deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33105
Published: 2022-02-09
Description: Out-of-bounds read in some Intel(R) Core(TM) processors with Radeon(TM) RX Vega M GL integrated graphics before version 21.10 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00481.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00481.html
CVE: CVE-2021-33107
Published: 2022-02-09
Description: Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before versions 11.0.0.0012, 12.0.0.0011, 14.0.0.0004 and 15.0.0.0004 may allow an unauthenticated user to potentially enable information disclosure via physical access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00575.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00601.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00575.html
CVE: CVE-2021-33110
Published: 2022-02-09
Description: Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00581.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00581.html
CVE: CVE-2021-33113
Published: 2022-02-09
Description: Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00582.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00582.html
CVE: CVE-2021-33114
Published: 2022-02-09
Description: Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00582.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00582.html
CVE: CVE-2021-33115
Published: 2022-02-09
Description: Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00582.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00582.html
CVE: CVE-2021-33119
Published: 2022-02-09
Description: Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00588.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00588.html
CVE: CVE-2021-33120
Published: 2022-02-09
Description: Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00589.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00589.html
CVE: CVE-2021-33129
Published: 2022-02-09
Description: Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00594.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00594.html
CVE: CVE-2021-33137
Published: 2022-02-09
Description: Out-of-bounds write in the Intel(R) Kernelflinger project may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00591.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00591.html
CVE: CVE-2021-33139
Published: 2022-02-09
Description: Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00604.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00604.html
CVE: CVE-2021-33147
Published: 2022-02-09
Description: Improper conditions check in the Intel(R) IPP Crypto library before version 2021.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00600.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00600.html
CVE: CVE-2021-33155
Published: 2022-02-09
Description: Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00604.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00604.html
CVE: CVE-2021-33166
Published: 2022-02-09
Description: Incorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00599.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00599.html
CVE: CVE-2021-37107
Published: 2022-02-09
Description: There is an improper memory access permission configuration on ACPU.Successful exploitation of this vulnerability may cause out-of-bounds access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-37109
Published: 2022-02-09
Description: There is a security protection bypass vulnerability with the modem.Successful exploitation of this vulnerability may cause memory protection failure.
CVSS Score: 7.8 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-37115
Published: 2022-02-09
Description: There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-39943
Published: 2022-02-09
Description: An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39943.json; https://gitlab.com/gitlab-org/gitlab/-/issues/343604; https://hackerone.com/reports/1375393
CVE: CVE-2021-39986
Published: 2022-02-09
Description: There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-39991
Published: 2022-02-09
Description: There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-39992
Published: 2022-02-09
Description: There is an improper security permission configuration vulnerability on ACPU.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-39994
Published: 2022-02-09
Description: There is an arbitrary address access vulnerability with the product line test code.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-39997
Published: 2022-02-09
Description: There is a vulnerability of unstrict input parameter verification in the audio assembly.Successful exploitation of this vulnerability may cause out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-40015
Published: 2022-02-09
Description: There is a race condition vulnerability in the binder driver subsystem in the kernel.Successful exploitation of this vulnerability may affect kernel stability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202202-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-40044
Published: 2022-02-09
Description: There is a permission verification vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may cause unauthorized operations.
CVSS Score: 8.8 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-40045
Published: 2022-02-09
Description: There is a vulnerability of signature verification mechanism failure in system upgrade through recovery mode.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://consumer.huawei.com/en/support/bulletin/2022/2/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202202-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE: CVE-2021-40696
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-44454
Published: 2022-02-09
Description: Improper input validation in a third-party component for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00632.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00632.html
CVE: CVE-2022-0162
Published: 2022-02-09
Description: The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perform administrative operations on the affected device through web-based management interface.
CVSS Score: 8.4 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0068; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0068
CVE: CVE-2022-0391
Published: 2022-02-09
Description: A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-74
References: https://bugs.python.org/issue43882; https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
CVE: CVE-2022-0529
Published: 2022-02-09
Description: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2051395; https://github.com/ByteHackr/unzip_poc; https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html
CVE: CVE-2022-0530
Published: 2022-02-09
Description: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2022/May/33; http://seclists.org/fulldisclosure/2022/May/35; http://seclists.org/fulldisclosure/2022/May/38
CVE: CVE-2022-0532
Published: 2022-02-09
Description: An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=2051730; https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls; https://bugzilla.redhat.com/show_bug.cgi?id=2051730
CVE: CVE-2022-0534
Published: 2022-02-09
Description: A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/michaelrsweet/htmldoc/commit/312f0f9c12f26fbe015cd0e6cefa40e4b99017d9; https://github.com/michaelrsweet/htmldoc/issues/463; https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
CVE: CVE-2022-20017
Published: 2022-02-09
Description: In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05862991; Issue ID: ALPS05862991.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20024
Published: 2022-02-09
Description: In system service, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219064; Issue ID: ALPS06219064.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20025
Published: 2022-02-09
Description: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06126832; Issue ID: ALPS06126832.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20026
Published: 2022-02-09
Description: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06126827; Issue ID: ALPS06126827.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20027
Published: 2022-02-09
Description: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06126826; Issue ID: ALPS06126826.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20028
Published: 2022-02-09
Description: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06198663; Issue ID: ALPS06198663.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20029
Published: 2022-02-09
Description: In cmdq driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05747150; Issue ID: ALPS05747150.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20030
Published: 2022-02-09
Description: In vow driver, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05837793; Issue ID: ALPS05837793.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20031
Published: 2022-02-09
Description: In fb driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05850708; Issue ID: ALPS05850708.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20032
Published: 2022-02-09
Description: In vow driver, there is a possible memory corruption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05852822; Issue ID: ALPS05852822.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20033
Published: 2022-02-09
Description: In camera driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05862973; Issue ID: ALPS05862973.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20034
Published: 2022-02-09
Description: In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160806.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20035
Published: 2022-02-09
Description: In vcu driver, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171675; Issue ID: ALPS06171675.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20036
Published: 2022-02-09
Description: In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171689; Issue ID: ALPS06171689.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022
CVE: CVE-2022-20037
Published: 2022-02-09
Description: In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171705; Issue ID: ALPS06171705.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2022; https://corp.mediatek.com/product-security-bulletin/February-2022