rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-37724 
A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.
Problem types: description: remote arbitrary command execution
Affected products: vendor: n/a
product: Aruba Operating System Software
Published: 2021-09-07T12:34:20.000Z
CVE-2021-37725 
A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
Problem types: description: remote cross-site request forgery (csrf)
Affected products: vendor: n/a
product: Aruba SD-WAN Software and Gateways; Aruba Operating System Software
Published: 2021-09-07T12:39:59.000Z
CVE-2021-37726 
A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Problem types: description: remote buffer overflow
Affected products: vendor: n/a
product: HPE Aruba Instant (IAP)
Published: 2021-10-12T14:06:35.000Z
CVE-2021-37727 
A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Problem types: description: remote arbitrary command execution
Affected products: vendor: n/a
product: HPE Aruba Instant (IAP)
Published: 2021-10-12T14:08:58.000Z
CVE-2021-37728 
A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5.0.13. Aruba has released patches for ArubaOS that address this security vulnerability.
Problem types: description: remote path traversal
Affected products: vendor: n/a
product: Aruba Operating System Software
Published: 2021-09-07T12:36:38.000Z
CVE-2021-37729 
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.3, 8.6.0.9, 8.5.0.12, 8.3.0.16, 6.5.4.19, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
Problem types: description: remote path traversal
Affected products: vendor: n/a
product: Aruba SD-WAN Software and Gateways; Aruba Operating System Software
Published: 2021-09-07T12:37:41.000Z
CVE-2021-37730 
A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Problem types: description: remote arbitrary command execution
Affected products: vendor: n/a
product: HPE Aruba Instant (IAP)
Published: 2021-10-12T14:07:45.000Z
CVE-2021-37731 
A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
Problem types: description: local path traversal
Affected products: vendor: n/a
product: Aruba SD-WAN Software and Gateways; Aruba Operating System Software
Published: 2021-09-07T12:41:13.000Z
CVE-2021-37732 
A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant 8.7.x.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Problem types: description: remote arbitrary command execution
Affected products: vendor: n/a
product: HPE Aruba Instant (IAP)
Published: 2021-10-12T15:12:55.000Z
CVE-2021-37733 
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.11, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
Problem types: description: remote path traversal
Affected products: vendor: n/a
product: Aruba SD-WAN Software and Gateways; Aruba Operating System Software
Published: 2021-09-07T12:38:54.000Z
CVE-2021-37734 
A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below; Aruba Instant 8.8.x.x: 8.8.0.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Problem types: description: remote unauthorized read access to files
Affected products: vendor: n/a
product: HPE Aruba Instant (IAP)
Published: 2021-10-12T15:16:28.000Z
CVE-2021-37735 
A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.10 and below; Aruba Instant 8.6.x.x: 8.6.0.4 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Problem types: description: remote denial of service
Affected products: vendor: n/a
product: HPE Aruba Instant (IAP)
Published: 2021-10-12T15:14:14.000Z
CVE-2021-37736 
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote authentication bypass
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-10-15T12:32:37.000Z
CVE-2021-37737 
A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote SQL injection
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-10-15T12:31:24.000Z
CVE-2021-37738 
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote disclosure of sensitive information
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-10-15T13:31:45.000Z
CVE-2021-37739 
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
Problem types: description: remote arbitrary command execution
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-10-15T13:34:23.000Z
CVE-2021-37740 
A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 before v3.0.4, that allows a remote attacker to turn the device unresponsive to all requests on the KNXnet/IP Secure layer, until the device is rebooted, via a SESSION_REQUEST frame with a modified total length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T19:31:19.000Z
CVE-2021-37741 
ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-21T12:56:52.000Z
CVE-2021-37742 
app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-30T00:00:00.000Z
CVE-2021-37743 
app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-30T02:09:05.000Z
CVE-2021-37746 
textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-30T13:17:32.000Z
CVE-2021-37748 
Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-28T11:11:20.000Z
CVE-2021-37749 
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetMap method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-30T03:20:17.000Z
CVE-2021-37750 
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-23T00:00:00.000Z
CVE-2021-37759 
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-31T17:35:10.000Z
CVE-2021-37760 
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-31T17:35:00.000Z
CVE-2021-37761 
Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T16:23:04.000Z
CVE-2021-37762 
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T15:40:33.000Z
CVE-2021-37764 
Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturers.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T20:36:25.000Z
CVE-2021-37770 
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T14:17:18.000Z
CVE-2021-37774 
An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-19T00:00:00.000Z
CVE-2021-37777 
Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by another site owner just by knowing the other site name and fuzzing for picture names. This leads to sensitive information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T13:40:18.000Z
CVE-2021-37778 
There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T14:38:23.000Z
CVE-2021-37781 
Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-37782 
Employee Record Management System v 1.2 is vulnerable to SQL Injection via editempprofile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-37786 
Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. A denial of service (physically proximate) could be caused by scanning a crafted QR code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T13:52:13.000Z
CVE-2021-37787 
The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2021-37788 
A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T12:32:07.000Z
CVE-2021-37789 
stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-02T00:00:00.000Z
CVE-2021-37791 
MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T15:39:20.000Z
CVE-2021-37794 
A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:28:09.000Z
CVE-2021-37803 
An SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0 via the username in lognin.php .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T15:28:49.000Z
CVE-2021-37805 
A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the add-vehicle.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T15:52:49.000Z
CVE-2021-37806 
An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0. The system is vulnerable to time-based SQL injection on multiple endpoints. Based on the SLEEP(N) function payload that will sleep for a number of seconds used on the (1) editid , (2) viewid, and (3) catename parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T16:01:42.000Z
CVE-2021-37807 
An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /check_availability.php endpoint that serves as a checker whether a new user's email is already exist within the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T16:06:21.000Z
CVE-2021-37808 
SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) username parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T16:21:03.000Z
CVE-2021-37819 
PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T21:48:53.000Z
CVE-2021-37823 
OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-03T00:00:00.000Z
CVE-2021-37832 
A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T12:30:57.000Z
CVE-2021-37833 
A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T12:31:06.000Z
CVE-2021-37839 Improper access to dataset metadata information
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
Problem types: cwe_id: CWE-273
description: CWE-273 Improper Check for Dropped Privileges
Affected products: vendor: Apache Software Foundation
product: Apache Superset
Credits: lang: en
value: Apache Superset would like to thank Dinesh for reporting this issue
Published: 2022-07-06T12:35:10.000Z
CVE-2021-37840 
aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T13:53:57.000Z
CVE-2021-37841 
Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read, write and possibly even execute code inside the containers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T13:30:30.000Z
CVE-2021-37842 
metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-02T11:39:24.000Z
CVE-2021-37843 
The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authentication is provided). The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6.6, 4.0.12, 5.0.5; for Bamboo 2.5.9, 3.6.6, 4.0.12, 5.0.5; and for Fisheye 2.5.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-08-02T18:47:32.000Z
CVE-2021-37845 
An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only valid in non-authenticated state." in RFC2595). This potentially allows an attacker to cause a victim's e-mail messages to be stored into an attacker's IMAP mailbox, but depends on details of the victim's client behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2021-37847 
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T19:45:46.000Z
CVE-2021-37848 
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T19:46:02.000Z