rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-37940 
An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly accessible.
Problem types: cwe_id: CWE-918
description: CWE-918
Affected products: vendor: Elastic
product: Enterprisesearch
Published: 2021-12-07T18:59:29.000Z
CVE-2021-37941 
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of permissions than they possess. This vulnerability affects users that have set up the agent via the attacher cli 3, the attach API 2, as well as users that have enabled the profiling_inferred_spans_enabled option
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: Elastic
product: APM Java Agent
Published: 2021-12-08T21:15:19.000Z
CVE-2021-37942 APM Java Agent Local Privilege Escalation
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Elastic
product: Elastic APM Java Agent
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-22T01:33:48.984Z
CVE-2021-37956 
Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:29.000Z
CVE-2021-37957 
Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:30.000Z
CVE-2021-37958 
Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:32.000Z
CVE-2021-37959 
Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:33.000Z
CVE-2021-37961 
Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:35.000Z
CVE-2021-37962 
Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:36.000Z
CVE-2021-37963 
Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Problem types: description: Side-channel information leakage
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:38.000Z
CVE-2021-37964 
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:39.000Z
CVE-2021-37965 
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:41.000Z
CVE-2021-37966 
Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:42.000Z
CVE-2021-37967 
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:44.000Z
CVE-2021-37968 
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:46.000Z
CVE-2021-37969 
Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalation via a crafted file.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:47.000Z
CVE-2021-37970 
Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:49.000Z
CVE-2021-37971 
Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:50.000Z
CVE-2021-37972 
Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:30:52.000Z
CVE-2021-37973 
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:40:09.000Z
CVE-2021-37974 
Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:50:12.000Z
CVE-2021-37975 
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T00:00:00.000Z
CVE-2021-37976 
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-10-08T21:50:15.000Z
CVE-2021-37977 
Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T20:25:16.000Z
CVE-2021-37978 
Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T20:25:18.000Z
CVE-2021-37979 
heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T20:25:20.000Z
CVE-2021-37980 
Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T20:25:21.000Z
CVE-2021-37981 
Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:31.000Z
CVE-2021-37982 
Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:32.000Z
CVE-2021-37983 
Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:34.000Z
CVE-2021-37984 
Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:35.000Z
CVE-2021-37985 
Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to debugger to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:37.000Z
CVE-2021-37986 
Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:38.000Z
CVE-2021-37987 
Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:40.000Z
CVE-2021-37988 
Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:41.000Z
CVE-2021-37989 
Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:43.000Z
CVE-2021-37990 
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:45.000Z
CVE-2021-37991 
Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Race
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:46.000Z
CVE-2021-37992 
Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:48.000Z
CVE-2021-37993 
Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:49.000Z
CVE-2021-37994 
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:51.000Z
CVE-2021-37995 
Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:52.000Z
CVE-2021-37996 
Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a malicious file.
Problem types: description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2021-11-02T21:05:54.000Z
CVE-2021-37997 
Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:22.000Z
CVE-2021-37998 
Use after free in Garbage Collection in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:23.000Z
CVE-2021-37999 
Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML in a new browser tab via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:25.000Z
CVE-2021-38000 
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
Problem types: description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:26.000Z
CVE-2021-38001 
Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:28.000Z
CVE-2021-38002 
Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:29.000Z
CVE-2021-38003 
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:31.000Z
CVE-2021-38004 
Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2021-11-23T21:30:32.000Z
CVE-2021-38005 
Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:33.000Z
CVE-2021-38006 
Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:35.000Z
CVE-2021-38007 
Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:36.000Z
CVE-2021-38008 
Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:38.000Z
CVE-2021-38009 
Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:39.000Z
CVE-2021-38010 
Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:41.000Z
CVE-2021-38011 
Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:42.000Z
CVE-2021-38012 
Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:44.000Z
CVE-2021-38013 
Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:45.000Z
CVE-2021-38014 
Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds write
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:47.000Z
CVE-2021-38015 
Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:48.000Z
CVE-2021-38016 
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:50.000Z
CVE-2021-38017 
Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:51.000Z
CVE-2021-38018 
Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:53.000Z
CVE-2021-38019 
Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:54.000Z
CVE-2021-38020 
Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:55.000Z
CVE-2021-38021 
Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:57.000Z
CVE-2021-38022 
Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2021-12-23T00:05:59.000Z
CVE-2021-38023 
Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2024-09-23T21:56:31.209Z
CVE-2021-38084 
An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T21:22:29.000Z