rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-29892 IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-12-03T16:27:40.657Z
CVE-2021-29894 
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2021-09-30T16:20:18.227Z
CVE-2021-29899 
IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Engineering Requirements Quality Assistant
Published: 2022-03-18T15:40:14.510Z
CVE-2021-29903 
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 207506.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2021-10-06T17:10:44.242Z
CVE-2021-29904 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 207610.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-23T18:05:48.587Z
CVE-2021-29905 
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207616.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz for Service Management
Published: 2021-09-23T18:05:50.185Z
CVE-2021-29906 
IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors. IBM X-Force ID: 207630.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: App Connect Enterprise Certified Container
Published: 2021-10-08T17:20:13.582Z
CVE-2021-29907 
IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 207633.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: OpenPages with Watson
Published: 2021-08-31T16:05:11.841Z
CVE-2021-29908 
The IBM TS7700 Management Interface is vulnerable to unauthenticated access. By accessing a specially-crafted URL, an attacker may gain administrative access to the Management Interface without authentication. IBM X-Force ID: 207747.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Virtualization Engine TS7700 3957-VED
vendor: IBM
product: Virtualization Engine TS7700 3957-VEC
Published: 2021-10-06T17:50:16.267Z
CVE-2021-29912 
IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cloud Pak for Security
Published: 2021-10-19T15:15:14.541Z
CVE-2021-29913 IBM Security Verify Privilege improper input validation

IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to improper input validation.  IBM X-Force ID:  207898.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Published: 2023-10-17T01:28:43.135Z
CVE-2021-29921 
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T00:00:00.000Z
CVE-2021-29922 
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-07T00:00:00.000Z
CVE-2021-29923 
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-07T16:38:59.000Z
CVE-2021-29929 
An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:25:13.000Z
CVE-2021-29930 
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:25:01.000Z
CVE-2021-29931 
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a panic in T::drop().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:24:50.000Z
CVE-2021-29932 
An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:24:37.000Z
CVE-2021-29933 
An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:24:27.000Z
CVE-2021-29934 
An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:24:14.000Z
CVE-2021-29935 
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:23:59.000Z
CVE-2021-29936 
An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:23:46.000Z
CVE-2021-29937 
An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:23:33.000Z
CVE-2021-29938 
An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:23:16.000Z
CVE-2021-29939 
An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:23:03.000Z
CVE-2021-29940 
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:22:50.000Z
CVE-2021-29941 
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:22:39.000Z
CVE-2021-29942 
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index can return uninitialized values if an iterator returns a len() that is too large.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T04:22:25.000Z
CVE-2021-29943 Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections
When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Solr
Credits: lang: en
value: Geza Nagy
Published: 2021-04-13T06:35:22.000Z
CVE-2021-29944 
Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88.
Problem types: description: HTML injection vulnerability in Firefox for Android's Reader View
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:20:29.000Z
CVE-2021-29945 
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
Problem types: description: Incorrect size computation in WebAssembly JIT could lead to null-reads
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:19:50.000Z
CVE-2021-29946 
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
Problem types: description: Port blocking could be bypassed
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:19:43.000Z
CVE-2021-29947 
Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.
Problem types: description: Memory safety bugs fixed in Firefox 88
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:19:37.000Z
CVE-2021-29948 
Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10.
Problem types: description: Race condition when reading from disk while verifying signatures
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2021-06-24T13:19:32.000Z
CVE-2021-29949 
When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library. This vulnerability affects Thunderbird < 78.9.1.
Problem types: description: Thunderbird might execute an alternative OTR library
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2021-06-24T13:18:52.000Z
CVE-2021-29950 
Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird < 78.8.1.
Problem types: description: Logic issue potentially leaves key material unlocked
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2021-06-24T13:18:46.000Z
CVE-2021-29951 
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
Problem types: description: Mozilla Maintenance Service could have been started or stopped by domain users
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2021-06-24T13:18:39.000Z
CVE-2021-29952 
When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
Problem types: description: Race condition in Web Render Components
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox for Android
Published: 2021-06-24T13:18:33.000Z
CVE-2021-29953 
A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
Problem types: description: Universal Cross-Site Scripting
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox for Android
Published: 2021-06-24T13:17:57.000Z
CVE-2021-29954 
Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnerability affects Hubs Cloud < mozillareality/reticulum/1.0.1/20210428201255.
Problem types: description: Insecure Proxy Configuration
Affected products: vendor: Mozilla
product: Hubs Cloud
Published: 2021-06-24T13:17:52.000Z
CVE-2021-29955 
A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.
Problem types: description: Transient Execution Vulnerability allowed leaking arbitrary memory address
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:17:46.000Z
CVE-2021-29956 
OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2.
Problem types: description: Thunderbird stored OpenPGP secret keys without master password protection
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2021-06-24T13:17:40.000Z
CVE-2021-29957 
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.
Problem types: description: Partial protection of inline OpenPGP message not indicated
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2021-06-24T13:16:54.000Z
CVE-2021-29958 
When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS < 34.
Problem types: description: File download shares private browsing mode cookies
Affected products: vendor: Mozilla
product: Firefox for iOS
Published: 2021-06-24T13:16:48.000Z
CVE-2021-29959 
When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera. This vulnerability affects Firefox < 89.
Problem types: description: Devices could be re-enabled without additional permission prompt
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:16:42.000Z
CVE-2021-29960 
Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. This vulnerability affects Firefox < 89.
Problem types: description: Filenames printed from private browsing mode incorrectly retained in preferences
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:16:36.000Z
CVE-2021-29961 
When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89.
Problem types: description: Firefox UI spoof using `<select>` elements and CSS scaling
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:15:55.000Z
CVE-2021-29962 
Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Problem types: description: No rate-limiting for popups on Firefox for Android
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:15:49.000Z
CVE-2021-29963 
Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Problem types: description: Shared cookies for search suggestions in private browsing mode
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:15:44.000Z
CVE-2021-29964 
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Problem types: description: Out of bounds-read when parsing a `WM_COPYDATA` message
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2021-06-24T13:15:35.000Z
CVE-2021-29965 
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Problem types: description: Password Manager on Firefox for Android susceptible to domain spoofing
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:14:52.000Z
CVE-2021-29966 
Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.
Problem types: description: Memory safety bugs fixed in Firefox 89
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:14:41.000Z
CVE-2021-29967 
Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Problem types: description: Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2021-06-24T13:14:29.000Z
CVE-2021-29968 
When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.0.1.
Problem types: description: Out of bounds read when drawing text characters onto a Canvas
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-06-24T13:14:22.000Z