rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-4156 
An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: libsndfile
Published: 2022-03-23T00:00:00.000Z
CVE-2021-4157 
An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T18:02:43.000Z
CVE-2021-4158 
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Problem types: cwe_id: CWE-476
description: CWE-476 - NULL Pointer Dereference
Affected products: vendor: n/a
product: QEMU
Published: 2022-08-24T15:10:39.000Z
CVE-2021-4159 
A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel.
Problem types: cwe_id: CWE-202
description: CWE-202 - Exposure of Sensitive Information Through Data Queries
Affected products: vendor: n/a
product: kernel
Published: 2022-08-24T15:10:57.000Z
CVE-2021-4160 BN_mod_exp may produce incorrect results on MIPS
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
Problem types: description: carry-propagating bug
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: Bernd Edlinger
Published: 2022-01-28T21:28:41.076Z
CVE-2021-4161 ICSA-21-357-01 Moxa MGate Protocol Gateways
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Moxa
product: MGate MB3180 Series
vendor: Moxa
product: MGate MB3280 Series
vendor: Moxa
product: MGate MB3480 Series
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Parul Sindhwad, Anurag M. Chevendra, and Dr. Faruk Kazi of CoE-CNDS Lab; VJTI; and Mumbai-INDIA reported this vulnerability to Moxa.
Published: 2021-12-27T18:48:19.982Z
CVE-2021-4162 Cross-Site Request Forgery (CSRF) in archivy/archivy
archivy is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: archivy
product: archivy/archivy
Published: 2021-12-25T11:20:09.000Z
CVE-2021-4164 Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-01-17T12:35:10.000Z
CVE-2021-4166 Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: vim
product: vim/vim
Published: 2021-12-25T18:15:09.000Z
CVE-2021-4168 Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2021-12-26T13:20:10.000Z
CVE-2021-4169 Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2021-12-26T11:35:09.000Z
CVE-2021-4170 Cross-site Scripting (XSS) - Stored in janeczku/calibre-web
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-01-16T20:55:10.000Z
CVE-2021-4171 Business Logic Errors in janeczku/calibre-web
calibre-web is vulnerable to Business Logic Errors
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-01-17T09:45:10.000Z
CVE-2021-4172 Cross-site Scripting (XSS) - Stored in star7th/showdoc
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-01-22T11:40:10.000Z
CVE-2021-4173 Use After Free in vim/vim
vim is vulnerable to Use After Free
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2021-12-27T12:25:12.000Z
CVE-2021-4175 Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2021-12-29T14:35:17.000Z
CVE-2021-4176 Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2021-12-29T14:35:12.000Z
CVE-2021-4177 Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchat
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2021-12-28T06:00:11.000Z
CVE-2021-4178 
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
Problem types: cwe_id: CWE-502
description: CWE-502 - Deserialization of Untrusted Data
Affected products: vendor: n/a
product: kubernetes-client
Published: 2022-08-24T15:02:11.000Z
CVE-2021-4179 Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2021-12-28T08:35:09.000Z
CVE-2021-4180 
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: openstack-tripleo-heat-templates
Published: 2022-03-23T19:46:20.000Z
CVE-2021-4181 
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Problem types: description: Buffer over-read in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Leonardo Grasso, Jason Dellaluce, and Federico Di Pierro
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4182 
Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Problem types: description: Loop with unreachable exit condition ('infinite loop') in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: ????? ????????
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4183 
Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file
Problem types: description: Buffer over-read in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Shaohua Li
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4184 
Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Problem types: description: Loop with unreachable exit condition ('infinite loop') in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4185 
Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Problem types: description: Loop with unreachable exit condition ('infinite loop') in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4186 
Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Problem types: description: Null pointer dereference in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4187 Use After Free in vim/vim
vim is vulnerable to Use After Free
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2021-12-29T17:10:09.000Z
CVE-2021-4188 NULL Pointer Dereference in mruby/mruby
mruby is vulnerable to NULL Pointer Dereference
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: mruby
product: mruby/mruby
Published: 2021-12-30T06:55:09.000Z
CVE-2021-4189 
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Problem types: description: Not-Known
Affected products: vendor: n/a
product: python
Published: 2022-08-24T00:00:00.000Z
CVE-2021-4190 
Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture file
Problem types: description: Excessive iteration in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Sharon Brizinov
Published: 2021-12-30T00:00:00.000Z
CVE-2021-4191 
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks @mungsul and @todb-r7 for reporting this vulnerability through our HackerOne bug bounty program.
Published: 2022-03-28T18:53:12.000Z
CVE-2021-4192 Use After Free in vim/vim
vim is vulnerable to Use After Free
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2021-12-31T00:00:00.000Z
CVE-2021-4193 Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: vim
product: vim/vim
Published: 2021-12-31T00:00:00.000Z
CVE-2021-4194 Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2022-01-06T17:35:10.000Z
CVE-2021-4195 XSS in Firmanet Software and Technology Customer Relation Manager
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes.

This issue affects Customer Relation Manager: before 2022.03.13.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Firmanet Software and Technology
product: Customer Relation Manager
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2023-03-14T08:10:48.103Z
CVE-2021-4197 
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: kernel
Published: 2022-03-23T19:46:43.000Z
CVE-2021-4198 messaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016)
A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Bitdefender
product: Total Security
vendor: Bitdefender
product: Internet Security
vendor: Bitdefender
product: Antivirus Plus
vendor: Bitdefender
product: Endpoint Security Tools
vendor: Bitdefender
product: VPN Standalone
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
Published: 2022-03-07T11:30:14.308Z
CVE-2021-4199 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Bitdefender
product: Total Security
vendor: Bitdefender
product: Internet Security
vendor: Bitdefender
product: Antivirus Plus
vendor: Bitdefender
product: Endpoint Security Tools for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
Published: 2022-03-07T11:35:12.457Z
CVE-2021-4200 Write access to the Catalog for any user when restricted-admin role is enabled
A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: SUSE
product: Rancher
vendor: SUSE
product: Rancher
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2022-05-02T07:05:15.716Z
CVE-2021-4201 Pre-authentication session hijacking
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: ForgeRock
product: Access Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Escourbiac Maxime and Schmitt Maxence from Mitchelin CERT
Published: 2022-02-14T21:04:29.132Z
CVE-2021-4202 
A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem.
Problem types: cwe_id: CWE-362
description: CWE-362->CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T18:02:45.000Z