rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3589 
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-306
description: CWE-306 - Missing Authentication for Critical Function
Affected products: vendor: n/a
product: Foreman Ansible
Published: 2022-03-23T19:46:10.000Z
CVE-2021-3590 
A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: foreman
Published: 2022-08-22T14:48:17.000Z
CVE-2021-3592 
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
Problem types: cwe_id: CWE-824
description: CWE-824
Affected products: vendor: n/a
product: QEMU
Published: 2021-06-15T00:00:00.000Z
CVE-2021-3593 
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
Problem types: cwe_id: CWE-824
description: CWE-824
Affected products: vendor: n/a
product: QEMU
Published: 2021-06-15T00:00:00.000Z
CVE-2021-3594 
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
Problem types: cwe_id: CWE-824
description: CWE-824
Affected products: vendor: n/a
product: QEMU
Published: 2021-06-15T00:00:00.000Z
CVE-2021-3595 
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
Problem types: cwe_id: CWE-824
description: CWE-824
Affected products: vendor: n/a
product: QEMU
Published: 2021-06-15T00:00:00.000Z
CVE-2021-3596 
A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: ImageMagick
Published: 2022-02-24T00:00:00.000Z
CVE-2021-3597 
A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: n/a
product: undertow
Published: 2022-05-24T18:19:11.000Z
CVE-2021-3598 
There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
Problem types: cwe_id: CWE-119
description: CWE-119->CWE-125
Affected products: vendor: n/a
product: OpenEXR
Published: 2021-07-06T00:00:00.000Z
CVE-2021-3599 
A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: ThinkPad BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Itai Liba and Assaf Carlsbad from SentinelOne for reporting these issues.
Published: 2021-11-12T22:05:33.000Z
CVE-2021-3600 
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.
Affected products: vendor: The Linux Kernel Organization
product: linux
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-01-08T18:16:42.087Z
CVE-2021-3602 
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: buildah
Published: 2022-03-03T18:26:21.000Z
CVE-2021-3603 Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: PHPMailer
product: PHPMailer
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-06-17T12:09:42.000Z
CVE-2021-3604 Primion-Digitek Secure 8 SQL injection vulnerability
Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.
Problem types: description: CWE 89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Primion Digitek
product: Secure 8 (Evalos)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ander Martínez of Titanium Industrial Security.
Published: 2021-06-18T14:14:47.260Z
CVE-2021-3605 
There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
Problem types: cwe_id: CWE-119
description: CWE-119->CWE-125
Affected products: vendor: n/a
product: OpenEXR
Published: 2021-08-25T00:00:00.000Z
CVE-2021-3606 
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: n/a
product: OpenVPN-GUI
Published: 2021-07-02T12:30:38.000Z
CVE-2021-3607 
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-190
description: CWE-190->CWE-770->(CWE-125|CWE-476)
Affected products: vendor: n/a
product: QEMU
Published: 2022-02-24T18:50:19.000Z
CVE-2021-3608 
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-824
description: CWE-824
Affected products: vendor: n/a
product: QEMU
Published: 2022-02-24T18:50:20.000Z
CVE-2021-3609 
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
Problem types: cwe_id: CWE-362
description: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: n/a
product: kernel
Published: 2022-03-03T18:24:59.000Z
CVE-2021-3610 
A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: ImageMagick
Published: 2022-02-24T00:00:00.000Z
CVE-2021-3611 
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: QEMU
Published: 2022-05-11T15:23:00.000Z
CVE-2021-3612 
An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-20
description: CWE-20->CWE-119
Affected products: vendor: n/a
product: kernel
Published: 2021-07-09T10:33:16.000Z
CVE-2021-3613 
OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe).
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: n/a
product: OpenVPN Connect
Published: 2021-07-02T12:33:36.000Z
CVE-2021-3614 
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
Problem types: cwe_id: CWE-636
description: CWE-636 Not Failing Securely ('Failing Open')
Affected products: vendor: Lenovo
product: Notebook BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Tim Boyd, NCC Group for reporting this issue.
Published: 2021-07-16T20:30:20.000Z
CVE-2021-3615 
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Lenovo
product: Smart Camera X3, X5, and C2E firmware
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues.
Published: 2021-08-17T16:25:25.000Z
CVE-2021-3616 
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Lenovo
product: Smart Camera X3, X5, and C2E firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues.
Published: 2021-08-17T16:25:27.000Z
CVE-2021-3617 
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Lenovo
product: Smart Camera X3, X5, and C2E firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues.
Published: 2021-08-17T16:25:29.000Z
CVE-2021-3618 
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: n/a
product: ALPACA
Published: 2022-03-23T00:00:00.000Z
CVE-2021-3619 Rapid7 Velociraptor Notebooks Authenticated Persistent XSS
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Rapid7
product: Velociraptor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Mike Cohen of Rapid7 discovered and fixed this vulnerability as part of routine software maintenance.
Published: 2021-08-17T19:07:39.160Z
CVE-2021-3620 
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-209
description: CWE-209 - Generation of Error Message Containing Sensitive Information
Affected products: vendor: n/a
product: ansible
Published: 2022-03-03T18:23:38.000Z
CVE-2021-3621 
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: n/a
product: sssd
Published: 2021-12-23T00:00:00.000Z
CVE-2021-3622 
A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: hivex
Published: 2021-12-23T20:31:25.000Z
CVE-2021-3623 
A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: libtpms
Published: 2022-03-02T22:02:36.000Z
CVE-2021-3624 
There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system.
Problem types: cwe_id: CWE-20
description: CWE-20->CWE-190->CWE-787
Affected products: vendor: n/a
product: dcraw
Published: 2022-04-18T16:20:35.000Z
CVE-2021-3625 Buffer overflow in Zephyr USB DFU DNLOAD
Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2021-10-05T20:50:20.352Z
CVE-2021-3626 Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts
The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Canonical
product: Multipass
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Micah Lee
Published: 2021-10-01T02:35:19.696Z
CVE-2021-3628 OpenKM Document Management Community vulnerable to Cross Site Scripting
OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OpenKM
product: Document Management Community
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Jorge Gutiérrez Valderrama
Published: 2021-08-30T17:06:59.834Z
CVE-2021-3629 
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: undertow
Published: 2022-05-24T18:19:00.000Z
CVE-2021-3630 
An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may lead to crash and segmentation fault. This flaw affects DjVuLibre versions prior to 3.5.28.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: djvulibre
Published: 2021-06-30T13:27:28.000Z