rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20293 
A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: RESTEasy
Published: 2021-06-10T11:09:47.000Z
CVE-2021-20294 
A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: binutils
Published: 2021-04-29T00:00:00.000Z
CVE-2021-20295 
It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756, refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: QEMU
Published: 2022-04-01T22:17:46.000Z
CVE-2021-20296 
A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: OpenEXR
Published: 2021-04-01T00:00:00.000Z
CVE-2021-20297 
A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: NetworkManager
Published: 2021-05-26T20:46:59.000Z
CVE-2021-20298 
A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: OpenEXR
Published: 2022-08-23T00:00:00.000Z
CVE-2021-20299 
A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-476
description: CWE-476 (NULL Pointer Dereference)
Affected products: vendor: n/a
product: OpenEXR
Published: 2022-03-16T00:00:00.000Z
CVE-2021-20300 
A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-190
description: CWE-190 - Integer Overflow or Wraparound
Affected products: vendor: n/a
product: OpenEXR
Published: 2022-03-04T00:00:00.000Z
CVE-2021-20302 
A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-20
description: CWE-20 - Improper Input Validation
Affected products: vendor: n/a
product: OpenEXR
Published: 2022-03-04T00:00:00.000Z
CVE-2021-20303 
A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.
Problem types: cwe_id: CWE-190
description: CWE-190 - Integer Overflow or Wraparound,  CWE-787 - Out-of-bounds Write
Affected products: vendor: n/a
product: OpenEXR
Published: 2022-03-04T00:00:00.000Z
CVE-2021-20304 
A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-190
description: CWE-190 - Integer Overflow or Wraparound
Affected products: vendor: n/a
product: OpenEXR
Published: 2022-08-23T00:00:00.000Z
CVE-2021-20305 
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-327
description: CWE-327
Affected products: vendor: n/a
product: nettle
Published: 2021-04-05T21:31:06.000Z
CVE-2021-20306 
A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: Business-central
Published: 2021-06-01T13:38:07.000Z
CVE-2021-20307 
Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.
Problem types: cwe_id: CWE-134
description: CWE-134
Affected products: vendor: n/a
product: libpano13
Published: 2021-04-05T21:34:23.000Z
CVE-2021-20308 
Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: htmldoc
Published: 2021-04-05T21:32:58.000Z
CVE-2021-20309 
A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImagemMagick
Published: 2021-05-11T00:00:00.000Z
CVE-2021-20310 
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImageMagick
Published: 2021-05-11T22:30:40.000Z
CVE-2021-20311 
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImageMagick
Published: 2021-05-11T22:30:47.000Z
CVE-2021-20312 
A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2021-05-11T00:00:00.000Z
CVE-2021-20313 
A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: ImageMagick
Published: 2021-05-11T00:00:00.000Z
CVE-2021-20314 
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
Problem types: description: stack buffer overflow
Affected products: vendor: n/a
product: libspf2
Published: 2021-08-12T14:37:09.000Z
CVE-2021-20315 
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked.
Problem types: cwe_id: CWE-667
description: CWE-667
Affected products: vendor: n/a
product: gnome-shell
Published: 2022-02-18T00:00:00.000Z
CVE-2021-20316 
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
Problem types: cwe_id: CWE-362
description: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: n/a
product: samba
Published: 2022-08-23T00:00:00.000Z
CVE-2021-20317 
A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.
Problem types: cwe_id: CWE-665
description: CWE-665
Affected products: vendor: n/a
product: kernel
Published: 2021-09-27T10:34:49.000Z
CVE-2021-20318 
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: n/a
product: Artemis in EAP 7
Published: 2021-12-23T19:48:41.000Z
CVE-2021-20319 
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
Problem types: cwe_id: CWE-347
description: CWE-347 - Improper Verification of Cryptographic Signature
Affected products: vendor: n/a
product: coreos-installer
Published: 2022-03-04T17:05:50.000Z
CVE-2021-20320 
A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: kernel
Published: 2022-02-18T17:50:43.000Z
CVE-2021-20321 
A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: n/a
product: kernel
Published: 2022-02-18T17:50:44.000Z
CVE-2021-20322 
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.
Problem types: cwe_id: CWE-330
description: CWE-330
Affected products: vendor: n/a
product: kernel
Published: 2022-02-18T17:50:45.000Z
CVE-2021-20323 
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: keycloak-services
Published: 2022-03-25T18:03:00.000Z
CVE-2021-20325 
Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.
Problem types: cwe_id: CWE-119
description: (CWE-119|CWE-918)
Affected products: vendor: n/a
product: httpd
Published: 2022-02-18T17:50:47.000Z
CVE-2021-20326 Specially crafted query may result in a denial of service of mongod
A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Adrien Petel
Published: 2021-04-30T09:10:13.589Z
CVE-2021-20327 MongoDB Node.js client side field level encryption library may not be validating KMS certificate
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: MongoDB Inc.
product: MongoDB Node.js Driver mongodb-client-encryption module
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2021-02-25T16:25:11.455Z
CVE-2021-20328 MongoDB Java driver client-side field level encryption not verifying KMS host name
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: MongoDB Inc.
product: mongo-java-driver
default_status: unaffected
vendor: MongoDB Inc.
product: mongodb-driver
default_status: unaffected
vendor: MongoDB Inc.
product: mongodb-driver-sync
default_status: unaffected
vendor: MongoDB Inc.
product: mongodb-driver-legacy
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2021-02-25T16:30:14.536Z
CVE-2021-20329 Specific cstrings input may not be properly validated in the Go Driver
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.
Problem types: cwe_id: CWE-1287
description: CWE-1287: Improper Validation of Specified Type of Input
Affected products: vendor: MongoDB Inc.
product: MongoDB Go Driver
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Hugo Ferrando Seage
Published: 2021-06-10T16:30:11.055Z
CVE-2021-20330 Specific replication command with malformed oplog entries can crash secondaries
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-12-15T12:30:10.405Z
CVE-2021-20331 MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: MongoDB Inc.
product: MongoDB C# Driver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Citrix Systems, Inc.
Published: 2021-05-13T07:40:11.801Z
CVE-2021-20332 MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: MongoDB Inc.
product: MongoDB Rust Driver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-08-02T12:50:09.915Z
CVE-2021-20333 Server log entry spoofing via newline injection
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-07-23T11:25:11.191Z