rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3063 PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Palo Alto Networks
product: PAN-OS
vendor: Palo Alto Networks
product: Prisma Access
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This issue was found by Nicholas Newsom of Palo Alto Networks during internal security review.
Published: 2021-11-10T17:10:29.461Z
CVE-2021-3064 PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces
A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Prisma Access customers are not impacted by this issue.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Palo Alto Networks
product: PAN-OS
vendor: Palo Alto Networks
product: Prisma Access
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks the Randori Attack Team (https://twitter.com/RandoriAttack) for discovering and reporting this issue.
Published: 2021-11-10T17:10:31.046Z
CVE-2021-3100 Log4j hot patch package privilege escalation
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Amazon Web Services
product: log4j-cve-2021-44228-hotpatch
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yuval Avrahami, Palo Alto Networks
Published: 2022-04-19T22:15:19.689Z
CVE-2021-3101 Hotdog Container Escape
Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Amazon Web Services
product: Hotdog
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yuval Avrahami, Palo Alto Networks
Published: 2022-04-19T22:15:21.519Z
CVE-2021-3109 
The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T15:14:15.000Z
CVE-2021-3110 
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T12:11:34.000Z
CVE-2021-3111 
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-08T14:18:31.000Z
CVE-2021-3113 
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and can then use that cookie immediately for admin access,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-17T02:33:24.000Z
CVE-2021-3114 
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T02:23:18.000Z
CVE-2021-3115 
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T02:14:51.000Z
CVE-2021-3116 
before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T05:00:49.000Z
CVE-2021-3118 
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (such as /req_password_user.php?email=). This allows an attacker to steal data in the database and obtain access to the application. (The database component runs as root.) NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T05:23:55.000Z
CVE-2021-3119 
Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-25T22:40:30.000Z
CVE-2021-3120 
An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-02-22T14:24:34.000Z
CVE-2021-3121 
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T05:57:18.000Z
CVE-2021-3122 
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-07T19:45:03.000Z
CVE-2021-3124 
Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars[0][name] field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-25T14:53:23.000Z
CVE-2021-3125 
In TP-Link TL-XDR3230 < 1.0.12, TL-XDR1850 < 1.0.9, TL-XDR1860 < 1.0.14, TL-XDR3250 < 1.0.2, TL-XDR6060 Turbo < 1.1.8, TL-XDR5430 < 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T17:41:04.000Z
CVE-2021-3127 
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-16T19:55:10.000Z
CVE-2021-3128 
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T17:41:07.000Z
CVE-2021-3129 
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T14:07:38.000Z
CVE-2021-3130 
Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T15:45:14.000Z
CVE-2021-3131 
The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T15:46:02.000Z
CVE-2021-3133 
The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T18:57:19.000Z
CVE-2021-3134 
Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T19:05:47.000Z
CVE-2021-3135 
An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-19T20:01:13.000Z
CVE-2021-3137 
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T03:17:14.000Z
CVE-2021-3138 
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-14T03:30:11.000Z
CVE-2021-3139 
In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T15:33:45.000Z
CVE-2021-3141 
In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain access to the Management Server and change the Stealth configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T04:03:39.000Z
CVE-2021-3144 
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T00:00:00.000Z
CVE-2021-3145 
In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-10T18:12:57.000Z
CVE-2021-3146 
The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T19:46:48.000Z
CVE-2021-3148 
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T00:00:00.000Z
CVE-2021-3149 
On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the system C library function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T01:48:18.000Z
CVE-2021-3150 
A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-15T18:48:55.000Z
CVE-2021-3151 
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__MONITORING__CONFIG__ADDRESS, or SM2__C__MONITORING__CONFIG__ADDRESS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T04:15:03.000Z
CVE-2021-3152 
Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-21T15:10:51.000Z
CVE-2021-3153 
HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T02:51:57.000Z
CVE-2021-3154 
An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-04T13:02:56.000Z
CVE-2021-3155 snapd created ~/snap with too-wide permissions
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Canonical Ltd.
product: snapd
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: James Troup
Published: 2022-02-17T22:15:16.000Z
CVE-2021-3156 
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T00:00:00.000Z
CVE-2021-3159 
A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG, SHTML, or MHT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T14:48:05.000Z
CVE-2021-3160 
Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unsecure serialized Java object using a specially crafted HTTP request, resulting in an unauthenticated remote code execution on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T19:37:46.000Z
CVE-2021-3162 
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-15T21:54:59.000Z
CVE-2021-3163 
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T20:35:07.000Z
CVE-2021-3164 
ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-21T05:45:20.000Z
CVE-2021-3165 
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T22:39:14.000Z
CVE-2021-3166 
An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary file content as a firmware update when the filename Settings_DSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update, resulting in a persistent outage of those services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-18T04:55:03.000Z
CVE-2021-3167 
In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-15T15:06:46.000Z
CVE-2021-3169 
An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T00:00:00.000Z
CVE-2021-3172 
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-3176 
The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view user information and application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T06:29:19.000Z
CVE-2021-3177 
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-19T00:00:00.000Z
CVE-2021-3178 
fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-19T06:44:51.000Z
CVE-2021-3179 
GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:13:08.000Z