deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24751
Published: 2022-03-16
Description: Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-362
References: https://github.com/zulip/zulip/commit/62ba8e455d8f460001d9fb486a6dabfd1ed67717; https://github.com/zulip/zulip/commit/e6eace307ef435eec3395c99247155efed9219e4; https://github.com/zulip/zulip/security/advisories/GHSA-6v98-m5x5-phqj
CVE: CVE-2020-25721
Published: 2022-03-16
Description: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2021728; https://bugzilla.samba.org/show_bug.cgi?id=14725; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2021-0957
Published: 2022-03-16
Description: In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-193149550
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-20180
Published: 2022-03-16
Description: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1915808; https://bugzilla.redhat.com/show_bug.cgi?id=1915808
CVE: CVE-2021-20257
Published: 2022-03-16
Description: An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1930087; https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2021-20299
Published: 2022-03-16
Description: A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740; https://bugzilla.redhat.com/show_bug.cgi?id=1939154; https://github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0f
CVE: CVE-2021-23158
Published: 2022-03-16
Description: A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-where condition, allowing an attacker to execute arbitrary code and denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967018; https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc; https://github.com/michaelrsweet/htmldoc/issues/414
CVE: CVE-2021-23165
Published: 2022-03-16
Description: A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967014; https://github.com/michaelrsweet/htmldoc/commit/6e8a[PII_REDACTED]0b5b5ae4861b3b0cbf4fba517f; https://github.com/michaelrsweet/htmldoc/commit/6e8a[PII_REDACTED]0b5b5ae4861b3b0cbf4fba517f.patch
CVE: CVE-2021-33853
Published: 2022-03-16
Description: A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2021-33853-stored-cross-site-scripting-in-x2crm.html; https://cybersecurityworks.com/zerodays/cve-2021-33853-stored-cross-site-scripting-in-x2crm.html
CVE: CVE-2021-39624
Published: 2022-03-16
Description: In PackageManager, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-67862680
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2022-06-01; https://source.android.com/security/bulletin/2022-06-01
CVE: CVE-2021-39667
Published: 2022-03-16
Description: In ih264d_parse_decode_slice of ih264d_parse_slice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-205702093
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39685
Published: 2022-03-16
Description: In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39686
Published: 2022-03-16
Description: In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39689
Published: 2022-03-16
Description: In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-206090748
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-345
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39690
Published: 2022-03-16
Description: In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-204316511
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1284
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39692
Published: 2022-03-16
Description: In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-209611539
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39693
Published: 2022-03-16
Description: In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-208662370
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39694
Published: 2022-03-16
Description: In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-202312327
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39695
Published: 2022-03-16
Description: In createOrUpdate of BasePermission.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-209607944
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39697
Published: 2022-03-16
Description: In checkFileUriDestination of DownloadProvider.java, there is a possible way to bypass external storage private directories protection due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-200813547
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39698
Published: 2022-03-16
Description: In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39701
Published: 2022-03-16
Description: In serviceConnection of ControlsProviderLifecycleManager.kt, there is a possible way to keep service running in foreground without notification or permission due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-212286849
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39702
Published: 2022-03-16
Description: In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates without user approval due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-205150380
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39703
Published: 2022-03-16
Description: In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-207057578
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39704
Published: 2022-03-16
Description: In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-209965481
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39705
Published: 2022-03-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-39706
Published: 2022-03-16
Description: In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-200164168
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39707
Published: 2022-03-16
Description: In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-200688991
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39708
Published: 2022-03-16
Description: In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-206128341
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39709
Published: 2022-03-16
Description: In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-208817618
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-03-01; https://source.android.com/security/bulletin/2022-03-01
CVE: CVE-2021-39710
Published: 2022-03-16
Description: Product: AndroidVersions: Android kernelAndroid ID: A-202160245References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39711
Published: 2022-03-16
Description: In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154175781References: Upstream kernel
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39712
Published: 2022-03-16
Description: In TBD of TBD, there is a possible user after free vulnerability due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-176918884References: N/A
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39713
Published: 2022-03-16
Description: Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39714
Published: 2022-03-16
Description: In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205573273References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-416
References: https://source.android.com/security/bulletin/pixel/2022-08-01; https://source.android.com/security/bulletin/pixel/2022-08-01
CVE: CVE-2021-39715
Published: 2022-03-16
Description: In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-178379135References: Upstream kernel
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39716
Published: 2022-03-16
Description: Product: AndroidVersions: Android kernelAndroid ID: A-206977562References: N/A
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39717
Published: 2022-03-16
Description: In iaxxx_btp_write_words of iaxxx-btp.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-198653629References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39718
Published: 2022-03-16
Description: In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205035540References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39719
Published: 2022-03-16
Description: In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205995178References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39720
Published: 2022-03-16
Description: Product: AndroidVersions: Android kernelAndroid ID: A-207433926References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39721
Published: 2022-03-16
Description: In TBD of TBD, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195726151References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39722
Published: 2022-03-16
Description: In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204585345References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39723
Published: 2022-03-16
Description: Product: AndroidVersions: Android kernelAndroid ID: A-209014813References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01
CVE: CVE-2021-39724
Published: 2022-03-16
Description: In TuningProviderBase::GetTuningTreeSet of tuning_provider_base.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205753190References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-03-01; https://source.android.com/security/bulletin/pixel/2022-03-01