rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-29618 Crash in `tf.transpose` with complex inputs
TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: tensorflow
product: tensorflow
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2021-05-14T19:25:18.000Z
CVE-2021-29619 Segfault in `tf.raw_ops.SparseCountSparseOutput`
TensorFlow is an end-to-end open source platform for machine learning. Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: tensorflow
product: tensorflow
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2021-05-14T19:25:13.000Z
CVE-2021-29620 XXE vulnerability on Launch import with externally-defined DTD file
Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: reportportal
product: reportportal
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-06-23T17:35:11.000Z
CVE-2021-29621 Observable Response Discrepancy in Flask-AppBuilder
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
Problem types: cwe_id: CWE-203
description: CWE-203: Observable Discrepancy
Affected products: vendor: dpgaspar
product: Flask-AppBuilder
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-06-07T19:00:12.000Z
CVE-2021-29622 Arbitrary redirects under /new endpoint
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: prometheus
product: prometheus
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2021-05-19T20:00:13.000Z
CVE-2021-29623 Uninitialized variable bug in Exiv2
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.
Problem types: cwe_id: CWE-908
description: CWE-908: Use of Uninitialized Resource
Affected products: vendor: Exiv2
product: exiv2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
Published: 2021-05-13T00:00:00.000Z
CVE-2021-29624 Lack of protection against cookie tossing attacks in fastify-csrf
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
Problem types: cwe_id: CWE-565
description: CWE-565: Reliance on Cookies without Validation and Integrity Checking
Affected products: vendor: fastify
product: fastify-csrf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2021-05-19T21:15:28.000Z
CVE-2021-29625 XSS in doc_link
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: vrana
product: adminer
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-05-19T21:35:11.000Z
CVE-2021-29626 
In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, copy-on-write logic failed to invalidate shared memory page mappings between multiple processes allowing an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel.
Problem types: description: Use after free memory disclosure
Affected products: vendor: n/a
product: FreeBSD
Published: 2021-04-07T14:48:32.000Z
CVE-2021-29627 
In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free or use after free.
Problem types: description: Double free or use after free
Affected products: vendor: n/a
product: FreeBSD
Published: 2021-04-07T14:45:52.000Z
CVE-2021-29628 
In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a fault could cause SMAP protections to be disabled for the duration of the system call. This weakness could be combined with other kernel bugs to craft an exploit.
Problem types: description: Privilege Context Switching Error
Affected products: vendor: n/a
product: FreeBSD
Published: 2021-05-28T14:06:12.000Z
CVE-2021-29629 
In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and 11.4-RELEASE before p10, missing message validation in libradius(3) could allow malicious clients or servers to trigger denial of service in vulnerable servers or clients respectively.
Problem types: description: Unchecked Input for Loop Condition
Affected products: vendor: n/a
product: FreeBSD
Published: 2021-05-28T14:06:47.000Z
CVE-2021-29630 
In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.
Problem types: description: Buffer Copy without Checking Size of Input
Affected products: vendor: n/a
product: FreeBSD
Published: 2021-08-30T18:01:08.000Z
CVE-2021-29631 
In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, certain VirtIO-based device models in bhyve failed to handle errors when fetching I/O descriptors. A malicious guest may cause the device model to operate on uninitialized I/O vectors leading to memory corruption, crashing of the bhyve process, and possibly arbitrary code execution in the bhyve process.
Problem types: description: Use of Uninitialized Resource
Affected products: vendor: n/a
product: FreeBSD
Published: 2021-08-30T18:00:15.000Z
CVE-2021-29632 
In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain conditions involving use of the highlight buffer while text is scrolling on the console, console data may overwrite data structures associated with the system console or other kernel memory.
Problem types: description: Kernel out-of-bounds write condition
Affected products: vendor: n/a
product: FreeBSD
Published: 2022-01-18T16:51:45.000Z
CVE-2021-29641 
Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T21:31:45.000Z
CVE-2021-29642 
GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T18:48:05.000Z
CVE-2021-29643 
PRTG Network Monitor before 21.3.69.1333 allows stored XSS via an unsanitized string imported from a User Object in a connected Active Directory instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T14:42:26.000Z
CVE-2021-29644 
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-10-12T18:19:29.000Z
CVE-2021-29645 
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2021-10-12T18:30:35.000Z
CVE-2021-29646 
An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T20:36:55.000Z
CVE-2021-29647 
An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T20:36:42.000Z
CVE-2021-29648 
An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T20:36:25.000Z
CVE-2021-29649 
An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T20:36:03.000Z
CVE-2021-29650 
An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T20:35:47.000Z
CVE-2021-29651 
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T13:54:57.000Z
CVE-2021-29652 
Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T13:58:34.000Z
CVE-2021-29653 
HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T16:41:46.000Z
CVE-2021-29654 
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T17:49:00.000Z
CVE-2021-29655 
Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T21:44:45.000Z
CVE-2021-29656 
Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T21:47:00.000Z
CVE-2021-29657 
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:44:33.000Z
CVE-2021-29658 
The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T16:58:52.000Z
CVE-2021-29659 
ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could cause higher than average load on the instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T12:46:20.000Z
CVE-2021-29660 
A Cross-Site Request Forgery (CSRF) vulnerability in en/cfg_setpwd.html in Softing AG OPC Toolbox through 4.10.1.13035 allows attackers to reset the administrative password by inducing the Administrator user to browse a URL controlled by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T18:42:02.000Z
CVE-2021-29661 
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T18:43:44.000Z
CVE-2021-29662 
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T17:28:16.000Z
CVE-2021-29663 
CourseMS (aka Course Registration Management System) 2.1 is affected by cross-site scripting (XSS). When an attacker with access to an Admin account creates a Job Title in the Site area (aka the admin/add_jobs.php name parameter), they can insert an XSS payload. This payload will execute whenever anyone visits the registration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T19:03:37.000Z
CVE-2021-29665 
IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with elevated privileges.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Verify Access
Published: 2021-05-31T14:50:18.877Z
CVE-2021-29666 
IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199400.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2021-04-27T16:32:52.431Z
CVE-2021-29667 
IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 199403.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2021-04-27T16:32:53.068Z
CVE-2021-29668 
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199406.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Engineering Test Management
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Rhapsody Model Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Engineering Lifecycle Optimization
vendor: IBM
product: Rational Engineering Lifecycle Manager
vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2021-06-02T20:40:44.845Z