rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-42114 Scalable Rowhammering In the Frequency Domain to Bypass TRR Mitigations On Modern DDR4/LPDDR4X Devices
Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer access patterns, consisting of aggressors with different frequencies, phases, and amplitudes allow triggering bit flips on affected memory modules using our Blacksmith fuzzer. The patterns generated by Blacksmith were able to trigger bitflips on all 40 PC-DDR4 DRAM devices in our test pool, which cover the three major DRAM manufacturers: Samsung, SK Hynix, and Micron. This means that, even when chips advertised as Rowhammer-free are used, attackers may still be able to exploit Rowhammer. For example, this enables privilege-escalation attacks against the kernel or binaries such as the sudo binary, and also triggering bit flips in RSA-2048 keys (e.g., SSH keys) to gain cross-tenant virtual-machine access. We can confirm that DRAM devices acquired in July 2020 with DRAM chips from all three major DRAM vendors (Samsung, SK Hynix, Micron) are affected by this vulnerability. For more details, please refer to our publication.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Micron
product: Micron ddr4_sdram
vendor: Samsung
product: Samsung ddr4_sdram
vendor: SK Hynix
product: SK Hynix ddr4_sdram
vendor: Micron
product: Micron lpddr4
vendor: Samsung
product: Samsung lpddr4
vendor: SK Hynix
product: SK Hynix lpddr4
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kaveh Razavi, Patrick Jattke, Stijn Gunter; Eidgenössische Technische Hochschule (ETH) Zürich
lang: en
value: Victor van der Veen; Qualcomm Technologies Inc.
lang: en
value: Pietro Frigo; VU Amsterdam
Published: 2021-11-16T11:45:20.110Z
CVE-2021-42115 Missing HTTPOnly flag on sensitive cookie in TopEase
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.
Problem types: cwe_id: CWE-1004
description: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:07.000Z
CVE-2021-42116 Unauthorized Menu Item Access in TopEase
Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the front-end source code or other means.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:08.000Z
CVE-2021-42117 UI Redressing in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:09.000Z
CVE-2021-42118 Stored XSS in TopEase
Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:10.000Z
CVE-2021-42119 Stored XSS in Search Function in TopEase
Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:11.000Z
CVE-2021-42120 Missing Character Length (Denial of Service) in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion of the underlying resource.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:12.000Z
CVE-2021-42121 Denial of Service via Invalid Date Format in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads to breaking the object page that the date field is present.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:12.000Z
CVE-2021-42122 Denial of Service via Invalid Object Attribute in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the affected attribute non-editable.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:13.000Z
CVE-2021-42123 Missing Upload Filter in TopEase
Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enabling client-side attacks.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Business-DNA Solutions GmbH
product: TopEase
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: SIX Group Services AG, Cyber Controls
Published: 2021-11-30T11:28:14.000Z
CVE-2021-42124 
An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:12:44.000Z
CVE-2021-42125 
An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: Ivanti Avalance
Published: 2021-12-07T13:12:49.000Z
CVE-2021-42126 
An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:12:56.000Z
CVE-2021-42127 
A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:01.000Z
CVE-2021-42128 
An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service.
Problem types: cwe_id: CWE-749
description: Exposed Dangerous Method or Function (CWE-749)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:10.000Z
CVE-2021-42129 
A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:14.000Z
CVE-2021-42130 
A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:19.000Z
CVE-2021-42131 
A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:24.000Z
CVE-2021-42132 
A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:29.000Z
CVE-2021-42133 
An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload of File with Dangerous Type (CWE-434)
Affected products: vendor: n/a
product: Ivanti Avalanche
Published: 2021-12-07T13:13:35.000Z
CVE-2021-42134 
The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-11T00:55:43.000Z
CVE-2021-42135 
HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-11T02:52:59.000Z
CVE-2021-42136 
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-13T15:32:56.000Z
CVE-2021-42137 
An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-11T04:02:32.000Z
CVE-2021-42138 
A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.
Problem types: description: https://cwe.mitre.org/data/definitions/336.html
Affected products: vendor: Thales CPL
product: Safenet Authentication Service
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: compass-security
Published: 2021-12-20T20:19:10.000Z
CVE-2021-42139 
Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-11T04:14:16.000Z
CVE-2021-42141 
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-22T00:00:00.000Z
CVE-2021-42142 
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-23T00:00:00.000Z
CVE-2021-42143 
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-24T00:00:00.000Z
CVE-2021-42144 
Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_decrypt_message().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-24T00:00:00.000Z
CVE-2021-42145 
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-24T00:00:00.000Z
CVE-2021-42146 
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-24T00:00:00.000Z
CVE-2021-42147 
Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denial of service via crafted data packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-24T00:00:00.000Z
CVE-2021-42165 
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T11:25:48.000Z
CVE-2021-42168 
Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESID or other unspecified impacts via the fullname parameter to the login_registration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-24T18:17:03.000Z
CVE-2021-42169 
The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T13:09:52.000Z
CVE-2021-42171 
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-14T14:51:06.000Z
CVE-2021-42183 
MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T13:02:49.000Z
CVE-2021-42185 
wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T11:06:30.000Z
CVE-2021-42192 
Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:00:00.000Z
CVE-2021-42193 
nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2021-42194 
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T21:12:04.000Z
CVE-2021-42195 
An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function handleEditText() located in swfdump.c. It allows an attacker to cause code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T16:31:33.000Z
CVE-2021-42196 
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traits_parse() located in abc.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T16:42:37.000Z
CVE-2021-42197 
An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. It allows an attacker to cause code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T16:51:23.000Z
CVE-2021-42198 
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_GetBits() located in rfxswf.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T17:19:30.000Z
CVE-2021-42199 
An issue was discovered in swftools through 20201222. A heap buffer overflow exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T17:25:39.000Z
CVE-2021-42200 
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function main() located in swfdump.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T17:36:52.000Z