rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33598 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows, Mac and Linux Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-08-23T11:02:50.000Z
CVE-2021-33599 Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AV engine scanner). The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit)  F-Secure Linux Security 64  F-Secure Atlant  F-Secure Cloud Protection for Salesforce
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-09-07T12:12:28.000Z
CVE-2021-33600 Denial of Service Vulnerability in Web Interface of F-Secure Internet Gatekeeper
A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attacker can trigger assertion via malformed HTTP packet to web interface. An unauthenticated attacker could exploit this vulnerability by sending a large username parameter. A successful exploitation could lead to a denial-of-service of the product.
Problem types: description: Denial of Service Vulnerability in Web Interface of F-Secure Internet Gatekeeper
Affected products: vendor: F-Secure
product: F-Secure Internet Gatekeeper
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-09-28T09:06:55.000Z
CVE-2021-33601 Arbitrary Code Execution in Web Interface of F-Secure Internet Gatekeeper
A vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. An authenticated user can modify settings through the web user interface in a way that could lead to an arbitrary code execution on the F-Secure Internet Gatekeeper server.
Problem types: description: Arbitrary Code Execution in Web Interface of F-Secure Internet Gatekeeper
Affected products: vendor: F-Secure
product: F-Secure Internet Gatekeeper
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Published: 2021-09-28T09:08:33.000Z
CVE-2021-33602 Denial-of-Service (DoS) Vulnerability
A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit)  F-Secure Linux Security 64  F-Secure Atlant &  F-Secure Cloud Protection for Salesforce
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-10-06T09:59:21.000Z
CVE-2021-33603 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit)  F-Secure Linux Security 64  F-Secure Atlant  F-Secure Cloud Protection for Salesforce and Cloud Protection for Microsoft Office 365
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-10-08T09:45:10.000Z
CVE-2021-33604 Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Problem types: cwe_id: CWE-172
description: CWE-172 Encoding Error
Affected products: vendor: Vaadin
product: Vaadin
vendor: Vaadin
product: flow-server
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-06-24T11:16:27.149Z
CVE-2021-33605 Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Vaadin
product: Vaadin
vendor: Vaadin
product: vaadin-checkbox-flow
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-08-25T12:12:41.760Z
CVE-2021-33609 Denial of service in DataCommunicator class in Vaadin 8
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Vaadin
product: Vaadin
vendor: Vaadin
product: vaadin-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2021-10-13T10:58:35.736Z
CVE-2021-33611 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Vaadin
product: Vaadin
vendor: Vaadin
product: vaadin-menu-bar
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-11-02T10:06:56.037Z
CVE-2021-33615 
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T12:32:07.000Z
CVE-2021-33616 
RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T11:51:06.000Z
CVE-2021-33617 
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-31T16:55:50.000Z
CVE-2021-33618 
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-10T22:40:41.000Z
CVE-2021-33620 
Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2021-05-28T00:00:00.000Z
CVE-2021-33621 
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2021-33622 
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-15T18:59:24.000Z
CVE-2021-33623 
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-28T00:00:00.000Z
CVE-2021-33624 
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-23T15:37:09.000Z
CVE-2021-33625 
An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T01:55:10.000Z
CVE-2021-33626 
A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T02:21:29.000Z
CVE-2021-33627 
An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T01:30:36.000Z
CVE-2021-33629 
isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when processing data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T14:46:50.000Z
CVE-2021-33630 NULL-ptr-deref in network sched
NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C.

This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: openEuler
product: kernel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-01-18T15:00:49.312Z
CVE-2021-33631 Kernel crash in EXT4 filesystem
Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: openEuler
product: kernel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-01-18T15:05:58.610Z
CVE-2021-33632 TOCTOU Race Condition problem in iSulad
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C.

This issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.


Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: openEuler
product: iSulad
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: dbearzhu@huawei.com
Published: 2024-03-25T06:59:42.307Z
CVE-2021-33633 Command Injection in aops-ceres
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.

This issue affects aops-ceres: from 1.3.0 through 1.4.1.


Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: openEuler
product: aops-ceres
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-03-23T11:29:44.343Z
CVE-2021-33634 Malicious image running containers may cause DoS attacks
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.


Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: openEuler
product: lcr
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: panwenjie2@huawei.com
Published: 2023-10-29T07:51:49.342Z
CVE-2021-33635 Pull malicious images may cause process to be hijacked
When malicious images are pulled by isula pull, attackers can execute arbitrary code.
Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: openEuler
product: iSulad
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: panwenjie2@huawei.com
Published: 2023-10-29T07:56:44.304Z
CVE-2021-33636 Load malicious images may cause process to be hijacked

When the isula load command is used to load malicious images, attackers can execute arbitrary code.


Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: openEuler
product: iSulad
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: panwenjie2@huawei.com
Published: 2023-10-29T07:58:05.033Z
CVE-2021-33637 Export container in a malicious directory may cause process to be hijacked

When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.


Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: openEuler
product: iSulad
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: panwenjie2@huawei.com
Published: 2023-10-29T07:58:55.220Z
CVE-2021-33638 Run copy with container in a malicious directory may cause container escaping

When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.


Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: openEuler
product: iSulad
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: panwenjie2@huawei.com
Published: 2023-10-29T07:59:45.026Z
CVE-2021-33639 
REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.
Problem types: cwe_id: CWE-749
description: CWE-749: Exposed Dangerous Method or Function
Affected products: vendor: n/a
product: kernel
Published: 2023-03-08T00:00:00.000Z
CVE-2021-33640 
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: openEuler
product: openEuler 22.03 LTS
vendor: openEuler
product: openEuler 20.03 LTS SP1
vendor: openEuler
product: openEuler 20.03 LTS SP3
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
Published: 2022-12-19T00:00:00.000Z
CVE-2021-33641 
When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free).
Problem types: cwe_id: CWE-416
description: CWE-416 : use after free
Affected products: vendor: n/a
product: byacc
Published: 2023-01-20T00:00:00.000Z
CVE-2021-33642 
When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.
Problem types: cwe_id: CWE-835
description: CWE-835 : infinite loop
Affected products: vendor: n/a
product: byacc
Published: 2023-01-20T00:00:00.000Z
CVE-2021-33643 
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: n/a
product: libtar
Published: 2022-08-09T00:00:00.000Z
CVE-2021-33644 
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: n/a
product: libtar
Published: 2022-08-09T00:00:00.000Z
CVE-2021-33645 
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: n/a
product: libtar
Published: 2022-08-09T00:00:00.000Z