rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-29152 
A remote denial of service (DoS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote denial of service (DoS)
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-07-08T15:27:33.000Z
CVE-2021-29154 
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T00:00:00.000Z
CVE-2021-29155 
An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T00:00:00.000Z
CVE-2021-29156 
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-25T08:20:13.000Z
CVE-2021-29157 
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2021-06-28T11:58:41.000Z
CVE-2021-29158 
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-23T20:34:00.000Z
CVE-2021-29159 
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-28T13:14:41.000Z
CVE-2021-29200 RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
Problem types: description: Java serialisation
Affected products: vendor: Apache Software Foundation
product: Apache OFBiz
Credits: lang: en
value: Apache OFBiz would like to thank the first report from "r00t4dm at Cloud-Penetrating Arrow Lab, asd of MoyunSec V-Lab <root@thiscode.cc> and 赖涵 <1044309102@qq.com>  a bit later
Published: 2021-04-27T19:50:13.000Z
CVE-2021-29201 
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote xss
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T13:24:14.000Z
CVE-2021-29202 
A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: local buffer overflow
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T13:24:19.000Z
CVE-2021-29203 
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. HPE has released a software update to resolve the vulnerability in the HPE Edgeline Infrastructure Manager.
Problem types: description: remote authentication bypass
Affected products: vendor: n/a
product: HPE Edgeline Infrastructure Management Software
Published: 2021-05-06T20:17:36.000Z
CVE-2021-29204 
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote xss
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T13:37:40.000Z
CVE-2021-29205 
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote xss
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T13:37:43.000Z
CVE-2021-29206 
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote xss
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T13:53:25.000Z
CVE-2021-29207 
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote xss
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T13:53:29.000Z
CVE-2021-29208 
A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote dom xss, crlf injection
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T14:32:42.000Z
CVE-2021-29209 
A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote dom xss, crlf injection
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T14:32:49.000Z
CVE-2021-29210 
A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote dom xss, crlf injection
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T14:11:03.000Z
CVE-2021-29211 
A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Problem types: description: remote xss
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2021-05-25T14:11:09.000Z
CVE-2021-29212 
A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality, integrity, and availability of the iLO Amplifier Pack appliance.
Problem types: description: remote directory traversal
Affected products: vendor: n/a
product: iLO Amplifier Pack
Published: 2021-11-01T13:18:43.000Z
CVE-2021-29213 
A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant MicroServer Gen10 Plus server's system ROMs prior to version 2.52. The vulnerability could be locally exploited to cause disclosure of sensitive information, denial of service (DoS), and/or compromise system integrity.
Problem types: description: local bypass security restrictions; local compromise of system integrity; local denial of service (DoS); local disclosure of sensitive information
Affected products: vendor: n/a
product: HPE ProLiant ML30 Gen10 Server; HPE ProLiant DL20 Gen10 Server; HPE ProLiant MicroServer Gen10 Plus
Published: 2021-11-01T13:17:32.000Z
CVE-2021-29214 
A security vulnerability has been identified in HPE StoreServ Management Console (SSMC). An authenticated SSMC administrator could exploit the vulnerability to inject code and elevate their privilege in SSMC. The scope of this vulnerability is limited to SSMC. Note: The arrays being managed are not impacted by this vulnerability. This vulnerability impacts SSMC versions 3.4 GA to 3.8.1.
Problem types: description: remote arbitrary code execution
Affected products: vendor: n/a
product: HPE StoreServ Management Console (SSMC); HPE 3PAR StoreServ Management and Core Software Media
Published: 2021-12-10T16:41:37.000Z
CVE-2021-29215 
A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem component was discovered in version(s): Prior to Tez-0.8: mapr-tez-0.8.201907081100-1.noarch; prior to Tez-0.9: mapr-tez-0.9.201907090334-1.noarch; prior to Tez-0.9.2: mapr-tez-0.9.2.0.201907081043-1.noarch. HPE has provided software updates to resolve the vulnerability in the TEZ MapR ecosystem component in HPE Ezmeral Data Fabric.
Problem types: description: remote access restriction bypass
Affected products: vendor: n/a
product: HPE Ezmeral Data Fabric
Published: 2022-01-18T16:52:33.000Z
CVE-2021-29216 
A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard.
Problem types: description: remote cross-site scripting
Affected products: vendor: n/a
product: HPE OneView Global Dashboard
Published: 2022-02-24T21:04:06.000Z
CVE-2021-29217 
A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard.
Problem types: description: remote URL redirection
Affected products: vendor: n/a
product: HPE OneView Global Dashboard
Published: 2022-02-24T21:04:45.000Z
CVE-2021-29218 
A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0. This vulnerability could be exploited locally by a user with high privileges to execute malware that may lead to a loss of confidentiality, integrity, and availability. HPE has provided software updates to resolve the vulnerability in HPE Agentless Management Service for Windows.
Problem types: description: local unquoted search path
Affected products: vendor: n/a
product: HPE Agentless Management
Published: 2022-02-04T22:29:15.000Z
CVE-2021-29219 
A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130_EI_7.10.R3507P02. HPE has made the following software update to resolve the vulnerability in HPE FlexNetwork 5130 EL Switch Series version 5130_EL_7.10.R3507P02.
Problem types: description: local buffer overflow
Affected products: vendor: n/a
product: HPE FlexNetwork 5130 EI Switch Series
Published: 2022-02-04T22:29:15.000Z
CVE-2021-29220 
Multiple buffer overflow security vulnerabilities have been identified in HPE iLO Amplifier Pack version(s): Prior to 2.12. These vulnerabilities could be exploited by a highly privileged user to remotely execute code that could lead to a loss of confidentiality, integrity, and availability. HPE has provided a software update to resolve this vulnerability in HPE iLO Amplifier Pack.
Problem types: description: remote buffer overflow
Affected products: vendor: n/a
product: iLO Amplifier Pack
Published: 2022-02-24T21:05:28.000Z
CVE-2021-29221 
A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.
Problem types: description: Incorrect Access Control
Affected products: vendor: Erlang Project
product: Erlang/OTP
Published: 2021-04-09T13:34:59.000Z
CVE-2021-29238 
CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T13:24:01.000Z
CVE-2021-29239 
CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T13:43:48.000Z
CVE-2021-29240 
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-04T11:00:38.000Z
CVE-2021-29241 
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T13:17:03.000Z
CVE-2021-29242 
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T13:56:06.000Z
CVE-2021-29243 
Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T12:41:13.000Z
CVE-2021-29245 
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T12:25:34.000Z
CVE-2021-29246 
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T12:25:43.000Z
CVE-2021-29247 
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T12:25:49.000Z
CVE-2021-29248 
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T12:25:55.000Z
CVE-2021-29249 
BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T22:20:08.000Z
CVE-2021-29250 
BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality. This enables cookie stealing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T12:26:01.000Z
CVE-2021-29251 
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker use cases in which a mail server is configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:42:18.000Z
CVE-2021-29252 
RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields could potentially exploit this vulnerability to execute code in a victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N
version: 3.1
Published: 2021-05-26T03:56:19.000Z
CVE-2021-29253 
The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:L/A:N/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-05-26T03:57:50.000Z
CVE-2021-29255 
MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on the same network as the device can capture these credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T17:27:07.000Z
CVE-2021-29256 
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:56:27.000Z
CVE-2021-29258 
An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T16:40:46.000Z
CVE-2021-29261 
The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T06:15:21.000Z
CVE-2021-29262 Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Apache Software Foundation
product: Apache Solr
Credits: lang: en
value: Timothy Potter and Mike Drob, Apple Cloud Services
Published: 2021-04-13T06:35:21.000Z
CVE-2021-29263 
In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T11:30:48.000Z
CVE-2021-29264 
An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T21:35:57.000Z
CVE-2021-29265 
An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T21:35:37.000Z
CVE-2021-29266 
An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T21:35:17.000Z