rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-22507 
Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10. The vulnerability could allow remote attackers to bypass user authentication and get unauthorized access.
Problem types: description: Authentication Bypass.
Affected products: vendor: n/a
product: Operations Bridge Manager
Published: 2021-04-08T17:35:08.000Z
CVE-2021-22508 Potential SQL injection in OpenText Operations Bridge Reporter
A potential vulnerability has been identified for OpenText Operations Bridge Reporter.  The vulnerability could be exploited to inject malicious SQL queries.  An attack requires to be an authenticated administrator of OBR with network access to the OBR web application.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: OpenText
product: Operations Bridge Reporter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-05-17T18:32:57.552Z
CVE-2021-22509 Handling of sensitive data in process memory in NetIQ Advance Authentication
A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: OpenText
product: NetIQ Advance Authentication
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
version: 3.1
Published: 2024-08-28T06:29:42.838Z
CVE-2021-22510 
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
Problem types: cwe_id: CWE-79
description: Cross-Site scripting (CWE-79)
Affected products: vendor: n/a
product: Micro Focus Application Automation Tools Plugin - Jenkins plugin
Published: 2021-04-08T21:25:29.000Z
CVE-2021-22511 
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation.
Affected products: vendor: n/a
product: Micro Focus Application Automation Tools Plugin - Jenkins plugin.
Published: 2021-04-08T21:27:24.000Z
CVE-2021-22512 
Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: Micro Focus Application Automation Tools Plugin - Jenkins plugin
Published: 2021-04-08T21:29:39.000Z
CVE-2021-22513 
Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: n/a
product: Micro Focus Application Automation Tools Plugin - Jenkins plugin.
Published: 2021-04-08T21:16:58.000Z
CVE-2021-22514 
An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of APM.
Problem types: description: Arbitrary code execution.
Affected products: vendor: n/a
product: Application Performance Management (APM)
Published: 2021-04-28T11:06:28.000Z
CVE-2021-22515 Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server
Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1.
Problem types: description: Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication.
Affected products: vendor: Micro Focus
product: NetIQ Advanced Authentication
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-07-12T10:04:15.162Z
CVE-2021-22516 
Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability could lead to sensitive information being in a log file.
Problem types: description: Insertion of Sensitive Information into Log File.
Affected products: vendor: n/a
product: Secure API Manager (SAPIM).
Published: 2021-06-04T12:05:37.000Z
CVE-2021-22517 
A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector. The vulnerability affects versions 10.10, 10.20, 10.30, 10.40, 10.50, 10.60, 10.70, 10.80, 10.0 and 10.91. A privileged user may potentially misuse this feature and thus allow unintended and unauthorized access of data.
Problem types: description: Privileged escalation vulnerability.
Affected products: vendor: n/a
product: Data Protector
Published: 2021-08-05T20:41:05.000Z
CVE-2021-22518 Sensitive Information logging in NetIQ Identity Manager Driver
A vulnerability identified in OpenText™ 
Identity Manager AzureAD Driver that allows logging of sensitive information into log file. This impacts all versions before 5.1.4.0
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: OpenText
product: Identity Manager AzureAD Driver
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-09-12T12:44:34.977Z
CVE-2021-22519 
Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50), 2018.08(11.51), 2018.11(11.60), 2019.02(11.70), 2019.05(11.80), 2019.08(11.90), 2019.11(11.91), 2020.05(11.92), 2020.10(11.93). The vulnerability could allow remote attackers to execute arbitrary code on affected installations of SiteScope.
Problem types: description: Execute arbitrary code.
Affected products: vendor: n/a
product: SiteScope
Published: 2021-05-28T19:22:04.000Z
CVE-2021-22521 
A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versions. The vulnerability could be exploited to gain unauthorized system privileges.
Problem types: description: Privileged escalation vulnerability.
Affected products: vendor: n/a
product: ZENworks Configuration Management
Published: 2021-07-30T20:21:28.000Z
CVE-2021-22522 
Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data.
Problem types: description: Reflected Cross-Site Scripting.
Affected products: vendor: n/a
product: Verastream Host Integrator.
Published: 2021-07-22T11:08:03.000Z
CVE-2021-22523 
XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow the control of web browser and hijacking user sessions.
Problem types: description: XML External Entity.
Affected products: vendor: n/a
product: Verastream Host Integrator.
Published: 2021-07-22T11:11:26.000Z
CVE-2021-22524 Denial of service vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
Problem types: cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: Micro Focus
product: NetIQ Access Manager
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Special thanks to Sipke Mellema for responsibly disclosing this vulnerability
Published: 2021-09-13T11:58:31.576Z
CVE-2021-22525 
This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1
Problem types: description: information leakage vulnerability.
Affected products: vendor: n/a
product: NetIQ Access Manager versions prior to 5.0.1
Published: 2021-09-02T16:56:41.000Z
CVE-2021-22526 Open Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Micro Focus
product: NetIQ Access Manager
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-09-13T12:00:50.890Z
CVE-2021-22527 Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Micro Focus
product: NetIQ Access Manager
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Published: 2021-09-13T11:56:22.591Z
CVE-2021-22528 Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Micro Focus
product: NetIQ Access Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Special thanks to the researcher community for reporting this to us as part of responsible disclosure, anonymously
Published: 2021-09-13T11:42:07.116Z
CVE-2021-22529 Sensitive Data Exposure leaks potential information in NetIQ Advance Authentication
A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version before 6.3.5.1
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: OpenText
product: NetIQ Advance Authentication
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-28T06:29:33.325Z
CVE-2021-22530 Improper account management vulnerability in NetIQ Advance Authentication
A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authentication before 6.3.5.1
Problem types: cwe_id: CWE-667
description: CWE-667 Improper Locking
Affected products: vendor: OpenText
product: NetIQ Advance Authentication
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Published: 2024-08-28T06:29:20.166Z
CVE-2021-22531 
A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0
Problem types: description: Cross Site Scripting vulnerability
Affected products: vendor: n/a
product: NetIQ Access Manager
Published: 2022-05-12T18:52:38.000Z
CVE-2021-22532 Possible NLDAP Denial of Service attack Vulnerability
Possible NLDAP Denial of Service attack Vulnerability

in eDirectory has been discovered in
OpenText™ 
eDirectory before 9.2.4.0000.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: OpenText
product: eDirectory
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2024-09-12T12:44:20.724Z
CVE-2021-22533 Possible Insertion of Sensitive Information into Log File Vulnerability
Possible Insertion of Sensitive Information into Log File Vulnerability

in eDirectory has been discovered in
OpenText™ eDirectory 9.2.4.0000.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: OpenText
product: eDirectory
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-09-12T12:43:51.734Z
CVE-2021-22535 
Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior to 10.1 Patch 1. The vulnerability could lead to unauthorized information disclosure.
Problem types: description: unauthorized information security disclosure.
Affected products: vendor: n/a
product: Directory and Resource Administrator (DRA)
Published: 2021-09-28T13:54:45.000Z
CVE-2021-22538 Privilege escalation in RBAC system
A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Google LLC
product: Exposure Notifications Verification Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Michael Mazzolini (Ethical Hacker at WHO)
Published: 2021-03-31T21:10:13.000Z
CVE-2021-22539 Code execution in VSCode-bazel via malicious Bazel config files
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Google LLC
product: VSCode-Bazel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: RyotaK
Published: 2021-04-16T10:15:12.912Z
CVE-2021-22540 XSS in Dart SDK
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: Google LLC
product: Dart SDK
Credits: lang: en
value: Vincenzo di Cicco
Published: 2021-04-22T14:15:17.000Z
CVE-2021-22543 Improper memory handling in Linux KVM
An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Linux Kernel
product: Linux Kernel
default_status: unaffected
Credits: lang: en
value: David Stevens
lang: en
value: Kevin Hamacher
lang: en
value: Jann Horn
Published: 2021-05-26T10:30:10.775Z
CVE-2021-22545 Use-after-free in BinDiff
An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Google LLC
product: Bindiff
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mickey Jin of Trend Micro Mobile Security Research Team
Published: 2021-06-29T11:55:11.520Z
CVE-2021-22547 Buffer overrun in Google Cloud IoT Device SDK for Embedded C
In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Google LLC
product: Google Cloud IoT Device SDK for Embedded C
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2021-05-04T13:05:17.000Z
CVE-2021-22548 Arbitrary enclave memory overread vulnerability in Asylo TrustedPrimitives::UntrustedCall
An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
Problem types: cwe_id: CWE-788
description: CWE-788 Access of Memory Location After End of Buffer
Affected products: vendor: Google LLC
product: Asylo
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Qinkun Bao (Baidu Security)
lang: en
value: Zhaofeng Chen (Baidu Security)
lang: en
value: Mingshen Sun (Baidu Security)
lang: en
value: Kang Li (Baidu Security)
Published: 2021-06-08T13:15:13.466Z
CVE-2021-22549 Arbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall
An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: Google LLC
product: Asylo
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Qinkun Bao (Baidu Security)
lang: en
value: Zhaofeng Chen (Baidu Security)
lang: en
value: Mingshen Sun (Baidu Security)
lang: en
value: Kang Li (Baidu Security)
Published: 2021-06-08T13:15:14.120Z
CVE-2021-22550 Enclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer
An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: Google LLC
product: Asylo
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Qinkun Bao (Baidu Security)
lang: en
value: Zhaofeng Chen (Baidu Security)
lang: en
value: Mingshen Sun (Baidu Security)
lang: en
value: Kang Li (Baidu Security)
Published: 2021-06-08T13:15:14.762Z