rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-40051 
There is an unauthorized access vulnerability in system components. Successful exploitation of this vulnerability will affect confidentiality.
Problem types: description: Unauthorized access vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
vendor: Huawei
product: HarmonyOS
Published: 2022-03-07T13:50:41.000Z
CVE-2021-40052 
There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability.
Problem types: description: Incorrect buffer size calculation vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:50:35.000Z
CVE-2021-40053 
There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.
Problem types: description: Permission control vulnerability
Affected products: vendor: n/a
product: HarmonyOS;EMUI;Magic UI
Published: 2022-03-07T13:50:29.000Z
CVE-2021-40054 
There is an integer underflow vulnerability in the atcmdserver module. Successful exploitation of this vulnerability may affect integrity.
Problem types: description: Integer underflow vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:50:21.000Z
CVE-2021-40055 
There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect integrity.
Problem types: description: Man-in-the-middle attack vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
vendor: Huawei
product: HarmonyOS
Published: 2022-03-07T13:50:15.000Z
CVE-2021-40056 
There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Buffer Copy without Checking Size of Input
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:50:10.000Z
CVE-2021-40057 
There is a heap-based and stack-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Heap-based and stack-based buffer overflow vulnerabilities
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:50:03.000Z
CVE-2021-40058 
There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Heap-based buffer overflow vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:49:59.000Z
CVE-2021-40059 
There is a permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Permission control vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:49:53.000Z
CVE-2021-40060 
There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Heap-based buffer overflow vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:49:47.000Z
CVE-2021-40061 
There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module. Successful exploitation of this vulnerability may affect integrity.
Problem types: description: Type confusion vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
vendor: Huawei
product: HarmonyOS
Published: 2022-03-07T13:49:40.000Z
CVE-2021-40062 
There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Buffer Copy without Checking Size of Input
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-03-07T13:49:31.000Z
CVE-2021-40063 
There is an improper access control vulnerability in the video module. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Improper access control vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
vendor: Huawei
product: HarmonyOS
Published: 2022-03-07T13:49:26.000Z
CVE-2021-40064 
There is a heap-based buffer overflow vulnerability in system components. Successful exploitation of this vulnerability may affect system stability.
Problem types: description: Heap-based buffer overflow vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
vendor: Huawei
product: HarmonyOS
Published: 2022-03-07T13:49:22.000Z
CVE-2021-40065 
The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Service logic error vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-04-11T19:38:24.000Z
CVE-2021-40066 
The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credentials can read data from it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v11.76 and Mobility v12.14.
Problem types: description: Incorrect access control in Mobility read-only API
Affected products: vendor: n/a
product: NetMotion Mobility
Published: 2021-09-16T11:18:27.000Z
CVE-2021-40067 
The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled, attackers with both network access to the API and valid credentials can read and write data to it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v12.14.
Problem types: description: Incorrect access control in Mobility read-write API
Affected products: vendor: n/a
product: NetMotion Mobility
Published: 2021-09-16T11:25:21.000Z
CVE-2021-40083 
Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iterations used for a positive wildcard proof).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T00:21:43.000Z
CVE-2021-40084 
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T00:21:25.000Z
CVE-2021-40085 
An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:32:24.000Z
CVE-2021-40086 
An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page (that can only be viewed by an administrator). While hidden from direct view, checking the page source would reveal the secret.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T01:25:18.000Z
CVE-2021-40087 
An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T01:24:59.000Z
CVE-2021-40088 
An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T01:24:49.000Z
CVE-2021-40089 
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T01:24:31.000Z
CVE-2021-40091 
An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-06T20:08:24.000Z
CVE-2021-40092 
A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T12:42:44.000Z
CVE-2021-40093 
A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via dashboard actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T12:48:40.000Z
CVE-2021-40094 
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T12:51:54.000Z
CVE-2021-40095 
An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability (when processing remote input in the log files downloaded by an authenticated administrator user), leading to the ability to read arbitrary files on the server filesystems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T12:54:16.000Z
CVE-2021-40096 
A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T12:58:33.000Z
CVE-2021-40097 
An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code, related to the bFilename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T11:06:08.000Z
CVE-2021-40098 
An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T11:08:16.000Z
CVE-2021-40099 
An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T14:58:32.000Z
CVE-2021-40100 
An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T14:57:20.000Z
CVE-2021-40101 
An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T19:38:32.000Z
CVE-2021-40102 
An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated with the __wakeup magic method).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T14:55:42.000Z
CVE-2021-40103 
An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T11:10:19.000Z
CVE-2021-40104 
An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T11:56:40.000Z
CVE-2021-40105 
An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T11:58:14.000Z
CVE-2021-40106 
An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T11:59:46.000Z
CVE-2021-40108 
An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T12:01:34.000Z
CVE-2021-40109 
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T12:04:54.000Z
CVE-2021-40110 Apache James IMAP vulnerable to a ReDoS
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
Problem types: description: Regular expression Denial of service
Affected products: vendor: Apache Software Foundation
product: Apache James
Credits: lang: en
value: Apache James PMC would like to thanks Benoit TELLIER for this report.
Published: 2022-01-04T08:55:22.000Z
CVE-2021-40111 Apache James IMAP parsing Denial Of Service
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
Problem types: description: Denial Of Service
Affected products: vendor: Apache Software Foundation
product: Apache James
Credits: lang: en
value: The Apache James PMC would like to thanks Benoit TELLIER for the report.
Published: 2022-01-04T08:55:24.000Z
CVE-2021-40112 Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Catalyst PON Series
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-11-04T15:35:33.328Z
CVE-2021-40113 Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Catalyst PON Series
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-11-04T15:35:39.174Z
CVE-2021-40114 Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
Published: 2021-10-27T18:56:37.380Z
CVE-2021-40115 Cisco Webex Video Mesh Cross-Site Scripting Vulnerability
A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Webex Video Mesh
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-11-04T15:35:45.040Z
CVE-2021-40116 Multiple Cisco Products Snort Rule Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.The vulnerability is due to improper handling of the Block with Reset or Interactive Block with Reset actions if a rule is configured without proper constraints. An attacker could exploit this vulnerability by sending a crafted IP packet to the affected device. A successful exploit could allow the attacker to cause through traffic to be dropped. Note: Only products with Snort3 configured and either a rule with Block with Reset or Interactive Block with Reset actions configured are vulnerable. Products configured with Snort2 are not vulnerable.
Problem types: cwe_id: CWE-241
description: CWE-241
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2021-10-27T18:56:42.934Z
CVE-2021-40117 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability
A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incoming SSL/TLS packets are not properly processed. An attacker could exploit this vulnerability by sending a crafted SSL/TLS packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2021-10-27T18:56:48.507Z