rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-28660 
rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-17T00:00:00.000Z
CVE-2021-28661 
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T14:06:31.000Z
CVE-2021-28662 
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T00:00:00.000Z
CVE-2021-28663 
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T00:00:00.000Z
CVE-2021-28664 
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T00:00:00.000Z
CVE-2021-28665 
Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive consumption of memory and CPU resources, and possibly a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T19:26:35.000Z
CVE-2021-28667 
StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data (from an action or rule name).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T02:16:23.000Z
CVE-2021-28668 
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T19:28:09.000Z
CVE-2021-28669 
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T19:27:59.000Z
CVE-2021-28670 
Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T17:40:09.000Z
CVE-2021-28671 
Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 have a remote Command Execution vulnerability in the Web User Interface that allows remote attackers with "a weaponized clone file" to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T20:06:50.000Z
CVE-2021-28672 
Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 allows remote attackers to execute arbitrary code through a buffer overflow in Web page parameter handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T20:06:46.000Z
CVE-2021-28673 
Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.23 and 37.59.01 (Bridge), B405 before 38.61.23 and 38.59.01 (Bridge), B600/B610 before 32.61.23 and 32.59.01 (Bridge), B605/B615 before 33.61.23 and 33.59.01 (Bridge), B7025/30/35 before 58.61.23 and 58.59.11 (Bridge), C400 before 67.61.23 and 67.59.01 (Bridge), C405 before 68.61.23 and 68.59.01 (Bridge), C500/C600 before 61.61.23 and 61.59.01 (Bridge), C505/C605 before 62.61.23 and 62.59.11 (Bridge), C7000 before 56.61.23 and 56.59.01 (Bridge), C7020/25/30 before 57.61.23 and 57.59.01 (Bridge), C8000/C9000 before 70.61.23 and 70.59.01 (Bridge), allows remote attackers with "a weaponized clone file" to execute arbitrary commands in the Web User Interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T19:00:49.000Z
CVE-2021-28674 
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-27T15:41:04.000Z
CVE-2021-28675 
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T14:29:12.000Z
CVE-2021-28676 
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T00:00:00.000Z
CVE-2021-28677 
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T15:18:49.000Z
CVE-2021-28678 
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T15:16:23.000Z
CVE-2021-28680 
The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:32:18.000Z
CVE-2021-28681 
Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T03:20:06.000Z
CVE-2021-28682 
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T16:15:20.000Z
CVE-2021-28683 
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T16:34:19.000Z
CVE-2021-28684 
The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the network (via an XXE attack).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-21T12:13:26.000Z
CVE-2021-28685 
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by calling one of several driver routines that map physical memory into the virtual address space of the calling process) and to interact with MSR registers. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T10:18:54.000Z
CVE-2021-28686 
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This could enable low-privileged users to achieve Denial of Service via a DeviceIoControl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T10:19:42.000Z
CVE-2021-28687 
HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Olaf Hering.'}]}}}
Published: 2021-06-11T14:54:14.000Z
CVE-2021-28688 
The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11.
Problem types: description: unknown
Affected products: vendor: Linux
product: Linux
vendor: Linux
product: Linux
vendor: Linux
product: Linux
vendor: Linux
product: Linux
vendor: Linux
product: Linux
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Nicolai Stange of SUSE.'}]}}}
Published: 2021-04-06T18:07:41.000Z
CVE-2021-28689 
x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated.
Problem types: description: unknown
Affected products: vendor: Xen
product: Xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jann Horn of Google Project Zero.'}]}}}
Published: 2021-06-11T14:53:06.000Z
CVE-2021-28690 
x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Andrew Cooper of Citrix.'}]}}}
Published: 2021-06-29T11:16:36.000Z
CVE-2021-28691 
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
Problem types: description: unknown
Affected products: vendor: Linux
product: Linux
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Michael Brown of iPXE and diagnosed by\nOlivier Benjamin, Michael Kurth and Martin Mazein of AWS.'}]}}}
Published: 2021-06-29T11:30:53.000Z
CVE-2021-28692 
inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Igor Druzhinin and Andrew Cooper of Citrix,\nand further issues were uncovered by by Jan Beulich of SUSE while trying\nto fix the first issue.'}]}}}
Published: 2021-06-30T10:27:57.000Z
CVE-2021-28693 
xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Julien Grall of Amazon.'}]}}}
Published: 2021-06-30T10:32:26.000Z
CVE-2021-28694 
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}
Published: 2021-08-27T18:46:32.000Z
CVE-2021-28695 
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}
Published: 2021-08-27T18:46:33.000Z