rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-38535 
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.76, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RAX35 before 1.0.3.62, and RAX40 before 1.0.3.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:H/S:C/UI:R
version: 3.1
Published: 2021-08-10T23:59:23.000Z
CVE-2021-38536 
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RAX35 before 1.0.3.62, and RAX40 before 1.0.3.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:H/S:C/UI:R
version: 3.1
Published: 2021-08-10T23:59:11.000Z
CVE-2021-38537 
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, and RAX40 before 1.0.3.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:L/A:N/C:L/I:L/PR:H/S:C/UI:R
version: 3.1
Published: 2021-08-10T23:59:03.000Z
CVE-2021-38538 
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0.4.26, R9000 before 1.0.4.26, RAX120 before 1.0.0.78, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK40 before 2.3.5.30, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and XR500 before 2.3.2.56.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:R
version: 3.1
Published: 2021-08-10T23:58:41.000Z
CVE-2021-38539 
Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.2.126, R7000 before 1.0.9.42, R7000P before 1.3.2.126, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.10, R8300 before 1.0.2.130, and R8500 before 1.0.2.130.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:L/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2021-08-10T23:58:28.000Z
CVE-2021-38540 Apache Airflow: Variable Import endpoint missed authentication check
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
Credits: lang: en
value: Apache Airflow would like to thank Nathan Jones, National Australia Bank’s Offensive Security Team
Published: 2021-09-09T15:05:09.000Z
CVE-2021-38542 Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Apache Software Foundation
product: Apache James
Credits: lang: en
value: We thanks Benoit Tellier, Raphael Ouazana for reporting this vulnerability as well as Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian Schinzel Münster University of Applied Science for their research and tools regarding STARTTLS security.
Published: 2022-01-04T08:55:21.000Z
CVE-2021-38543 
TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:26:02.000Z
CVE-2021-38544 
Sony SRS-XB33 and SRS-XB43 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:25:43.000Z
CVE-2021-38545 
Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the Raspberry Pi supplies power to some speakers. The power indicator LED of the Raspberry Pi is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects the Raspberry Pi's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the Raspberry Pi, we can recover the sound played by the speakers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:25:33.000Z
CVE-2021-38546 
CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:25:14.000Z
CVE-2021-38547 
Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:24:59.000Z
CVE-2021-38548 
JBL Go 2 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:24:48.000Z
CVE-2021-38549 
MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T15:24:29.000Z
CVE-2021-38553 
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:48:47.000Z
CVE-2021-38554 
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:45:50.000Z
CVE-2021-38555 An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java
An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
Problem types: description: XML external entity (XXE) injection vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Any23
Credits: lang: en
value: The Apache Any23 Project Management Committee would like to thank Zhuxuan Wu for reporting the security vulnerability.
Published: 2021-09-11T11:05:11.000Z
CVE-2021-38556 
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-24T12:33:07.000Z
CVE-2021-38557 
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-24T12:33:01.000Z
CVE-2021-38559 
DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-26T12:47:12.000Z
CVE-2021-38560 
Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T15:25:34.000Z
CVE-2021-38561 
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2021-38562 
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T08:52:58.000Z
CVE-2021-38563 
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number, and thus there is an attempted incorrect array access (leading to a NULL pointer dereference, or out-of-bounds read or write).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:16:06.000Z
CVE-2021-38564 
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:15:40.000Z
CVE-2021-38565 
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:15:26.000Z
CVE-2021-38566 
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:15:16.000Z
CVE-2021-38567 
An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries, leading to a NULL pointer dereference, aka CNVD-C-2021-95204.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:15:05.000Z
CVE-2021-38568 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:14:51.000Z
CVE-2021-38569 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:14:39.000Z
CVE-2021-38570 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:14:25.000Z
CVE-2021-38571 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:14:13.000Z
CVE-2021-38572 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:13:19.000Z
CVE-2021-38573 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:12:54.000Z
CVE-2021-38574 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T21:12:14.000Z
CVE-2021-38575 
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
Problem types: cwe_id: CWE-124
description: A case of CWE-124, CWE-680, and CWE-252 is occurring in NetworkPkg/IScsiDxe.
Affected products: vendor: TianoCore
product: EDK II
Published: 2021-12-01T00:00:00.000Z
CVE-2021-38576 
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
Problem types: description: Security Feature Bypass
Affected products: vendor: n/a
product: EDK II
Published: 2022-01-03T21:07:45.000Z
CVE-2021-38578 
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
Problem types: cwe_id: CWE-124
description: A case of CWE-124 is occurring in PiSmmCore.
Affected products: vendor: TianoCore
product: EDK II
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Published: 2022-03-03T21:53:37.000Z
CVE-2021-38583 
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T13:36:53.000Z
CVE-2021-38584 
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:56:10.000Z
CVE-2021-38585 
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:55:59.000Z
CVE-2021-38586 
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:55:47.000Z
CVE-2021-38587 
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:55:37.000Z
CVE-2021-38588 
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:55:25.000Z
CVE-2021-38589 
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:55:12.000Z
CVE-2021-38590 
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T22:54:59.000Z
CVE-2021-38591 
An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt6883. Attackers can change some of the NvRAM content by leveraging the misconfiguration of a debug command. The LG ID is LVE-SMP-210005 (August 2021).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T23:12:24.000Z
CVE-2021-38592 
Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T01:19:57.000Z
CVE-2021-38593 
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T00:00:00.000Z
CVE-2021-38597 
wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T14:26:50.000Z
CVE-2021-38598 
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-23T04:17:16.000Z