rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-28829 TIBCO Administrator CSV injection vulnerability
The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, and TIBCO Administrator - Enterprise Edition for z/Linux contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a persistent CSV injection attack from the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, and TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1.
Problem types: description: Successful execution of this vulnerability provides the attacker with the ability to exploit the inherent trust an end-user has in the affected system and may allow an attacker to:- Infect end users with viruses or malware- Gain control over an end-user's computer and execute operating system commands- Steal sensitive information- Forge, spoof or modify data that appears to be generated by the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Administrator - Enterprise Edition
vendor: TIBCO Software Inc.
product: TIBCO Administrator - Enterprise Edition
vendor: TIBCO Software Inc.
product: TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Administrator - Enterprise Edition for z/Linux
vendor: TIBCO Software Inc.
product: TIBCO Administrator - Enterprise Edition for z/Linux
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-04-20T18:30:18.460Z
CVE-2021-28831 
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-03-19T04:01:54.000Z
CVE-2021-28832 
VSCodeVim before 1.19.0 allows attackers to execute arbitrary code via a crafted workspace configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T06:01:35.000Z
CVE-2021-28833 
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-21T12:18:38.000Z
CVE-2021-28834 
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T06:51:15.000Z
CVE-2021-28835 
Buffer Overflow vulnerability in XNView before 2.50, allows local attackers to execute arbitrary code via crafted GEM bitmap file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-08-11T00:00:00.000Z
CVE-2021-28838 
Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b, DAP-2690 3.20RC115 BETA, DAP-2695 1.20RC093, DAP-3320 1.05RC027 BETA and DAP-3662 1.05rc069 in the sbin/httpd binary. The crash happens at the `atoi' operation when a specific network package are sent to the httpd binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T17:23:52.000Z
CVE-2021-28839 
Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_certificate function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the strrchr in the upload_certificate function would take NULL as first argument, and incur the NULL pointer dereference vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T17:29:13.000Z
CVE-2021-28840 
Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_config function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the content in upload_file variable is NULL in the upload_config function then the strncasecmp would take NULL as first argument, and incur the NULL pointer dereference vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T17:32:44.000Z
CVE-2021-28841 
Null Pointer Dereference vulnerability in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service by sending a POST request to apply_cgi via an action ping_test without a ping_ipaddr key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T18:02:51.000Z
CVE-2021-28842 
Null Pointer Deference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial os service by sending the POST request to apply_cgi via action do_graph_auth without login_name key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T18:34:56.000Z
CVE-2021-28843 
Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03 by sending the POST request to apply_cgi with an unknown action name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T18:47:43.000Z
CVE-2021-28844 
Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03 by sending the POST request to apply_cgi via a do_graph_auth action without a session_id key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T18:54:10.000Z
CVE-2021-28845 
Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service by sending the POST request to apply_cgi via the lang action without a language key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:13:10.000Z
CVE-2021-28846 
A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40dcd0 when calling fprintf with "%s: key len = %d, too long\n" format. The two variables seem to be put in the wrong order. The vulnerability could be triggered by sending the POST request to apply_cgi with a long and unknown key in the request body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:22:31.000Z
CVE-2021-28847 
MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T10:58:16.000Z
CVE-2021-28848 
Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T11:11:18.000Z
CVE-2021-28855 
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T16:11:11.000Z
CVE-2021-28856 
In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T16:11:08.000Z
CVE-2021-28857 
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-15T21:51:56.000Z
CVE-2021-28858 
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and other sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-15T21:51:50.000Z
CVE-2021-28860 
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T11:48:33.000Z
CVE-2021-28861 
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T00:00:00.000Z
CVE-2021-28874 
SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T12:08:55.000Z
CVE-2021-28875 
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-11T00:00:00.000Z
CVE-2021-28876 
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-11T00:00:00.000Z
CVE-2021-28877 
In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-11T00:00:00.000Z
CVE-2021-28878 
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-11T00:00:00.000Z
CVE-2021-28879 
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-11T00:00:00.000Z
CVE-2021-28890 
J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list, related to the use of ${} to join SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T21:57:07.000Z
CVE-2021-28899 
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T14:08:31.000Z
CVE-2021-28901 
Multiple cross-site scripting (XSS) vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows remote attackers to inject arbitrary web script or HTML via the (1) NOM_CLI , (2) ADRESSE , (3) ADRESSE2, (4) LOCALITE parameters to /eshop/products/json/aouCustomerAdresse; and the (5) nom_liste parameter to /eshop/products/json/addCustomerFavorite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T17:50:05.000Z
CVE-2021-28902 
In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T18:36:06.000Z
CVE-2021-28903 
A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T18:36:15.000Z
CVE-2021-28904 
In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T18:36:27.000Z
CVE-2021-28905 
In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T18:36:35.000Z
CVE-2021-28906 
In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T18:36:44.000Z
CVE-2021-28909 
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SSH root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T17:35:00.000Z
CVE-2021-28910 
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T17:37:34.000Z
CVE-2021-28911 
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial number). Having those info, a possible loginId can be self-calculated in a brute force attack against BMX interface. This is usable and part of an attack chain to gain SSH root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T17:45:39.000Z
CVE-2021-28912 
BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T17:57:34.000Z
CVE-2021-28913 
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so called and hard coded unique 'eibPort String' which acts as the root SSH key passphrase. This is usable and part of an attack chain to gain SSH root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T18:00:27.000Z
CVE-2021-28914 
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain SSH root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T18:03:32.000Z
CVE-2021-28918 
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T12:33:50.000Z
CVE-2021-28924 
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T12:57:39.000Z
CVE-2021-28925 
SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T12:57:36.000Z
CVE-2021-28927 
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T14:09:35.000Z
CVE-2021-28931 
Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T14:01:19.000Z
CVE-2021-28935 
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T12:00:23.000Z
CVE-2021-28936 
The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. The administrator username has to be known (default:admin) whereas no previous authentication is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T12:04:35.000Z
CVE-2021-28937 
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T12:04:30.000Z
CVE-2021-28938 
Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before 7.11.2-23.0 can leak user information across thread contexts. This occurs in opportunistic circumstances when there is concurrent query execution by a low-privilege user and a high-privilege user. The former query might run with the latter query's privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-13T05:52:46.000Z
CVE-2021-28940 
Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpie_debug.php and /scripts/magpie_simple.php page that if you send a specific https url in the RSS URL field, you are able to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T19:06:19.000Z
CVE-2021-28941 
Because of no validation on a curl command in MagpieRSS 0.72 in the /extlib/Snoopy.class.inc file, when you send a request to the /scripts/magpie_debug.php or /scripts/magpie_simple.php page, it's possible to request any internal page if you use a https request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T19:08:37.000Z
CVE-2021-28950 
An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-20T19:55:16.000Z
CVE-2021-28951 
An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-20T19:53:46.000Z