rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-21952 
An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: n/a
product: Anker"
Published: 2021-12-22T18:07:16.000Z
CVE-2021-21953 
An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges.
Problem types: cwe_id: CWE-300
description: CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Affected products: vendor: n/a
product: Anker
Published: 2021-12-22T18:07:17.000Z
CVE-2021-21954 
A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: n/a
product: Anker
Published: 2021-12-09T15:32:38.000Z
CVE-2021-21955 
An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability.
Problem types: cwe_id: CWE-334
description: CWE-334: Small Space of Random Values
Affected products: vendor: n/a
product: Anker
Published: 2021-12-09T15:32:43.000Z
CVE-2021-21956 
A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potential arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: CloudLinux Inc
product: Imunify360
Published: 2022-04-14T19:56:05.446Z
CVE-2021-21957 
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: n/a
product: Dream Report
Published: 2021-12-08T21:29:57.000Z
CVE-2021-21958 
A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file can lead to memory corruption and potential arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Hancom
Published: 2022-02-16T16:38:31.000Z
CVE-2021-21959 
A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:09.000Z
CVE-2021-21960 
A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:03.000Z
CVE-2021-21961 
A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:04.000Z
CVE-2021-21962 
A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:11.000Z
CVE-2021-21963 
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:02.000Z
CVE-2021-21964 
A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:05.000Z
CVE-2021-21965 
A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:05.000Z
CVE-2021-21966 
An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-457
description: CWE-457: Use of Uninitialized Variable
Affected products: vendor: n/a
product: Texas Instruments
Published: 2022-02-16T16:38:32.000Z
CVE-2021-21967 
An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Sealevel Systems, Inc.
product: SeaConnect 370W
Published: 2022-04-14T19:56:06.861Z
CVE-2021-21968 
A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:10.000Z
CVE-2021-21969 
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [4] the json_object_get_string to populate the p_payload global variable. The p_payload is only 0x100 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: n/a
product: Sealevel"
Published: 2022-02-04T22:29:00.000Z
CVE-2021-21970 
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [3] the json_object_get_string to populate the p_name global variable. The p_name is only 0x80 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:01.000Z
CVE-2021-21971 
An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: n/a
product: Sealevel
Published: 2022-02-04T22:29:02.000Z
CVE-2021-21972 
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Problem types: description: Remote code execution vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server
vendor: n/a
product: VMware Cloud Foundation
Published: 2021-02-24T16:42:05.000Z
CVE-2021-21973 
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Problem types: description: SSRF vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server
vendor: n/a
product: VMware Cloud Foundation
Published: 2021-02-24T16:42:02.000Z
CVE-2021-21974 
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
Problem types: description: OpenSLP heap-overflow vulnerability
Affected products: vendor: n/a
product: VMware ESXi
vendor: n/a
product: VMware Cloud Foundation
Published: 2021-02-24T16:57:33.000Z
CVE-2021-21975 
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
Problem types: description: Server Side Request Forgery
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-03-31T17:51:51.000Z
CVE-2021-21976 
vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command injection vulnerability which may allow an authenticated admin user to perform a remote code execution.
Problem types: description: Authenticated command injection
Affected products: vendor: n/a
product: vSphere Replication
Published: 2021-02-11T20:34:45.000Z
CVE-2021-21978 
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.
Problem types: description: Remote code execution vulnerability
Affected products: vendor: n/a
product: VMware View Planner
Published: 2021-03-03T17:44:25.000Z
CVE-2021-21979 
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.
Problem types: description: APP_KEY fixed in the container image
Affected products: vendor: n/a
product: Bitnami Containers
Published: 2021-03-03T16:15:14.000Z
CVE-2021-21980 
The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
Problem types: description: Arbitrary file read vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server and VMware Cloud Foundation
Published: 2021-11-24T16:32:43.000Z
CVE-2021-21981 
VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of this issue may allow attackers with local guest user account to assign privileges higher than their own permission level.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware NSX-T
Published: 2021-04-19T14:37:21.000Z
CVE-2021-21982 
VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful exploitation of this issue would result in the attacker being able to view and alter administrative configuration settings.
Problem types: description: Authentication bypass
Affected products: vendor: n/a
product: VMware Carbon Black Cloud Workload appliance
Published: 2021-04-01T18:45:53.000Z
CVE-2021-21983 
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
Problem types: description: Arbitrary file write vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2021-03-31T17:50:36.000Z
CVE-2021-21984 
VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance.
Problem types: description: Remote code execution vulnerability in VMware vRealize Business for Cloud
Affected products: vendor: n/a
product: VMware vRealize Business for Cloud
Published: 2021-05-07T11:20:14.000Z
CVE-2021-21985 
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Problem types: description: Remote code execution vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server and VMware Cloud Foundation
Published: 2021-05-26T14:04:30.000Z
CVE-2021-21986 
The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.
Problem types: description: Issue with Authentication mechanism
Affected products: vendor: n/a
product: VMware vCenter Server and VMware Cloud Foundation
Published: 2021-05-26T14:04:35.000Z
CVE-2021-21987 
VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.
Problem types: description: Out-of-bounds read vulnerability in Cortado ThinPrint
Affected products: vendor: n/a
product: VMware Workstation Pro / Player (Workstation), VMware Horizon Client for Windows
Published: 2021-05-24T11:34:55.000Z
CVE-2021-21988 
VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (JPEG2000 Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.
Problem types: description: Out-of-bounds read vulnerability in Cortado ThinPrint
Affected products: vendor: n/a
product: VMware Workstation Pro / Player (Workstation), VMware Horizon Client for Windows
Published: 2021-05-24T11:35:00.000Z
CVE-2021-21989 
VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.
Problem types: description: Out-of-bounds read vulnerability in Cortado ThinPrint
Affected products: vendor: n/a
product: VMware Workstation Pro / Player (Workstation), VMware Horizon Client for Windows
Published: 2021-05-24T11:43:34.000Z
CVE-2021-21990 
VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to 20.1.0.32, 1912 prior to 19.12.0.24) contain a cross-site scripting vulnerability. VMware Workspace ONE UEM console does not validate incoming requests during device enrollment after leading to rendering of unsanitized input on the user device in response.
Problem types: description: Reflective Cross-site scripting
Affected products: vendor: n/a
product: Vmware Workspace One UEM console
Published: 2021-05-11T13:29:41.000Z
CVE-2021-21991 
The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-22T18:59:08.000Z
CVE-2021-21992 
The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.
Problem types: description: XML parsing denial-of-service vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-22T18:59:15.000Z
CVE-2021-21993 
The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.
Problem types: description: SSRF vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2021-09-23T11:37:24.000Z
CVE-2021-21994 
SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request.
Problem types: description: Authentication bypass vulnerability
Affected products: vendor: n/a
product: VMware ESXi and VMware Cloud Foundation
Published: 2021-07-13T18:05:43.000Z
CVE-2021-21995 
OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service condition.
Problem types: description: Authentication bypass vulnerability
Affected products: vendor: n/a
product: VMware ESXi and VMware Cloud Foundation
Published: 2021-07-13T18:05:49.000Z
CVE-2021-21996 
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
Problem types: description: File traversal attack
Affected products: vendor: n/a
product: Saltstack Salt
Published: 2021-09-08T00:00:00.000Z
CVE-2021-21997 
VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest operating system, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest operating system.
Problem types: description: Denial-of-service vulnerability in the VM3DMP driver
Affected products: vendor: n/a
product: VMware Tools for Windows
Published: 2021-06-18T12:41:17.000Z
CVE-2021-21998 
VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.
Problem types: description: Authentication bypass?
Affected products: vendor: n/a
product: VMware Carbon Black App Control (AppC)
Published: 2021-06-23T11:10:25.000Z