rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-46813 
Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:06:56.000Z
CVE-2021-46814 
The video framework has an out-of-bounds memory read/write vulnerability. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Out-of-bounds memory read/write vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:54:56.000Z
CVE-2021-46816 Adobe Premiere Pro M4A file memory corruption vulnerability could lead to remote code execution
Adobe Premiere Pro version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Premiere
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-13T12:19:12.164Z
CVE-2021-46817 Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code execution
Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Media Encoder
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-13T12:15:19.567Z
CVE-2021-46818 Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code execution
Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Media Encoder
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-13T12:09:16.834Z
CVE-2021-46820 
Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T20:36:26.000Z
CVE-2021-46822 
The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-18T15:27:44.000Z
CVE-2021-46823 
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-18T15:27:17.000Z
CVE-2021-46824 
Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Lastname parameter to the Update Account form in student_profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-23T14:36:57.000Z
CVE-2021-46825 
Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web server responses to unintended clients. Severity/CVSSv3: High / 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Advance Secure Gateway and ProxySG
Published: 2022-07-07T15:48:36.000Z
CVE-2021-46827 
An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T04:55:13.000Z
CVE-2021-46828 
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T00:00:00.000Z
CVE-2021-46829 
GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-24T18:47:35.000Z
CVE-2021-46830 
A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could potentially allow an external user who self-registers with a specific username and/or profile information to gain access to files at a higher directory level than intended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T22:03:37.000Z
CVE-2021-46834 
A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected product versions include:JAD-AL50 versions 102.0.0.225(C00E220R3P4).
Problem types: description: Permission Bypass
Affected products: vendor: n/a
product: JAD-AL50
Published: 2022-09-20T19:45:15.000Z
CVE-2021-46835 
There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
Problem types: description: Traffic Hijacking
Affected products: vendor: n/a
product: WS7200-10
Published: 2022-09-20T19:49:49.000Z
CVE-2021-46836 
Implementation of the WLAN module interfaces has the information disclosure vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Information leakage vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:55:42.000Z
CVE-2021-46837 
res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T00:00:00.000Z
CVE-2021-46839 
The HW_KEYMASTER module has a vulnerability of missing bounds check on length.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
Problem types: description: Lack of length check vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2021-46840 
The HW_KEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
Problem types: description: Out-of-bounds access vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2021-46841 
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privileged network position can track a user's activity.
Problem types: description: An attacker in a privileged network position can track a user's activity
Affected products: vendor: Apple
product: Apple Music for Android
Published: 2023-02-27T00:00:00.000Z
CVE-2021-46846 
Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.


Problem types: description: n/a
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Integrated Lights-Out 5
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-11-03T16:06:09.815Z
CVE-2021-46848 
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2021-46850 
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2021-46851 
The DRM module has a vulnerability in verifying the secure memory attributes. Successful exploitation of this vulnerability may cause abnormal video playback.
Problem types: description: Unstrict verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-11-09T00:00:00.000Z
CVE-2021-46852 
The memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Logic bypass vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-11-09T00:00:00.000Z
CVE-2021-46853 
Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-03T00:00:00.000Z
CVE-2021-46854 
mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-23T00:00:00.000Z
CVE-2021-46856 
The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.


Problem types: description: Path traversal vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2022-12-20T00:00:00.000Z
CVE-2021-46867 
The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access.
Problem types: description: Out-of-bounds memory access vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2021-46868 
The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access.
Problem types: description: Out-of-bounds memory access vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2021-46871 
tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-10T00:00:00.000Z
CVE-2021-46872 
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-13T00:00:00.000Z
CVE-2021-46873 
WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-29T00:00:00.000Z
CVE-2021-46875 
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-12T00:00:00.000Z
CVE-2021-46876 
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-12T00:00:00.000Z
CVE-2021-46877 
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-18T00:00:00.000Z
CVE-2021-46878 
An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file and trick the victim opening it using the affect software, triggering use-after-free and execute arbitrary code on the target system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2021-46879 
An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute arbitrary code on the target system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2021-46880 
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2021-46881 
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Memory Overwriting Vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46882 
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Memory Overwriting Vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46883 
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Memory Overwriting Vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46884 
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Memory Overwriting Vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46885 
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Memory Overwriting Vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46886 
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Memory Overwriting Vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46887 
Lack of length check vulnerability in the HW_KEYMASTER module. Successful exploitation of this vulnerability may cause out-of-bounds read.
Problem types: description: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Huawei
product: EMUI
Published: 2023-05-26T00:00:00.000Z
CVE-2021-46888 
An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-21T00:00:00.000Z
CVE-2021-46889 
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-07T00:00:00.000Z
CVE-2021-46890 
Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
Problem types: description: Business Logic Errors
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-07-05T11:52:24.005Z
CVE-2021-46891 
Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-07-05T12:15:51.878Z
CVE-2021-46892 
Encryption bypass vulnerability in Maintenance mode. Successful exploitation of this vulnerability may affect service confidentiality.
Problem types: cwe_id: CWE-701
description: CWE-701 Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-07-06T12:41:21.742Z
CVE-2021-46893 
Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity.
Problem types: description: unstrict data verification and parameter check
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-07-05T12:17:19.514Z
CVE-2021-46894 
Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalation.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-07-06T12:23:59.118Z
CVE-2021-46895 
Vulnerability of defects introduced in the design process in the Multi-Device Task Center. Successful exploitation of this vulnerability will cause the hopped app to bypass the app lock and reset the device that initiates the hop.
Problem types: cwe_id: CWE-701
description: CWE-701 Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-08-13T12:45:33.542Z
CVE-2021-46896 
Buffer Overflow vulnerability in PX4-Autopilot allows attackers to cause a denial of service via handler function handling msgid 332.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2021-46897 
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-22T00:00:00.000Z
CVE-2021-46898 
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-22T00:00:00.000Z
CVE-2021-46899 
SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-09T00:00:00.000Z
CVE-2021-46900 
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-31T00:00:00.000Z