rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20180 
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: n/a
product: Ansible
Published: 2022-03-16T14:12:30.000Z
CVE-2021-20181 
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
Problem types: cwe_id: CWE-367
description: CWE-367->CWE-416
Affected products: vendor: n/a
product: qemu
Published: 2021-05-13T15:24:15.000Z
CVE-2021-20182 
A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this build container, they can potentially utilize the raw devices of the underlying node, such as the network and storage devices, to at least escalate their privileges to that of the cluster admin. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-552
description: CWE-552
Affected products: vendor: n/a
product: openshift
Published: 2021-02-23T21:32:26.000Z
CVE-2021-20183 
It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: moodle
Published: 2021-01-28T18:36:39.000Z
CVE-2021-20184 
It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades.
Problem types: cwe_id: CWE-354
description: CWE-354
Affected products: vendor: n/a
product: moodle
Published: 2021-01-28T18:44:27.000Z
CVE-2021-20185 
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: moodle
Published: 2021-01-28T19:01:04.000Z
CVE-2021-20186 
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: moodle
Published: 2021-01-28T18:38:03.000Z
CVE-2021-20187 
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: n/a
product: moodle
Published: 2021-01-28T18:30:03.000Z
CVE-2021-20188 
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: podman
Published: 2021-02-11T15:31:47.000Z
CVE-2021-20190 
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: n/a
product: jackson-databind
Published: 2021-01-19T16:27:58.000Z
CVE-2021-20191 
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: n/a
product: ansible
Published: 2021-05-26T00:00:00.000Z
CVE-2021-20193 
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-401
description: CWE-401->CWE-125
Affected products: vendor: n/a
product: tar
Published: 2021-03-26T16:41:23.000Z
CVE-2021-20194 
There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: kernel
Published: 2021-02-23T22:33:24.000Z
CVE-2021-20195 
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: keycloak
Published: 2021-05-28T10:42:09.000Z
CVE-2021-20196 
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: qemu
Published: 2021-05-26T21:16:58.000Z
CVE-2021-20197 
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.
Problem types: cwe_id: CWE-59
description: CWE-59
Affected products: vendor: n/a
product: binutils
Published: 2021-03-26T16:47:20.000Z
CVE-2021-20198 
A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this port during installation can make unauthenticated `/exec` requests to execute arbitrary commands within running containers. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: n/a
product: openshift/installer
Published: 2021-02-23T17:45:25.000Z
CVE-2021-20199 
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
Problem types: cwe_id: CWE-346
description: CWE-346
Affected products: vendor: n/a
product: podman
Published: 2021-02-02T18:12:26.000Z
CVE-2021-20201 
A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: spice
Published: 2021-05-28T10:42:15.000Z
CVE-2021-20202 
A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
Problem types: cwe_id: CWE-377
description: CWE-377
Affected products: vendor: n/a
product: keycloak
Published: 2021-05-12T14:40:00.000Z
CVE-2021-20203 
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: qemu
Published: 2021-02-25T19:09:46.000Z
CVE-2021-20204 
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: getdata
Published: 2021-05-06T14:50:52.000Z
CVE-2021-20205 
Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted GIF image.
Problem types: description: Divide By Zero
Affected products: vendor: n/a
product: Libjpeg-turbo
Published: 2021-03-10T16:21:58.000Z
CVE-2021-20206 
An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-20
description: CWE-20->CWE-22
Affected products: vendor: n/a
product: containernetworking-cni
Published: 2021-03-26T21:34:58.000Z
CVE-2021-20208 
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
Problem types: cwe_id: CWE-266
description: CWE-266
Affected products: vendor: n/a
product: cifs-utils
Published: 2021-04-19T21:12:00.000Z
CVE-2021-20209 
A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: privoxy
Published: 2021-05-25T19:34:09.000Z
CVE-2021-20210 
A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can lead to a system crash.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:02.000Z
CVE-2021-20211 
A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:08.000Z
CVE-2021-20212 
A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcre error leading to a system crash.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:16.000Z
CVE-2021-20213 
A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:26.000Z
CVE-2021-20214 
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail can lead to a system crash.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:34.000Z
CVE-2021-20215 
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to a system crash.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:41.000Z
CVE-2021-20216 
A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:49.000Z
CVE-2021-20217 
A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead to denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-617
description: CWE-617
Affected products: vendor: n/a
product: privoxy
Published: 2021-03-25T18:57:55.000Z
CVE-2021-20218 
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: n/a
product: fabric8-kubernetes-client
Published: 2021-03-16T21:00:32.000Z
CVE-2021-20219 
A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could delay the loop (due to a changing ldata->read_head, and a missing sanity check) and cause a threat to the system availability.
Problem types: cwe_id: CWE-697
description: CWE-697
Affected products: vendor: n/a
product: kernel
Published: 2021-03-23T16:34:00.000Z
CVE-2021-20220 
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Problem types: cwe_id: CWE-444
description: CWE-444
Affected products: vendor: n/a
product: undertow
Published: 2021-02-23T17:21:44.000Z
CVE-2021-20221 
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Problem types: cwe_id: CWE-125
description: CWE-125->CWE-787
Affected products: vendor: n/a
product: qemu
Published: 2021-05-13T15:34:48.000Z
CVE-2021-20222 
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: keycloak
Published: 2021-03-23T16:36:39.000Z
CVE-2021-20224 
An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash.
Problem types: cwe_id: CWE-190
description: CWE-190 - Integer Overflow or Wraparound
Affected products: vendor: n/a
product: ImageMagick
Published: 2022-08-25T00:00:00.000Z
CVE-2021-20225 
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: grub2
Published: 2021-03-03T16:44:26.000Z
CVE-2021-20226 
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2021-02-23T16:36:29.000Z
CVE-2021-20227 
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: sqlite
Published: 2021-03-23T00:00:00.000Z
CVE-2021-20228 
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200->CWE-522
Affected products: vendor: n/a
product: ansible
Published: 2021-04-29T15:34:08.000Z
CVE-2021-20229 
A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: PostgreSQL
Published: 2021-02-23T17:40:53.000Z
CVE-2021-20230 
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: n/a
product: stunnel
Published: 2021-02-23T16:34:39.000Z
CVE-2021-20231 
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: gnutls
Published: 2021-03-12T18:23:59.000Z
CVE-2021-20232 
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: gnutls
Published: 2021-03-12T18:25:29.000Z
CVE-2021-20233 
A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: grub2
Published: 2021-03-03T16:44:34.000Z
CVE-2021-20234 
An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: zeromq
Published: 2021-04-01T13:46:33.000Z
CVE-2021-20235 
There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality.
Problem types: cwe_id: CWE-120
description: CWE-120->CWE-787
Affected products: vendor: n/a
product: zeromq
Published: 2021-04-01T13:47:05.000Z
CVE-2021-20236 
A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-120
description: CWE-120->CWE-787
Affected products: vendor: n/a
product: zeromq
Published: 2021-05-28T10:42:19.000Z