rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-26931 
An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T00:00:00.000Z
CVE-2021-26932 
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T00:00:00.000Z
CVE-2021-26933 
An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T01:05:46.000Z
CVE-2021-26934 
An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn't stated accordingly in its support status entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T01:07:59.000Z
CVE-2021-26935 
In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the event_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T14:06:55.000Z
CVE-2021-26936 
The replay-sorcery program in ReplaySorcery 0.4.0 through 0.5.0, when using the default setuid-root configuration, allows a local attacker to escalate privileges to root by specifying video output paths in privileged locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T17:53:59.000Z
CVE-2021-26937 
encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T19:35:50.000Z
CVE-2021-26938 
A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web design agency and 5.2.17 is simply the PHP version running on this hosts
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T17:54:46.000Z
CVE-2021-26939 
An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. NOTE: third parties report that this is a site-specific problem
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T17:55:31.000Z
CVE-2021-26943 
The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM (issue 3 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T19:26:31.000Z
CVE-2021-26945 
An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: OpenEXR
Published: 2021-06-08T11:39:06.000Z
CVE-2021-26947 
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
default_status: unaffected
vendor: Odoo
product: Odoo Enterprise
default_status: unaffected
Credits: lang: eng
value: Nils Hamerlinck
lang: eng
value: Andreas Perhab
Published: 2023-04-25T18:33:41.553Z
CVE-2021-26948 
Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file.
Problem types: cwe_id: CWE-479
description: CWE-479->CWE-476
Affected products: vendor: n/a
product: htmldoc
Published: 2022-03-03T00:00:00.000Z
CVE-2021-26950 
Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products
Published: 2022-08-18T19:44:19.000Z
CVE-2021-26951 
An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:07:49.000Z
CVE-2021-26952 
An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:07:42.000Z
CVE-2021-26953 
An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:06:38.000Z
CVE-2021-26954 
An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:07:33.000Z
CVE-2021-26955 
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:07:26.000Z
CVE-2021-26956 
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:06:48.000Z
CVE-2021-26957 
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:07:18.000Z
CVE-2021-26958 
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T22:07:10.000Z
CVE-2021-26960 
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
Problem types: description: remote unauthenticated cross-site request forgery (csrf)
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T15:57:56.000Z
CVE-2021-26961 
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
Problem types: description: remote unauthenticated cross-site request forgery (csrf)
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T15:50:56.000Z
CVE-2021-26962 
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.
Problem types: description: remote authenticated arbitrary command execution
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T15:56:03.000Z
CVE-2021-26963 
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.
Problem types: description: remote authenticated arbitrary command execution
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:08:40.000Z
CVE-2021-26964 
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.
Problem types: description: remote authentication restriction bypass
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:06:09.000Z
CVE-2021-26965 
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
Problem types: description: remote authenticated sql injection
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:29:58.000Z
CVE-2021-26966 
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
Problem types: description: remote authenticated sql injection
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:10:31.000Z
CVE-2021-26967 
A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of certain components of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the AirWave management interface.
Problem types: description: remote reflected cross-site scripting (xss)
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:33:05.000Z
CVE-2021-26968 
A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface.
Problem types: description: remote authenticated stored cross-site scripting (xss)
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:35:26.000Z
CVE-2021-26969 
A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
Problem types: description: remote authenticated authenticated xml external entity (xxe)
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:41:32.000Z
CVE-2021-26970 
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
Problem types: description: remote authenticated arbitrary command execution
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:37:10.000Z
CVE-2021-26971 
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
Problem types: description: remote authenticated arbitrary command execution
Affected products: vendor: n/a
product: Aruba AirWave Management Platform
Published: 2021-03-05T16:43:48.000Z
CVE-2021-26987 
Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: Element Plug-in for vCenter Server
vendor: n/a
product: Management Services for Element Software and NetApp HCI
vendor: n/a
product: NetApp SolidFire & HCI Management Node
Published: 2021-03-15T21:28:13.000Z
CVE-2021-26988 
Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to converting a 7-Mode directory to Cluster-mode such as Storage Virtual Machine (SVM) names, volume names, directory paths and Job IDs.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-03-04T20:44:47.000Z
CVE-2021-26989 
Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attacker to cause a Denial of Service (DoS) on clustered Data ONTAP configured for SMB access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-03-04T20:47:53.000Z
CVE-2021-26990 
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files.
Problem types: description: Arbitrary File Overwrite
Affected products: vendor: n/a
product: Cloud Manager
Published: 2021-03-19T18:42:06.000Z
CVE-2021-26991 
Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Cloud Manager.
Problem types: description: Cross-Origin Resource Sharing (CORS)
Affected products: vendor: n/a
product: Cloud Manager
Published: 2021-03-19T18:34:24.000Z
CVE-2021-26992 
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS).
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Cloud Manager
Published: 2021-03-19T18:39:02.000Z
CVE-2021-26993 
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to cause a partial Denial of Service (DoS) to the web server.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: E-Series SANtricity OS Controller Software 11.x
Published: 2021-06-11T13:14:04.000Z
CVE-2021-26994 
Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Denial of Service (DoS) on a cluster node.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-06-04T10:56:36.000Z
CVE-2021-26995 
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow privileged attackers to execute arbitrary code.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: E-Series SANtricity OS Controller Software 11.x
Published: 2021-06-11T13:12:58.000Z
CVE-2021-26996 
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover system configuration and application information which may aid in crafting more complex attacks.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: E-Series SANtricity OS Controller Software 11.x
Published: 2021-06-11T13:11:46.000Z
CVE-2021-26997 
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in crafting more complex attacks.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: E-Series SANtricity OS Controller Software 11.x
Published: 2021-06-11T12:44:58.000Z
CVE-2021-26998 
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: NetApp Cloud Manager
Published: 2021-08-06T14:19:41.000Z
CVE-2021-26999 
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: NetApp Cloud Manager
Published: 2021-08-06T14:20:49.000Z
CVE-2021-27001 
Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to the end of the retention period.
Problem types: description: Arbitrary Data Modification
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-10-19T14:11:58.000Z
CVE-2021-27002 
NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy.
Problem types: description: Sensitive Information Disclosure
Affected products: vendor: n/a
product: Cloud Manager
Published: 2021-10-11T16:37:17.000Z
CVE-2021-27003 
Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.
Problem types: description: Clickjacking attack
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-10-12T17:57:44.000Z
CVE-2021-27004 
System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local attacker to discover plaintext iSCSI CHAP credentials.
Problem types: description: Disclosure of sensitive information
Affected products: vendor: n/a
product: System Manager 9.x
Published: 2021-11-01T12:30:38.000Z