rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-30357 
SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.
Problem types: cwe_id: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
Affected products: vendor: n/a
product: SSL Network Extender Client for Linux
Published: 2021-06-08T13:31:53.000Z
CVE-2021-30358 
Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: n/a
product: Check Point Mobile Access Portal Agent
Published: 2021-10-19T13:32:46.000Z
CVE-2021-30359 
The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation repair and place a specially crafted binary in the repair folder, which runs with the admin privileges.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Check Point Harmony Browse and SandBlast Agent for Browsers
Published: 2021-10-22T13:32:54.000Z
CVE-2021-30360 
Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder which runs with the Check Point Remote Access Client privileges.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Check Point Remote Access Client
Published: 2022-01-07T22:39:56.000Z
CVE-2021-30361 
The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: n/a
product: Check Point Gaia Portal
Published: 2022-05-11T16:42:52.000Z
CVE-2021-30454 
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T21:20:18.000Z
CVE-2021-30455 
An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in IdMap::clone_from upon a .clone panic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T21:20:07.000Z
CVE-2021-30456 
An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in get_or_insert upon a panic of a user-provided f function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T21:19:45.000Z
CVE-2021-30457 
An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in remove_set upon a panic in a Drop impl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T21:19:55.000Z
CVE-2021-30458 
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-09T06:06:04.000Z
CVE-2021-30459 
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T17:27:00.000Z
CVE-2021-30461 
A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value (which might contain PHP code) is injected into config/configuration.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-29T13:02:12.000Z
CVE-2021-30462 
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T13:54:15.000Z
CVE-2021-30463 
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&code= URI. This occurs because chmod is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T13:54:00.000Z
CVE-2021-30464 
OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T18:29:53.000Z
CVE-2021-30465 
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T00:00:00.000Z
CVE-2021-30468 Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Apache Software Foundation
product: Apache CXF
Published: 2021-06-16T12:00:18.000Z
CVE-2021-30469 
A flaw was found in PoDoFo 0.9.7. An use-after-free in PoDoFo::PdfVecObjects::Clear() function can cause a denial of service via a crafted PDF file.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: podofo
Published: 2021-05-26T21:37:05.000Z
CVE-2021-30470 
A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType() functions can lead to a stack overflow.
Problem types: cwe_id: CWE-674
description: CWE-674
Affected products: vendor: n/a
product: podofo
Published: 2021-05-26T21:37:28.000Z
CVE-2021-30471 
A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a stack overflow.
Problem types: cwe_id: CWE-674
description: CWE-674
Affected products: vendor: n/a
product: podofo
Published: 2021-05-26T21:38:04.000Z
CVE-2021-30472 
A flaw was found in PoDoFo 0.9.7. A stack-based buffer overflow in PdfEncryptMD5Base::ComputeOwnerKey function in PdfEncrypt.cpp is possible because of a improper check of the keyLength value.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: podofo
Published: 2021-05-26T21:38:26.000Z
CVE-2021-30473 
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T00:00:00.000Z
CVE-2021-30474 
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T00:00:00.000Z
CVE-2021-30475 
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-04T00:00:00.000Z
CVE-2021-30476 
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T16:23:20.000Z
CVE-2021-30477 
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T23:45:14.000Z
CVE-2021-30478 
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T23:47:27.000Z
CVE-2021-30479 
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T23:48:38.000Z
CVE-2021-30480 
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2021-04-09T22:03:47.000Z
CVE-2021-30481 
Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:R
version: 3.1
Published: 2021-04-10T18:31:34.000Z
CVE-2021-30482 
In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T12:16:27.000Z
CVE-2021-30483 
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-27T18:21:30.000Z
CVE-2021-30485 
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp() on a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-11T15:06:17.000Z
CVE-2021-30486 
SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp (GET computerID or group1), or AssetManagementSummary.jsp (GET group1).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T11:54:57.000Z
CVE-2021-30487 
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T23:43:01.000Z
CVE-2021-30490 
upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to modify files, allowing for privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T12:32:01.000Z
CVE-2021-30493 
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:49:47.000Z
CVE-2021-30494 
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:50:52.000Z
CVE-2021-30496 
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T00:00:00.000Z
CVE-2021-30497 
Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T01:22:07.000Z
CVE-2021-30498 
A flaw was found in libcaca. A heap buffer overflow in export.c in function export_tga might lead to memory corruption and other potential consequences.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: libcaca
Published: 2021-05-26T00:00:00.000Z
CVE-2021-30499 
A flaw was found in libcaca. A buffer overflow of export.c in function export_troff might lead to memory corruption and other potential consequences.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: libcaca
Published: 2021-05-26T23:50:10.000Z
CVE-2021-30500 
Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: upx
Published: 2021-05-26T23:51:50.000Z
CVE-2021-30501 
An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: upx
Published: 2021-05-26T23:54:30.000Z
CVE-2021-30502 
The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted workspace configuration with replCommand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-25T02:55:10.000Z
CVE-2021-30503 
The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in the workspace configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-13T01:15:24.000Z
CVE-2021-30504 
In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T11:32:37.000Z
CVE-2021-30506 
Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web application to inject scripts or HTML into a privileged page via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:32.000Z
CVE-2021-30507 
Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:33.000Z
CVE-2021-30508 
Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:34.000Z
CVE-2021-30509 
Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension.
Problem types: description: Out of bounds write
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:34.000Z
CVE-2021-30510 
Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Race
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:35.000Z
CVE-2021-30511 
Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:36.000Z
CVE-2021-30512 
Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:36.000Z
CVE-2021-30513 
Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:37.000Z
CVE-2021-30514 
Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:38.000Z
CVE-2021-30515 
Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:38.000Z
CVE-2021-30516 
Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:39.000Z
CVE-2021-30517 
Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:40.000Z
CVE-2021-30518 
Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:40.000Z
CVE-2021-30519 
Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:41.000Z
CVE-2021-30520 
Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-04T17:15:42.000Z
CVE-2021-30521 
Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-06-07T19:25:40.000Z
CVE-2021-30522 
Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-07T19:25:40.000Z
CVE-2021-30523 
Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-07T19:25:41.000Z
CVE-2021-30524 
Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-06-07T19:25:42.000Z