rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-44004 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:42.000Z
CVE-2021-44005 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:43.000Z
CVE-2021-44006 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:43.000Z
CVE-2021-44007 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This could allow an attacker to cause a denial-of-service condition.
Problem types: cwe_id: CWE-193
description: CWE-193: Off-by-one Error
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:44.000Z
CVE-2021-44008 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:45.000Z
CVE-2021-44009 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:46.000Z
CVE-2021-44010 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:46.000Z
CVE-2021-44011 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer while parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15101)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:47.000Z
CVE-2021-44012 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15102)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:48.000Z
CVE-2021-44013 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15103)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:49.000Z
CVE-2021-44014 
A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057, ZDI-CAN-19081)
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Siemens
product: JT Open
default_status: unknown
vendor: Siemens
product: JT Utilities
default_status: unknown
vendor: Siemens
product: Solid Edge
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2021-12-14T12:06:50.000Z
CVE-2021-44015 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The VCRUNTIME140.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted CGM files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15109)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:50.000Z
CVE-2021-44016 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15110)
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Solid Edge SE2021
vendor: Siemens
product: Solid Edge SE2022
vendor: Siemens
product: Teamcenter Visualization V13.1
vendor: Siemens
product: Teamcenter Visualization V13.2
vendor: Siemens
product: Teamcenter Visualization V13.3
Published: 2022-02-09T15:17:09.000Z
CVE-2021-44017 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:51.000Z
CVE-2021-44018 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15112)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Solid Edge SE2021
vendor: Siemens
product: Solid Edge SE2022
vendor: Siemens
product: Teamcenter Visualization V13.1
vendor: Siemens
product: Teamcenter Visualization V13.2
vendor: Siemens
product: Teamcenter Visualization V13.3
Published: 2022-02-09T15:17:10.000Z
CVE-2021-44019 
An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44020 and 44021.
Problem types: description: Improper Privilege Management
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-12-03T10:50:10.000Z
CVE-2021-44020 
An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44019 and 44021.
Problem types: description: Improper Privilege Management
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-12-03T10:50:11.000Z
CVE-2021-44021 
An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44019 and 44020.
Problem types: description: Improper Privilege Management
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-12-03T10:50:11.000Z
CVE-2021-44022 
A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Reachable Assertion Denial-of-Service
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2021-12-03T10:50:12.000Z
CVE-2021-44023 
A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.
Problem types: description: Link Following Denial-of-Service
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2021-12-16T02:28:35.000Z
CVE-2021-44024 
A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Link Following Denial-of-Service
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-01-08T15:51:04.000Z
CVE-2021-44025 
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T03:47:48.000Z
CVE-2021-44026 
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T03:47:27.000Z
CVE-2021-44028 
XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T05:03:39.000Z
CVE-2021-44029 
An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T05:08:42.000Z
CVE-2021-44030 
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T05:07:42.000Z
CVE-2021-44031 
An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T05:08:18.000Z
CVE-2021-44032 
TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T04:06:52.000Z
CVE-2021-44033 
In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T04:37:57.000Z
CVE-2021-44035 
Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
version: 3.1
Published: 2021-12-17T15:17:50.000Z
CVE-2021-44036 
Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:50:34.000Z
CVE-2021-44037 
Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:57:22.000Z
CVE-2021-44038 
An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T18:29:55.000Z
CVE-2021-44040 HTTP request line fuzzing attacks
Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu for reporting these issues.  We used his tool t-reqs (https://github.com/bahruzjabiyev/t-reqs-http-fuzzer) for discovering them.
Published: 2022-03-23T14:05:15.000Z
CVE-2021-44041 
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T17:49:48.000Z
CVE-2021-44042 
An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T17:49:45.000Z
CVE-2021-44043 
An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T17:50:33.000Z
CVE-2021-44044 
An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing JPG files. Crafted data in a JPG (4 extraneous bytes before the marker 0xca) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-05T20:29:48.000Z
CVE-2021-44045 
An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation for the XFAT sectors count can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-05T20:30:10.000Z
CVE-2021-44046 
An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function (verifying input data from a U3D file) leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-05T20:30:39.000Z
CVE-2021-44047 
A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-05T20:30:59.000Z
CVE-2021-44048 
An out-of-bounds write vulnerability exists when reading a TIF file using Open Design Alliance (ODA) Drawings Explorer before 2022.11. The specific issue exists after loading TIF files. Crafted data in a TIF file can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-05T20:31:56.000Z
CVE-2021-44049 
CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T14:28:51.000Z
CVE-2021-44050 
CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data.
Problem types: description: SQL injection
Affected products: vendor: n/a
product: CA Network Flow Analysis (NFA)
Published: 2021-12-02T18:18:41.000Z
CVE-2021-44051 Command injection
A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: QNAP Systems Inc.
product: QuTScloud
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QTS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Enio Pena Navarro and Michael Messner from Siemens Energy AG
Published: 2022-05-05T16:50:20.575Z