rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33646 
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: n/a
product: libtar
Published: 2022-08-09T00:00:00.000Z
CVE-2021-33647 
When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap allocated buffers.
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:19:06.000Z
CVE-2021-33648 
When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:17:35.000Z
CVE-2021-33649 
When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_shape, it will access data outside of bounds of input_shape which allocated from heap buffers.
Problem types: cwe_id: CWE-125
description: CWE-125  Out-of-bounds Read
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:20:28.000Z
CVE-2021-33650 
When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds of inputs which allocated from heap buffers.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:24:12.000Z
CVE-2021-33651 
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception.
Problem types: cwe_id: CWE-369
description: CWE-369 Division by Zero Exception
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:23:04.000Z
CVE-2021-33652 
When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes element, it will cause a division by 0 exception.
Problem types: cwe_id: CWE-369
description: CWE-369 Division by Zero Exception
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:21:47.000Z
CVE-2021-33653 
When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter block_shape element, it will cause a division by 0 exception.
Problem types: cwe_id: CWE-369
description: CWE-369  Division by Zero Exception
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:25:27.000Z
CVE-2021-33654 
When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception.
Problem types: cwe_id: CWE-369
description: CWE-369 Division by Zero Exception
Affected products: vendor: n/a
product: openEuler:mindspore
Published: 2022-06-27T16:26:29.000Z
CVE-2021-33655 
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: n/a
product: kernel
Published: 2022-07-18T14:45:50.000Z
CVE-2021-33656 
When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: n/a
product: openEuler:kernel
Published: 2022-07-18T14:44:28.000Z
CVE-2021-33657 
There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.
Problem types: description: heap overflow
Affected products: vendor: n/a
product: SDL2
Published: 2022-04-01T00:00:00.000Z
CVE-2021-33658 
atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.
Problem types: description: n/a
Affected products: vendor: openEuler
product: atune
Published: 2022-03-11T17:54:21.000Z
CVE-2021-33659 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:33:01.000Z
CVE-2021-33660 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:32:11.000Z
CVE-2021-33661 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:32:55.000Z
CVE-2021-33662 
Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-06-09T13:32:05.000Z
CVE-2021-33663 
SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83,7.84, allows an unauthorized attacker to insert cleartext commands due to improper restriction of I/O buffering into encrypted SMTP sessions over the network which can partially impact the integrity of the application.
Problem types: description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP
Published: 2021-06-09T13:33:06.000Z
CVE-2021-33664 
SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP)
Published: 2021-06-09T13:32:50.000Z
CVE-2021-33665 
SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
Published: 2021-06-09T13:33:13.000Z
CVE-2021-33666 
When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Commerce Cloud
Published: 2021-06-09T13:32:45.000Z
CVE-2021-33667 
Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP Business Objects Web Intelligence (BI Launchpad)
Published: 2021-07-14T11:03:26.000Z
CVE-2021-33668 
Due to improper input sanitization, specially crafted LDAP queries can be injected by an unauthenticated user. This could partially impact the confidentiality of the application.
Problem types: description: LDAP Injection
Affected products: vendor: SAP SE
product: SAP InfraBox
Published: 2021-06-09T12:02:26.000Z
CVE-2021-33669 
Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and availability.
Problem types: description: Insecure Temporary File Storage
Affected products: vendor: SAP SE
product: SAP Mobile SDK Certificate Provider
Published: 2021-06-09T13:59:32.000Z
CVE-2021-33670 
SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for Java (Http Service)
Published: 2021-07-14T11:04:11.000Z
CVE-2021-33671 
SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. The impact of missing authorization could result to abuse of functionality restricted to a particular user group, and could allow unauthorized users to read, modify or delete restricted data.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP NetWeaver Guided Procedures (Administration Workset)
Published: 2021-07-14T11:03:32.000Z
CVE-2021-33672 
Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability.
Problem types: description: OS Command Injection
Affected products: vendor: SAP SE
product: SAP Contact Center
Published: 2021-09-14T11:21:48.000Z
CVE-2021-33673 
Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to exploit a Stored Cross-Site Scripting (XSS) vulnerability when a user browses through the employee directory and to execute arbitrary code on the victim's browser. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands.
Problem types: description: OS Command Injection
Affected products: vendor: SAP SE
product: SAP Contact Center
Published: 2021-09-14T11:18:51.000Z
CVE-2021-33674 
Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected Cross-Site Scripting (XSS) vulnerability when creating a new email and to execute arbitrary code on the victim's browser.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Contact Center
Published: 2021-09-14T11:24:33.000Z
CVE-2021-33675 
Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected Cross-Site Scripting (XSS) vulnerability through phishing and to execute arbitrary code on the victim's browser.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Contact Center
Published: 2021-09-14T11:19:23.000Z
CVE-2021-33676 
A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.
Problem types: description: Missing Authority Check
Affected products: vendor: SAP SE
product: SAP CRM
Published: 2021-07-14T11:03:48.000Z
CVE-2021-33677 
SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP and ABAP Platform
Published: 2021-07-14T11:03:57.000Z
CVE-2021-33678 
A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.
Problem types: cwe_id: CWE-95
description: CWE-95 (Code Injection)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Reconciliation Framework)
Published: 2021-07-14T11:04:19.000Z
CVE-2021-33679 
The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (BI Workspace)
Published: 2021-09-14T11:19:15.000Z
CVE-2021-33680 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and causes the application to crash and becoming temporarily unavailable until the user restarts the application.
Problem types: cwe_id: CWE-120
description: CWE-120 (Buffer Overflow)
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-07-14T11:03:39.000Z
CVE-2021-33681 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and causes the application to crash and becoming temporarily unavailable until the user restarts the application.
Problem types: cwe_id: CWE-787
description: CWE-787 (Out-of-bounds Write)
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-07-14T11:04:04.000Z
CVE-2021-33682 
SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with basic level privileges to store a malicious script on SAP Lumira Server. The execution of the script content, by a victim registered on SAP Lumira Server, could compromise the confidentiality and integrity of SAP Lumira content.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Lumira Server
Published: 2021-07-14T11:08:58.000Z
CVE-2021-33683 
SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
Problem types: cwe_id: CWE-444
description: CWE-444 (HTTP Request Smuggling)
Affected products: vendor: SAP SE
product: SAP Web Dispatcher and Internet Communication Manager
Published: 2021-07-14T11:04:45.000Z
CVE-2021-33684 
SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to restart itself after the crash and hence the impact on the availability is low.
Problem types: cwe_id: CWE-787
description: Memory Corruption (CWE-787)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP and ABAP Platform
Published: 2021-07-14T11:04:32.000Z
CVE-2021-33685 
SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restricted directory. A successful attack allows access to high level sensitive data
Problem types: description: Directory/Path Traversal
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-09-14T11:21:56.000Z
CVE-2021-33686 
Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over kind or degree.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-09-14T11:24:43.000Z
CVE-2021-33687 
SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (Enterprise Portal)
Published: 2021-07-14T11:05:00.000Z
CVE-2021-33688 
SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions, only some information can be obtained.
Problem types: description: SQL Injection
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-09-14T11:24:52.000Z
CVE-2021-33689 
When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted.
Problem types: cwe_id: CWE-778
description: Insufficient Logging (CWE-778)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (Administrator applications)
Published: 2021-07-14T11:04:38.000Z
CVE-2021-33690 
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: SAP SE
product: SAP NetWeaver Development Infrastructure (Component Build Service)
Published: 2021-09-15T18:01:41.000Z
CVE-2021-33691 
NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.SAP NetWeaver Development Infrastructure Notification Service allows a threat actor to send crafted scripts to a victim. If the victim has an active session when the crafted script gets executed, the threat actor could compromise information in victims session, and gain access to some sensitive information also.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver Development Infrastructure (Notification Service)
Published: 2021-09-15T18:01:48.000Z
CVE-2021-33692 
SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories.
Problem types: description: Code Injection via Path Traversal
Affected products: vendor: SAP SE
product: SAP Cloud Connector
Published: 2021-09-15T18:01:43.000Z
CVE-2021-33693 
SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: SAP SE
product: SAP Cloud Connector
Published: 2021-09-15T18:01:47.000Z
CVE-2021-33694 
SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP SE
product: SAP Cloud Connector
Published: 2021-09-15T18:01:49.000Z
CVE-2021-33695 
Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.
Problem types: cwe_id: CWE-297
description: CWE-297: Improper Validation of Certificate with Host Mismatch
Affected products: vendor: SAP SE
product: SAP Cloud Connector
Published: 2021-09-15T18:01:44.000Z
CVE-2021-33696 
SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading to non-permanently deface or modify displayed content from a Web site.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Crystal Report)
Published: 2021-09-15T18:01:42.000Z