deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20791
Published: 2021-09-17
Description: Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to bypass access restriction and to exchange unauthorized files between the local environment and the isolated environment or settings of the web browser via unspecified vectors.
CVSS Score: 9.3 (CRITICAL)
References: https://jscom.jp/news-20210910_2/; https://jvn.jp/en/jp/JVN81658818/index.html; https://jscom.jp/news-20210910_2/
CVE: CVE-2021-20825
Published: 2021-09-17
Description: Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN46313661/index.html; https://www.ec-cube.net/products/detail.php?product_id=1419; https://jvn.jp/en/jp/JVN46313661/index.html
CVE: CVE-2021-20828
Published: 2021-09-17
Description: Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN23406150/index.html; https://www.activefusions.com/news/2021/20210915.html; https://jvn.jp/en/jp/JVN23406150/index.html
CVE: CVE-2021-3805
Published: 2021-09-17
Description: object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6; https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053; https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
CVE: CVE-2021-1939
Published: 2021-09-17
Description: Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1947
Published: 2021-09-17
Description: Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1976
Published: 2021-09-17
Description: A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-30260
Published: 2021-09-17
Description: Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuration command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-20, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-30261
Published: 2021-09-17
Description: Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-3803
Published: 2021-09-17
Description: nth-check is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726; https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0; https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html
CVE: CVE-2021-3804
Published: 2021-09-17
Description: taro is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/nervjs/taro/commit/acadb6c826ba57f2030a626f1de4f7b4608fcdb5; https://huntr.dev/bounties/0ebe85e6-cc85-42b8-957e-18d8df277414; https://github.com/nervjs/taro/commit/acadb6c826ba57f2030a626f1de4f7b4608fcdb5
CVE: CVE-2021-3807
Published: 2021-09-17
Description: ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9; https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-3810
Published: 2021-09-17
Description: code-server is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/cdr/code-server/commit/ca617df135e78833f93c8320cb2d2cf8bba809f5; https://huntr.dev/bounties/38888513-30fc-4d8f-805d-34070d60e223; https://github.com/cdr/code-server/commit/ca617df135e78833f93c8320cb2d2cf8bba809f5
CVE: CVE-2021-3811
Published: 2021-09-17
Description: adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pi-hole/adminlte/commit/f526716de7bb0fd382a64bcbbb33915c926f94bb; https://huntr.dev/bounties/fa38c61f-4043-4872-bc85-7fe5ae5cc2e8; https://github.com/pi-hole/adminlte/commit/f526716de7bb0fd382a64bcbbb33915c926f94bb
CVE: CVE-2021-3812
Published: 2021-09-17
Description: adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pi-hole/adminlte/commit/f526716de7bb0fd382a64bcbbb33915c926f94bb; https://huntr.dev/bounties/875a6885-9a64-46f3-94ad-92f40f989200; https://github.com/pi-hole/adminlte/commit/f526716de7bb0fd382a64bcbbb33915c926f94bb
CVE: CVE-2021-41303
Published: 2021-09-17
Description: Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://lists.apache.org/thread.html/raae98bb934e4bde304465896ea02d9798e257e486d04a42221e2c41b%40%3Cuser.shiro.apache.org%3E; https://lists.apache.org/thread.html/re470be1ffea44bca28ccb0e67a4cf5d744e2d2b981d00fdbbf5abc13%40%3Cannounce.shiro.apache.org%3E; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-23442
Published: 2021-09-17
Description: This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1321
References: https://github.com/tony-tsx/cookiex-deep/commit/b5bea2b7f34a5fa9abb4446cbd038ecdbcd09c88; https://github.com/tony-tsx/cookiex-deep/issues/1; https://snyk.io/vuln/SNYK-JS-COOKIEXDEEP-1582793
CVE: CVE-2021-39327
Published: 2021-09-17
Description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-459
References: http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.html; https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail=
CVE: CVE-2021-31842
Published: 2021-09-17
Description: XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-776, CWE-776
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10367; https://kc.mcafee.com/corporate/index?page=content&id=SB10367
CVE: CVE-2021-31843
Published: 2021-09-17
Description: Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would otherwise not have access to via manipulating junction links to redirect McAfee folder operations to an unintended location.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59, CWE-59
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10367; https://kc.mcafee.com/corporate/index?page=content&id=SB10367
CVE: CVE-2021-31844
Published: 2021-09-17
Description: A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.
CVSS Score: 8.2 (HIGH)
CWE: CWE-120, CWE-120
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10368; https://kc.mcafee.com/corporate/index?page=content&id=SB10368
CVE: CVE-2021-31845
Published: 2021-09-17
Description: A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro (.sam) files onto a machine and having DLP Discover scan it, leading to remote code execution with elevated privileges. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.
CVSS Score: 8.4 (HIGH)
CWE: CWE-120, CWE-120
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10368; https://kc.mcafee.com/corporate/index?page=content&id=SB10368
CVE: CVE-2021-39227
Published: 2021-09-17
Description: ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1321, CWE-1321
References: https://github.com/ecomfe/zrender/pull/826; https://github.com/ecomfe/zrender/releases/tag/5.2.1; https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf
CVE: CVE-2021-39228
Published: 2021-09-17
Description: Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-825, CWE-416
References: https://github.com/tremor-rs/tremor-runtime/commit/1a2efcdbe68e5e7fd0a05836ac32d2cde78a0b2e; https://github.com/tremor-rs/tremor-runtime/pull/1217; https://github.com/tremor-rs/tremor-runtime/releases/tag/v0.11.6
CVE: CVE-2021-41315
Published: 2021-09-17
Description: The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/; https://docs.device42.com/auto-discovery/remote-collector-rc/; https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/
CVE: CVE-2021-41316
Published: 2021-09-17
Description: The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/; https://docs.device42.com/auto-discovery/nmap-autodiscovery/; https://docs.device42.com/auto-discovery/remote-collector-rc/
CVE: CVE-2019-9060
Published: 2021-09-17
Description: An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://dev.cmsmadesimple.org/project/changelog/5819; https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285; https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
CVE: CVE-2021-38304
Published: 2021-09-17
Description: Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.ni.com/en-us/support/documentation/supplemental/21/improper-input-validation-in-ni-pal.html; https://www.ni.com/en-us/support/documentation/supplemental/21/improper-input-validation-in-ni-pal.html
CVE: CVE-2021-41317
Published: 2021-09-17
Description: XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://docs.google.com/document/d/12rq4YIFZLSmZlEsq7d7hYCI1qO5xyIxA1Wrs1m4y9-4/preview; https://github.com/mandatoryprogrammer/xsshunter-express/commit/56bb44ed9024849f64173f71583ecb7d873baba0; https://vuln.ryotak.me/advisories/57
CVE: CVE-2021-40825
Published: 2021-09-17
Description: nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. The nECY does not force a change to the key upon the initial configuration of an affected device. nECY system controllers utilize an encrypted channel to secure SensorViewTM configuration and monitoring software and nECY to nECY communications. Impacted devices are at risk of exploitation. A remote attacker with IP access to an impacted device could submit lighting control commands to the nECY by leveraging the default key. A successful attack may result in the attacker gaining the ability to modify lighting conditions or gain the ability to update the software on lighting devices. The impacted key is referred to as the SensorView Password in the nECY nLight Explorer Interface and the Gateway Password in the SensorView application. An attacker cannot authenticate to or modify the configuration or software of the nECY system controller.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1188
References: https://insights.acuitybrands.com/psirt-blog-2369078/nlight-eclypse-default-key-vulnerabiliy; https://www.acuitybrands.com/products/detail/588952/nlight/necy-system-controller/nlight-eclypset-system-controller; https://insights.acuitybrands.com/psirt-blog-2369078/nlight-eclypse-default-key-vulnerabiliy
CVE: CVE-2020-12080
Published: 2021-09-17
Description: A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2020-12080-Remediated-in-FlexNet-Publisher/ta-p/143873; https://community.flexera.com/t5/FlexNet-Publisher-News/FlexNet-Publisher-2020-R2-11-17-0-is-here/ba-p/144017/jump-to/first-unread-message; https://www.tenable.com/security/research/tra-2020-28
CVE: CVE-2020-12082
Published: 2021-09-17
Description: A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.flexera.com/t5/Code-Insight-Knowledge-Base/CVE-2020-12082-Remediated-in-Code-Insight/ta-p/169353; https://community.flexera.com/t5/Code-Insight-Knowledge-Base/CVE-2020-12082-Remediated-in-Code-Insight/ta-p/169353
CVE: CVE-2020-12083
Published: 2021-09-17
Description: An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).
CVSS Score: 9.9 (CRITICAL)
References: https://community.flexera.com/t5/Code-Insight-Knowledge-Base/CVE-2020-12083-Remediated-in-Code-Insight/ta-p/169356; https://community.flexera.com/t5/Code-Insight-Knowledge-Base/CVE-2020-12083-Remediated-in-Code-Insight/ta-p/169356
CVE: CVE-2021-41326
Published: 2021-09-17
Description: In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/MISP/MISP/commit/e36f73947e741bc97320f0c42199acd1a94c7051; https://github.com/MISP/MISP/compare/v2.4.147...v2.4.148; https://zigrin.com/advisories/misp-command-injection-vulnerability-in-opendata-export/
CVE: CVE-2018-20686
Published: 2021-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-38402
Published: 2021-09-17
Description: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02
CVE: CVE-2021-38404
Published: 2021-09-17
Description: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02
CVE: CVE-2021-38406
Published: 2021-09-17
Description: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38406
CVE: CVE-2021-38412
Published: 2021-09-17
Description: Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-257-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-257-01
CVE: CVE-2021-39216
Published: 2021-09-17
Description: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the host. If you do not have host code that matches one of these shapes, then you are not impacted. If Wasmtime's `VMExternRefActivationsTable` became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. The bug has been fixed, and users should upgrade to Wasmtime 0.30.0. If you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to `wasmtime::Config::wasm_reference_types`.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: https://crates.io/crates/wasmtime; https://github.com/bytecodealliance/wasmtime/commit/101998733b74624cbd348a2366d05760b40181f3; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf