rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3494 
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.
Problem types: cwe_id: CWE-319
description: CWE-319
Affected products: vendor: n/a
product: foreman
Published: 2021-04-26T14:13:18.000Z
CVE-2021-3495 
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-281
description: CWE-281
Affected products: vendor: n/a
product: kiali/kiali-operator
Published: 2021-06-01T13:31:32.000Z
CVE-2021-3496 
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: jhead
Published: 2021-04-22T00:00:00.000Z
CVE-2021-3497 
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: gstreamer-plugins-good
Published: 2021-04-19T20:22:15.000Z
CVE-2021-3498 
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: gstreamer-plugins-good
Published: 2021-04-19T20:22:24.000Z
CVE-2021-3499 
A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there is multiple DNS rules. It could lead to potentially lose of confidentiality, integrity or availability of a service.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: openshift/ovn-kubernetes
Published: 2021-06-02T15:48:10.000Z
CVE-2021-3500 
A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via crafted djvu file may lead to application crash and other consequences.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: djvulibre
Published: 2021-06-24T18:02:00.000Z
CVE-2021-3501 
A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: kernel
Published: 2021-05-05T22:31:28.000Z
CVE-2021-3502 
A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.
Problem types: cwe_id: CWE-617
description: CWE-617->CWE-476
Affected products: vendor: n/a
product: avahi
Published: 2021-05-07T11:46:21.000Z
CVE-2021-3503 
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: wildfly
Published: 2022-04-18T16:20:37.000Z
CVE-2021-3504 
A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: hivex
Published: 2021-05-11T22:30:25.000Z
CVE-2021-3505 
A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.
Problem types: cwe_id: CWE-331
description: CWE-331
Affected products: vendor: n/a
product: libtpms
Published: 2021-04-19T20:22:05.000Z
CVE-2021-3506 
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: kernel
Published: 2021-04-19T21:11:52.000Z
CVE-2021-3507 
A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: QEMU
Published: 2021-05-06T15:16:14.000Z
CVE-2021-3508 
A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: n/a
product: PDFResurrect
Published: 2021-04-28T13:44:09.000Z
CVE-2021-3509 
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: ceph-dashboard
Published: 2021-05-26T23:56:39.000Z
CVE-2021-3510 Zephyr JSON decoder incorrectly decodes array of array
Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4
Problem types: cwe_id: CWE-588
description: Attempt to Access Child of a Non-structure Pointer (CWE-588)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-10-05T20:50:17.320Z
CVE-2021-3511 
Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to obtain information such as configuration via unspecified vectors.
Problem types: description: Information Disclosure
Affected products: vendor: BUFFALO INC.
product: Buffalo broadband routers
Published: 2021-04-28T00:45:26.000Z
CVE-2021-3512 
Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to bypass access restriction and to start telnet service and execute arbitrary OS commands with root privileges via unspecified vectors.
Problem types: description: Improper Access Control
Affected products: vendor: BUFFALO INC.
product: Buffalo broadband routers
Published: 2021-04-28T00:45:27.000Z
CVE-2021-3513 
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-522
description: CWE-522 - Insufficiently Protected Credentials
Affected products: vendor: n/a
product: keycloak
Published: 2022-08-22T14:45:08.000Z
CVE-2021-3514 
When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: 389-ds-base
Published: 2021-05-28T00:00:00.000Z
CVE-2021-3515 
A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: n/a
product: pglogical
Published: 2021-06-01T13:31:40.000Z
CVE-2021-3516 
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: libxml2
Published: 2021-06-01T13:38:13.000Z
CVE-2021-3517 
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: libxml2
Published: 2021-05-19T13:45:00.000Z
CVE-2021-3518 
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: libxml2
Published: 2021-05-18T11:20:24.000Z
CVE-2021-3519 
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Lenovo
product: Desktop BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Pawel Urbanek for reporting this issue.
Published: 2021-11-12T22:05:29.000Z
CVE-2021-3520 
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Problem types: cwe_id: CWE-190
description: CWE-190->CWE-787
Affected products: vendor: n/a
product: lz4
Published: 2021-06-02T12:32:32.000Z
CVE-2021-3521 
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.
Problem types: cwe_id: CWE-347
description: CWE-347 - Improper Verification of Cryptographic Signature
Affected products: vendor: n/a
product: RPM
Published: 2022-08-22T00:00:00.000Z
CVE-2021-3522 
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: GStreamer
Published: 2021-06-02T14:38:16.000Z
CVE-2021-3523 
A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address.
Problem types: cwe_id: CWE-281
description: CWE-281
Affected products: vendor: n/a
product: apicast
Published: 2022-04-27T20:58:08.000Z
CVE-2021-3524 
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: ceph
Published: 2021-05-17T00:00:00.000Z
CVE-2021-3527 
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: n/a
product: QEMU
Published: 2021-05-26T21:13:56.000Z
CVE-2021-3528 
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.
Problem types: cwe_id: CWE-522
description: CWE-522->CWE-532
Affected products: vendor: n/a
product: NooBaa
Published: 2021-05-13T14:30:07.000Z
CVE-2021-3529 
A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: noobaa-core
Published: 2021-06-02T16:10:51.000Z
CVE-2021-3530 
A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.
Problem types: cwe_id: CWE-674
description: CWE-674
Affected products: vendor: n/a
product: binutils
Published: 2021-06-02T14:31:23.000Z
CVE-2021-3531 
A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: ceph
Published: 2021-05-18T00:00:00.000Z
CVE-2021-3535 
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. This issue affects version 6.6.80 and prior, and is fixed in 6.6.81. If your Security Console currently falls on or within this affected version range, ensure that you update your Security Console to the latest version.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Rapid7
product: Rapid7 Nexpose
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This issue was discovered and reported by Philipp Behmer.
Published: 2021-06-16T01:40:12.586Z
CVE-2021-3536 
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: wildfly
Published: 2021-05-20T12:15:09.000Z
CVE-2021-3537 
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: libxml2
Published: 2021-05-14T19:50:10.000Z
CVE-2021-3538 
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker.
Problem types: cwe_id: CWE-338
description: CWE-338
Affected products: vendor: n/a
product: satori/go.uuid
Published: 2021-06-02T13:22:21.000Z
CVE-2021-3539 EspoCRM Avatar Persistent XSS
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: EspoCRM
product: EspoCRM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Wiktor Sędkowski of Nokia and Trevor Christiansen of Rapid7 discovered and reported this issue through Rapid7's vulnerability disclosure program.
Published: 2021-08-04T22:20:47.939Z
CVE-2021-3540 Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection
By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
Problem types: cwe_id: CWE-88
description: CWE-88 Argument Injection or Modification
Affected products: vendor: Ivanti
product: MobileIron Core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: William Vu of Rapid7
Published: 2021-07-22T18:27:21.040Z
CVE-2021-3541 
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: libxml2
Published: 2021-07-09T16:02:21.000Z
CVE-2021-3543 
A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.
Problem types: cwe_id: CWE-416
description: (CWE-416|CWE-476)
Affected products: vendor: n/a
product: kernel
Published: 2021-06-01T13:20:34.000Z