rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-4203 
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.
Problem types: cwe_id: CWE-362
description: CWE-362->CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T00:00:00.000Z
CVE-2021-4204 
An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.
Problem types: cwe_id: CWE-20
description: CWE-20 - Improper Input Validation
Affected products: vendor: n/a
product: kernel
Published: 2022-08-24T00:00:00.000Z
CVE-2021-4206 
A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
Problem types: cwe_id: CWE-190
description: CWE-190->CWE-131->CWE-120
Affected products: vendor: n/a
product: QEMU
Published: 2022-04-29T16:19:09.000Z
CVE-2021-4207 
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
Problem types: cwe_id: CWE-362
description: CWE-362->CWE-120
Affected products: vendor: n/a
product: QEMU
Published: 2022-04-29T16:07:33.000Z
CVE-2021-4208 ExportFeed <= 2.0.1.0 - Admin+ SQL Injection
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: ExportFeed: List WooCommerce Products on eBay Store
Credits: lang: en
value: 0xdecafbad
Published: 2022-02-21T10:45:57.000Z
CVE-2021-4209 
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
Problem types: cwe_id: CWE-476
description: CWE-476 - NULL Pointer Dereference
Affected products: vendor: n/a
product: GnuTLS
Published: 2022-08-24T15:07:31.000Z
CVE-2021-4210 
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas
Published: 2022-04-22T20:30:41.000Z
CVE-2021-4211 
A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas
Published: 2022-04-22T20:30:43.000Z
CVE-2021-4212 
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas
Published: 2022-04-22T20:30:44.000Z
CVE-2021-4213 
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Problem types: cwe_id: CWE-401
description: CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products: vendor: n/a
product: JSS
Published: 2022-08-24T15:07:48.000Z
CVE-2021-4214 
A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.
Problem types: cwe_id: CWE-120
description: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: n/a
product: libpng
Published: 2022-08-24T00:00:00.000Z
CVE-2021-4216 
A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.
Problem types: cwe_id: CWE-369
description: CWE-369 - Divide By Zero
Affected products: vendor: n/a
product: mupdf
Published: 2022-08-26T15:25:43.000Z
CVE-2021-4217 
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Problem types: cwe_id: CWE-476
description: CWE-476 - NULL Pointer Dereference
Affected products: vendor: n/a
product: unzip
Published: 2022-08-24T15:08:43.000Z
CVE-2021-4218 
A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots. The issue is specific to CentOS/RHEL.
Problem types: cwe_id: CWE-665
description: CWE-665 - Improper Initialization -> CWE-824 - Access of Uninitialized Pointer
Affected products: vendor: n/a
product: kernel
Published: 2022-08-24T15:08:25.000Z
CVE-2021-4219 
A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw allows an attacker to crash the system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: imagemagick
Published: 2022-03-23T19:46:17.000Z
CVE-2021-4221 
If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*<br>*Note*: Due to a clerical error this advisory was not included in the original announcement, and was added in Feburary 2022. This vulnerability affects Firefox < 92.
Problem types: description: Address bar spoofing on Firefox for Android due to RTL characters
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2021-4222 WP Paginate < 2.1.4 - Admin+ Stored Cross-Site Scripting
The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP-Paginate
Credits: lang: en
value: Park Won Seok
Published: 2022-02-28T09:06:40.000Z
CVE-2021-4225 SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: SP Project & Document Manager
Credits: lang: en
value: pang0lin @webray.com.cn inc
Published: 2022-04-25T15:50:53.000Z
CVE-2021-4226 RSFirewall < 1.1.25 - IP Block Bypass
RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: RSFirewall!
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
Published: 2022-12-15T17:14:40.696Z
CVE-2021-4227 Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
Problem types: description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Unknown
product: ark-commenteditor
default_status: affected
Credits: lang: en
value: Rasi Afeef
lang: en
value: WPScan
Published: 2024-01-16T15:52:25.423Z
CVE-2021-4228 Hard-coded TLS Certificate
Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: Lanner Inc
product: IAC-AST2500A
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
Credits: lang: en
value: Andrea Palanca of Nozomi Networks found this bug during a security research activity.
Published: 2022-10-24T00:00:00.000Z
CVE-2021-4229 ua-parser-js Crypto Mining backdoor
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-912
description: CWE-912 Backdoor
Affected products: vendor: unspecified
product: ua-parser-js
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-05-24T15:30:35.000Z
CVE-2021-4230 Airfield Online MySQL Backup improper authentication
A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: unspecified
product: Airfield Online
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-05-24T16:10:13.000Z
CVE-2021-4231 Angular Comment cross site scripting
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Angular
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Miško Hevery
Published: 2022-05-26T07:10:14.000Z
CVE-2021-4232 Zoo Management System manage-ticket.php cross site scripting
A vulnerability classified as problematic has been found in Zoo Management System 1.0. Affected is an unknown function of the file admin/manage-ticket.php. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. It is possible to launch the attack remotely.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Zoo Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-05-26T17:05:10.000Z
CVE-2021-4234 
OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack.
Problem types: cwe_id: CWE-406
description: CWE-406: Insufficient Control of Network Message Volume
Affected products: vendor: n/a
product: OpenVPN Access Server
Published: 2022-07-06T19:10:17.000Z
CVE-2021-4235 Denial of service in gopkg.in/yaml.v2
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Problem types: description: CWE 400: Uncontrolled Resource Consumption
Affected products: vendor: gopkg.in/yaml.v2
product: gopkg.in/yaml.v2
default_status: unaffected
vendor: github.com/go-yaml/yaml
product: github.com/go-yaml/yaml
default_status: affected
Credits: lang: en
value: @simonferquel
Published: 2022-12-27T21:13:42.393Z
CVE-2021-4236 Panic or authentication bypass in github.com/ecnepsnai/web
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
Problem types: description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: github.com/ecnepsnai/web
product: github.com/ecnepsnai/web
default_status: unaffected
Published: 2022-12-27T21:13:45.711Z
CVE-2021-4238 Insufficient randomness in github.com/Masterminds/goutils
Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
Problem types: description: CWE 330: Use of Insufficiently Random Values
Affected products: vendor: github.com/Masterminds/goutils
product: github.com/Masterminds/goutils
default_status: unaffected
Published: 2022-12-27T21:13:50.373Z
CVE-2021-4239 Weak encryption and denial of service in github.com/flynn/noise
The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.
Problem types: description: CWE 400: Uncontrolled Resource Consumption
Affected products: vendor: github.com/flynn/noise
product: github.com/flynn/noise
default_status: unaffected
Published: 2022-12-27T21:13:53.590Z
CVE-2021-4240 phpservermon User.php generatePasswordResetToken predictable algorithm in random number generator
A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.
Problem types: cwe_id: CWE-331
description: CWE-331 Insufficient Entropy -> CWE-338 Cryptographically Weak PRNG -> CWE-1241 Use of Predictable Algorithm in Random Number Generator
Affected products: vendor: unspecified
product: phpservermon
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
Published: 2022-11-15T00:00:00.000Z
CVE-2021-4241 phpservermon User.php setUserLoggedIn predictable algorithm in random number generator
A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is bb10a5f3c68527c58073258cb12446782d223bc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213744.
Problem types: cwe_id: CWE-331
description: CWE-331 Insufficient Entropy -> CWE-338 Cryptographically Weak PRNG -> CWE-1241 Use of Predictable Algorithm in Random Number Generator
Affected products: vendor: unspecified
product: phpservermon
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
Published: 2022-11-15T00:00:00.000Z
CVE-2021-4242 Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection
A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the file ip/syscmd.htm. The manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214592.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-78 OS Command Injection
Affected products: vendor: Sapido
product: BR270n
vendor: Sapido
product: BRC76n
vendor: Sapido
product: GR297
vendor: Sapido
product: RB1732
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-11-30T00:00:00.000Z
CVE-2021-4244 yikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scripting
A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 is able to address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: yikes-inc-easy-mailchimp-extender Plugin
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
Published: 2022-12-12T00:00:00.000Z
CVE-2021-4245 chbrown rfc6902 pointer.ts prototype pollution
A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
Problem types: cwe_id: CWE-74
description: CWE-74 Injection -> CWE-94 Code Injection -> CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: chbrown
product: rfc6902
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
Published: 2022-12-15T00:00:00.000Z