rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-31498 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12744.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: rgod
Published: 2021-06-15T19:11:41.000Z
CVE-2021-31499 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12745.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: rgod
Published: 2021-06-15T19:11:42.000Z
CVE-2021-31500 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12746.
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: rgod
Published: 2021-06-15T19:11:44.000Z
CVE-2021-31501 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13310.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-15T19:11:46.000Z
CVE-2021-31502 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13673.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-15T19:11:47.000Z
CVE-2021-31503 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IGS files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12690.
Problem types: cwe_id: CWE-824
description: CWE-824: Access of Uninitialized Pointer
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: rgod
Published: 2021-08-03T16:05:14.000Z
CVE-2021-31504 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12691.
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: rgod
Published: 2021-08-03T16:05:16.000Z
CVE-2021-31505 
This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The device can be booted into a special operation mode where hard-coded credentials are accepted for SSH authentication. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-12890.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: Arlo
product: Q Plus
Credits: lang: en
value: Team FLASHBACK: Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) + Radek Domanski (@RabbitPro)
Published: 2021-06-29T14:33:48.000Z
CVE-2021-31506 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13674.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:49.000Z
CVE-2021-31507 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12653.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: rgod
Published: 2021-06-29T14:33:50.000Z
CVE-2021-31508 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13306.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:50.000Z
CVE-2021-31509 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13309.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:51.000Z
CVE-2021-31510 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13675.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:52.000Z
CVE-2021-31511 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13676.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:53.000Z
CVE-2021-31512 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13677.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:54.000Z
CVE-2021-31513 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13678.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:55.000Z
CVE-2021-31514 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13679.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: OpenText
product: Brava! Desktop
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Published: 2021-06-29T14:33:56.000Z
CVE-2021-31515 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13668.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Vector 35
product: Binary Ninja
Credits: lang: en
value: Mat Powell of Trend Micro Zero Day Initiative
Published: 2021-06-29T14:33:57.000Z
CVE-2021-31516 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13670.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Vector 35
product: Binary Ninja
Credits: lang: en
value: Mat Powell of Trend Micro Zero Day Initiative
Published: 2021-06-29T14:33:58.000Z
CVE-2021-31517 
Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31518.
Problem types: description: File-Parsing DOS
Affected products: vendor: Trend Micro
product: Trend Micro Home Network Security
Published: 2021-05-05T15:04:56.000Z
CVE-2021-31518 
Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31517.
Problem types: description: File-Parsing DOS
Affected products: vendor: Trend Micro
product: Trend Micro Home Network Security
Published: 2021-05-05T15:05:03.000Z
CVE-2021-31519 
An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Problem types: description: Incorrect Permission Assignment
Affected products: vendor: Trend Micro
product: Trend Micro HouseCall for Home Networks
Published: 2021-05-12T14:57:42.000Z
CVE-2021-31520 
A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess currently logged-in administrators' session session token in order to gain access to the product's web management interface.
Problem types: description: Weak Session Token Authentication Bypass
Affected products: vendor: Trend Micro
product: Trend Micro IM Security
Published: 2021-05-10T11:00:31.000Z
CVE-2021-31521 
Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal.
Problem types: description: Reflected XSS
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2021-06-17T11:42:50.000Z
CVE-2021-31522 Apache Kylin unsafe class loading
Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Problem types: description: load any class
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
Credits: lang: en
value: bo yu <forhaby0@gmail.com>
Published: 2022-01-06T12:35:18.000Z
CVE-2021-31523 
The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T18:41:23.000Z
CVE-2021-31525 
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T12:17:11.000Z
CVE-2021-31530 
Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-29T13:11:56.000Z
CVE-2021-31531 
Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-29T13:13:12.000Z
CVE-2021-31532 
NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (silicon rev 0A, 1B), LPC55S1x, LPC551x (silicon rev 0A) and LPC55S0x, LPC550x (silicon rev 0A) include an undocumented ROM patch peripheral that allows unsigned, non-persistent modification of the internal ROM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T10:49:11.000Z
CVE-2021-31535 
LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T12:26:26.000Z
CVE-2021-31537 
SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T14:11:33.000Z
CVE-2021-31538 
LANCOM R&S Unified Firewall (UF) devices running LCOS FX 10.5 allow Relative Path Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T14:59:32.000Z
CVE-2021-31539 
Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-23T16:11:12.000Z
CVE-2021-31540 
Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local user is able to read and write to all the configuration files, e.g., modify the application server configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-23T16:10:17.000Z
CVE-2021-31542 
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T00:00:00.000Z
CVE-2021-31545 
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWiki usernames, related to rev_deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T02:30:59.000Z
CVE-2021-31546 
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have been visible to users with access to view AbuseFilter log data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T02:30:48.000Z
CVE-2021-31547 
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T02:30:35.000Z
CVE-2021-31548 
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T02:30:22.000Z