rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33014 KUKA KR C4 - Use of Hard-Coded Credentials
An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: KUKA
product: KR C4
vendor: KUKA
product: KSS (KUKA.SystemSoftware)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chen Jie from NSFOCUS reported these vulnerabilities to CISA.
Published: 2022-05-26T16:33:08.000Z
CVE-2021-33015 
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-824
description: ACCESS OF UNINITIALIZED POINTER CWE-824
Affected products: vendor: n/a
product: Cscape
Published: 2021-08-25T18:13:26.000Z
CVE-2021-33016 KUKA KR C4 - Use of Hard-Coded Credentials
An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: KUKA
product: KR C4
vendor: KUKA
product: KSS (KUKA.SystemSoftware)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chen Jie from NSFOCUS reported these vulnerabilities to CISA.
Published: 2022-05-26T16:32:36.000Z
CVE-2021-33017 Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel
The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Philips
product: IntelliBridge EC 40 Hub
vendor: Philips
product: IntelliBridge EC 80 Hub
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks
Published: 2021-12-27T18:48:21.413Z
CVE-2021-33018 Philips Vue PACS Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Philips
product: Vue PACS
vendor: Philips
product: Vue MyVue
vendor: Philips
product: Vue Speech
vendor: Philips
product: Vue Motion
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Philips reported these vulnerabilities to CISA.
Published: 2022-04-01T22:17:21.000Z
CVE-2021-33019 
A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Delta Electronics DOPSoft
Published: 2021-08-30T17:09:35.000Z
CVE-2021-33020 Philips Vue PACS Use of a Key Past its Expiration Date
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Problem types: cwe_id: CWE-324
description: CWE-324: Use of a Key Past its Expiration Date
Affected products: vendor: Philips
product: Vue PACS
vendor: Philips
product: Vue MyVue
vendor: Philips
product: Vue Speech
vendor: Philips
product: Vue Motion
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Philips reported these vulnerabilities to CISA.
Published: 2022-04-01T22:17:17.000Z
CVE-2021-33021 xArrow SCADA Cross-site Scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-site Scripting
Affected products: vendor: xArrow
product: xArrow SCADA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Sharon Brizinov from Claroty, and Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-16T17:53:01.000Z
CVE-2021-33022 Philips Vue PACS Cleartext Transmission of Sensitive Information
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Philips
product: Vue PACS
vendor: Philips
product: Vue MyVue
vendor: Philips
product: Vue Speech
vendor: Philips
product: Vue Motion
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Philips reported these vulnerabilities to CISA.
Published: 2022-04-01T22:17:20.000Z
CVE-2021-33023 Advantech WebAccess
Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Advantech
product: WebAccess
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Natnael Samson, @NattiSamson, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA.
Published: 2021-10-18T12:41:08.470Z
CVE-2021-33024 Philips Vue PACS Insufficiently Protected Credentials
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Philips
product: Vue PACS
vendor: Philips
product: Vue MyVue
vendor: Philips
product: Vue Speech
vendor: Philips
product: Vue Motion
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Philips reported these vulnerabilities to CISA.
Published: 2022-04-01T22:17:18.000Z
CVE-2021-33025 xArrow SCADA Path Traversal
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-site Scripting
Affected products: vendor: xArrow
product: xArrow SCADA
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
version: 3.1
Credits: lang: en
value: Sharon Brizinov from Claroty, and Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-16T17:53:33.333Z
CVE-2021-33026 
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-13T22:51:20.000Z
CVE-2021-33027 
Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-19T11:52:00.000Z
CVE-2021-33031 
In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email address if the attacker knows details of the victim such as the exact roles and group roles, ID, and remote authentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T15:28:01.000Z
CVE-2021-33032 
A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T17:45:35.000Z
CVE-2021-33033 
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T22:57:17.000Z
CVE-2021-33034 
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T22:57:07.000Z
CVE-2021-33035 Buffer overflow from a crafted DBF file
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Apache Software Foundation
product: Apache OpenOffice
Published: 2021-09-23T08:10:10.000Z
CVE-2021-33036 Apache Hadoop Privilege escalation vulnerability
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Credits: lang: en
value: Apache Hadoop would like to thank Hideyuki Furue for reporting and fixing this issue.
Published: 2022-06-15T14:25:14.000Z
CVE-2021-33037 Incorrect Transfer-Encoding handling with HTTP/1.0
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
Credits: lang: en
value: The Apache Tomcat Security Team would like to thank Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab for identifying and reporting this issue.
Published: 2021-07-12T14:55:15.000Z
CVE-2021-33038 
An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T13:51:14.000Z
CVE-2021-33040 
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-17T16:14:29.000Z
CVE-2021-33041 
vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-17T16:04:23.000Z
CVE-2021-33044 
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Problem types: description: Improper Authentication
Affected products: vendor: n/a
product: Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices
Published: 2021-09-15T21:36:04.000Z
CVE-2021-33045 
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Problem types: description: Improper Authentication
Affected products: vendor: n/a
product: Some Dahua IP Camera, Video Intercom, NVR, XVR devices
Published: 2021-09-15T21:50:08.000Z
CVE-2021-33046 
Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.
Problem types: description: Access control
Affected products: vendor: n/a
product: Access control vulnerability found in some Dahua products
Published: 2022-01-13T20:27:13.000Z
CVE-2021-33054 
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-04T14:40:15.000Z
CVE-2021-33055 
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-30T18:12:17.000Z
CVE-2021-33056 
Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T20:54:37.000Z
CVE-2021-33057 
The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T22:36:59.000Z
CVE-2021-33058 
Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: version
Published: 2021-11-17T19:11:16.000Z
CVE-2021-33059 
Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Administrative Tools for Intel(R) Network Adapters
Published: 2021-11-17T19:13:18.000Z
CVE-2021-33060 
Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2022-08-18T19:58:06.000Z
CVE-2021-33061 
Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description:  denial of service 
Affected products: vendor: n/a
product: Intel(R) 82599 Ethernet Controllers and Adapters
Published: 2022-02-09T22:04:34.000Z
CVE-2021-33062 
Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) VTune(TM) Profiler
Published: 2021-11-17T19:10:23.000Z
CVE-2021-33063 
Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10
Published: 2021-11-17T19:09:02.000Z
CVE-2021-33064 
Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) System Studio
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: 2022-11-11T15:49:15.307Z
CVE-2021-33068 
Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial of service via network access.
Problem types: description:  denial of service 
Affected products: vendor: n/a
product: Intel(R) AMT
Published: 2022-02-09T22:04:31.000Z
CVE-2021-33069 
Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC
default_status: unaffected
Published: 2022-05-12T16:35:59.000Z
CVE-2021-33071 
Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) oneAPI Rendering Toolkit
Published: 2021-11-17T19:03:56.000Z
CVE-2021-33073 
Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Distribution of OpenVINOâ„¢ Toolkit
Published: 2021-11-17T19:22:19.000Z
CVE-2021-33074 
Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products
Published: 2022-05-12T16:35:58.000Z
CVE-2021-33075 
Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products
Published: 2022-05-12T16:35:59.000Z
CVE-2021-33076 
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Problem types: description: information disclosure 
Affected products: vendor: n/a
product: Intel(R) SSD DC
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Published: 2022-09-20T14:24:46.000Z