rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3320 Type Confusion in 802154 ACK Frames Handling
Type Confusion in 802154 ACK Frames Handling. Zephyr versions >= v2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-27r3-rxch-2hm7
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference (CWE-476)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-05-24T21:40:30.745Z
CVE-2021-3321 Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal
Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99
Problem types: cwe_id: CWE-680
description: Integer Overflow to Buffer Overflow (CWE-680)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Published: 2021-10-12T21:50:13.151Z
CVE-2021-3322 Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr
Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference (CWE-476)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-10-12T21:50:14.638Z
CVE-2021-3323 Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound) (CWE-191). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc
Problem types: cwe_id: CWE-191
description: Integer Underflow (Wrap or Wraparound) (CWE-191)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-10-12T21:50:16.135Z
CVE-2021-3325 
Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_deny option). This issue occurred because a new access-control feature was introduced without considering that some exiting installations became unsafe, upon an update to 3.13.0, unless the new feature was immediately configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-27T18:56:59.000Z
CVE-2021-3326 
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-27T00:00:00.000Z
CVE-2021-3327 
Ovation Dynamic Content 1.10.1 for Elementor allows XSS via the post_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T02:52:24.000Z
CVE-2021-3328 
An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-bounds read that crashes the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T17:07:08.000Z
CVE-2021-3329 DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
Problem types: cwe_id: CWE-703
description: Improper Check or Handling of Exceptional Conditions (CWE-703)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
Published: 2023-02-26T00:00:00.000Z
CVE-2021-3330 RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr
RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions >= >=2.4.0 contain Out-of-bounds Write (CWE-787). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-10-12T21:50:17.624Z
CVE-2021-3331 
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-27T20:22:25.000Z
CVE-2021-3332 
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T20:22:58.000Z
CVE-2021-3333 
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T13:01:25.000Z
CVE-2021-3336 
DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T04:58:39.000Z
CVE-2021-3337 
The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quote in the postbit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T19:32:59.000Z
CVE-2021-3339 
ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T07:07:35.000Z
CVE-2021-3340 
A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T21:01:09.000Z
CVE-2021-3341 
A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before 20.0.219.0, allows an attacker to read any file on the host file system via an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T00:45:35.000Z
CVE-2021-3342 
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T21:01:57.000Z
CVE-2021-3344 
A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the container image under construction. An OpenShift user, able to execute code during build time inside this container can re-use the credentials to overwrite arbitrary container images in internal registries and/or escalate their privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This affects github.com/openshift/builder v0.0.0-20210125201112-7901cb396121 and before.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: openshift/builder
Published: 2021-03-16T21:09:45.000Z
CVE-2021-3345 
_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T14:20:31.000Z
CVE-2021-3346 
Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T16:38:09.000Z
CVE-2021-3347 
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T16:56:16.000Z
CVE-2021-3348 
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T03:43:32.000Z
CVE-2021-3349 
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T04:04:19.000Z
CVE-2021-3350 
deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T04:35:34.000Z
CVE-2021-3351 
OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T05:22:23.000Z
CVE-2021-3352 
The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access (view and modify) user data without authorization due to improper handling of tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:35:14.000Z
CVE-2021-3355 
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-24T15:00:48.000Z
CVE-2021-3370 
DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-08T03:42:23.000Z
CVE-2021-3374 
Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T18:13:44.000Z
CVE-2021-3375 
ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-15T17:39:44.000Z
CVE-2021-3376 
An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using the user_group_id_field parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T13:16:55.000Z
CVE-2021-3377 
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-05T19:03:58.000Z
CVE-2021-3378 
FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T22:08:33.000Z
CVE-2021-3380 
Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-10T16:30:03.000Z
CVE-2021-3382 
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T15:15:04.000Z
CVE-2021-3384 
A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which would temporarily prevent the system to contact new hosts via IPv4 or IPv6. This affects versions 2.0.0 to 2.7.7, 2.8.0 to 2.16.0, 3.0.0 to 3.7.16, 3.8.0 to 3.11.4, and 4.0.0 to 4.1.5. Fixed in versions 2.7.8, 3.7.17, 3.11.5, and 4.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-02T17:08:54.000Z
CVE-2021-3391 
MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T19:37:09.000Z
CVE-2021-3392 
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: QEMU
Published: 2021-03-23T19:07:17.000Z
CVE-2021-3393 
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.
Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: n/a
product: postgresql
Published: 2021-04-01T13:46:02.000Z
CVE-2021-3394 
Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for a local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T14:51:09.000Z
CVE-2021-3395 
A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-02T20:43:34.000Z
CVE-2021-3396 
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T20:13:54.000Z
CVE-2021-3398 
Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T16:13:24.000Z
CVE-2021-3401 
Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states "I believe that this vulnerability cannot actually be exploited."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-04T04:47:30.000Z
CVE-2021-3402 
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: libyara
Published: 2021-05-14T20:05:25.000Z
CVE-2021-3403 
In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a double free which can be triggered via a crafted file.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: ytnef
Published: 2021-03-04T21:10:50.000Z
CVE-2021-3404 
In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a heap buffer overflow which can be triggered via a crafted file.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: ytnef
Published: 2021-03-04T21:10:57.000Z
CVE-2021-3405 
A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: libebml
Published: 2021-02-23T19:05:27.000Z
CVE-2021-3406 
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
Problem types: cwe_id: CWE-347
description: CWE-347
Affected products: vendor: n/a
product: keylime
Published: 2021-02-25T19:15:57.000Z
CVE-2021-3407 
A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences.
Problem types: cwe_id: CWE-415
description: CWE-415
Affected products: vendor: n/a
product: mupdf
Published: 2021-02-23T22:04:15.000Z
CVE-2021-3409 
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: QEMU
Published: 2021-03-23T20:20:58.000Z
CVE-2021-3410 
A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local execution of arbitrary code in the user context.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: libcaca
Published: 2021-02-23T22:22:18.000Z
CVE-2021-3411 
A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: n/a
product: Linux kernel
Published: 2021-03-09T19:08:30.000Z
CVE-2021-3412 
It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.
Problem types: cwe_id: CWE-307
description: CWE-307
Affected products: vendor: n/a
product: 3Scale
Published: 2021-06-01T13:47:23.000Z
CVE-2021-3413 
A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Satellite
Published: 2021-04-08T22:06:48.000Z
CVE-2021-3414 
A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organizations are also granted. The highest threat from this vulnerability is to data confidentiality.
Problem types: cwe_id: CWE-281
description: CWE-281 - Improper Preservation of Permissions
Affected products: vendor: n/a
product: satellite
Published: 2022-08-26T15:25:42.000Z
CVE-2021-3416 
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: n/a
product: QEMU
Published: 2021-03-18T19:53:29.000Z