rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-21744 
ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration parameters of the device, causing some security functions of the device to be disabled.
Problem types: description: configuration file control
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T15:18:18.000Z
CVE-2021-21745 
ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click.
Problem types: description: Referer authentication bypass
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T15:20:50.000Z
CVE-2021-21746 
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.
Problem types: description: XSS
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T14:34:39.000Z
CVE-2021-21747 
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.
Problem types: description: XSS
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T14:38:33.000Z
CVE-2021-21748 
ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code.
Problem types: description: stack-based buffer overflow
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T15:24:44.000Z
CVE-2021-21749 
ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code.
Problem types: description: stack-based buffer overflow
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T15:22:06.000Z
CVE-2021-21750 
ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized access.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: ZXIN10 CMS
Published: 2021-12-27T18:48:25.000Z
CVE-2021-21751 
ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications when configuring the large screen page, an attacker with high privileges could exploit this vulnerability to tamper with the URL and cause service exception.
Problem types: description: input verification
Affected products: vendor: n/a
product: ZXIN10 CMS
Published: 2021-12-27T18:48:25.000Z
CVE-2021-21772 
A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: description: use-after-free
Affected products: vendor: n/a
product: 3MF
Published: 2021-03-10T00:00:00.000Z
CVE-2021-21773 
An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: n/a
product: Accusoft
Published: 2021-03-31T13:59:31.000Z
CVE-2021-21775 
A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Webkit
Published: 2021-07-07T21:18:18.000Z
CVE-2021-21776 
An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: n/a
product: Accusoft
Published: 2021-03-31T14:00:37.000Z
CVE-2021-21777 
An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted network request can lead to an out-of-bounds read.
Problem types: description: out of bounds read
Affected products: vendor: n/a
product: EIP Stack Group
Published: 2021-06-17T10:48:54.000Z
CVE-2021-21778 
A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0. A specially crafted network request can lead to loss of communications. An attacker can send an unauthenticated message to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: n/a
product: MZ Automation"
Published: 2021-08-25T18:27:21.000Z
CVE-2021-21779 
A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Webkit
Published: 2021-07-08T11:21:56.000Z
CVE-2021-21781 
An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11
Problem types: cwe_id: CWE-908
description: CWE-908: Use of Uninitialized Resource
Affected products: vendor: n/a
product: Linux Kernel
Published: 2021-08-18T14:37:46.000Z
CVE-2021-21782 
An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: n/a
product: Accusoft
Published: 2021-03-31T14:00:57.000Z
CVE-2021-21783 
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: n/a
product: Genivia
Published: 2021-03-25T16:01:12.000Z
CVE-2021-21784 
An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: n/a
product: Accusoft
Published: 2021-04-13T18:08:43.000Z
CVE-2021-21785 
An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: IOBit
Published: 2021-08-05T20:06:11.000Z
CVE-2021-21786 
A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to increased privileges. An attacker can send a malicious IRP to trigger this vulnerability.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: Iobit
Published: 2021-07-07T16:49:38.000Z
CVE-2021-21787 
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the first dword passed in the input buffer is the device port to write to and the byte at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: Iobit
Published: 2021-07-07T16:39:44.000Z
CVE-2021-21788 
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the first dword passed in the input buffer is the device port to write to and the word at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users. A local attacker can send a malicious IRP to trigger this vulnerability.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: Iobit
Published: 2021-07-07T16:39:51.000Z
CVE-2021-21789 
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0e0, the first dword passed in the input buffer is the device port to write to and the dword at offset 4 is the value to write via the OUT instruction. A local attacker can send a malicious IRP to trigger this vulnerability.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: Iobit
Published: 2021-07-07T16:40:02.000Z
CVE-2021-21790 
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: IOBit
Published: 2021-08-05T20:04:59.000Z
CVE-2021-21791 
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: IOBit
Published: 2021-08-05T20:05:04.000Z
CVE-2021-21792 
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read four bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
Problem types: cwe_id: CWE-782
description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: IObit
Published: 2021-08-05T20:05:08.000Z
CVE-2021-21793 
An out-of-bounds write vulnerability exists in the JPG sof_nb_comp header processing functionality of Accusoft ImageGear 19.8 and 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: n/a
product: Accusoft
Published: 2021-07-08T11:11:53.000Z
CVE-2021-21794 
An out-of-bounds write vulnerability exists in the TIF bits_per_sample processing functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: n/a
product: Accusoft"
Published: 2021-07-08T11:18:18.000Z
CVE-2021-21795 
A heap-based buffer overflow vulnerability exists in the PSD read_icc_icCurve_data functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to an integer overflow that, in turn, leads to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Accusoft
Published: 2021-06-11T16:17:10.000Z
CVE-2021-21796 
An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Nitro Pro
Published: 2021-10-18T12:42:51.000Z
CVE-2021-21797 
An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
Problem types: cwe_id: CWE-415
description: CWE-415: Double Free
Affected products: vendor: n/a
product: Nitro Pro
Published: 2021-10-18T12:45:35.000Z
CVE-2021-21798 
An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger the vulnerability.
Problem types: cwe_id: CWE-562
description: CWE-562: Return of Stack Variable Address
Affected products: vendor: n/a
product: Nitro Pro
Published: 2021-09-15T13:19:16.000Z
CVE-2021-21799 
Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Advantech
Published: 2021-07-16T10:33:51.000Z
CVE-2021-21800 
Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Advantech
Published: 2021-07-16T10:33:56.000Z
CVE-2021-21801 
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Advantech
Published: 2021-07-16T10:37:13.000Z
CVE-2021-21802 
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Advantech
Published: 2021-07-16T10:37:19.000Z
CVE-2021-21803 
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Advantech
Published: 2021-07-16T10:37:30.000Z
CVE-2021-21804 
A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-98
description: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: n/a
product: Advantech
Published: 2021-07-16T10:34:02.000Z
CVE-2021-21805 
An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: n/a
product: Advantech
Published: 2021-08-05T20:03:59.000Z
CVE-2021-21806 
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in remote code execution. The victim needs to visit a malicious web site to trigger the vulnerability.
Problem types: description: use-after-free
Affected products: vendor: n/a
product: Webkit
Published: 2021-07-08T11:06:47.000Z
CVE-2021-21807 
An integer overflow vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to a stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: n/a
product: Accusoft
Published: 2021-07-07T21:30:30.000Z
CVE-2021-21808 
A memory corruption vulnerability exists in the PNG png_palette_process functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide malicious inputs to trigger this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: n/a
product: Accusoft
Published: 2021-06-11T16:15:29.000Z
CVE-2021-21809 
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
Problem types: description: OS command injection
Affected products: vendor: n/a
product: Moodle
Published: 2021-06-23T21:25:46.000Z
CVE-2021-21810 
A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: AT&T Labs
Published: 2021-08-17T19:17:59.000Z
CVE-2021-21811 
A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: n/a
product: AT&T
Published: 2021-08-31T16:56:06.000Z
CVE-2021-21812 
A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs’ Xmill 0.7. Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strcpy copying the path provided by the user into a static sized buffer without any length checks resulting in a stack-buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.
Problem types: description: stack based buffer overflow
Affected products: vendor: n/a
product: AT&T
Published: 2021-08-13T22:39:44.000Z
CVE-2021-21813 
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to memcpy copying the path provided by the user into a staticly sized buffer without any length checks resulting in a stack-buffer overflow.
Problem types: description: stack-based buffer overflow
Affected products: vendor: n/a
product: AT&T
Published: 2021-08-13T22:40:18.000Z
CVE-2021-21814 
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strlen to determine the ending location of the char* passed in by the user, no checks are done to see if the passed in char* is longer than the staticly sized buffer data is memcpy‘d into, but after the memcpy a null byte is written to what is assumed to be the end of the buffer to terminate the char*, but without length checks, this null write occurs at an arbitrary offset from the buffer. An attacker can provide malicious input to trigger this vulnerability.
Problem types: description: stack-based buffer overflow
Affected products: vendor: n/a
product: AT&T
Published: 2021-08-13T22:39:59.000Z