rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3820 Inefficient Regular Expression Complexity in pksunkara/inflect
inflect is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: pksunkara
product: pksunkara/inflect
Published: 2021-09-27T12:25:26.000Z
CVE-2021-3821 
A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when running HP Workpath solutions on potentially affected products.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP FutureSmart
Published: 2022-11-21T21:27:09.538Z
CVE-2021-3822 Inefficient Regular Expression Complexity in josdejong/jsoneditor
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: josdejong
product: josdejong/jsoneditor
Published: 2021-09-27T12:25:28.000Z
CVE-2021-3823 Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Bitdefender
product: GravityZone Update Server
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2021-10-28T13:55:12.997Z
CVE-2021-3824 
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
Problem types: cwe_id: CWE-84
description: CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page
Affected products: vendor: n/a
product: OpenVPN Access Server
Published: 2021-09-23T14:53:51.000Z
CVE-2021-3825 Missing Authorization Checks in LiderAhenk
On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: TUBITAK
product: Lider
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Credits: lang: en
value: Mehmet INCE from PRODAFT
Published: 2021-10-01T14:36:20.926Z
CVE-2021-3826 
Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: gcc
Published: 2022-09-01T00:00:00.000Z
CVE-2021-3827 
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Problem types: cwe_id: CWE-287
description: CWE-287 - Improper Authentication
Affected products: vendor: n/a
product: keycloak
Published: 2022-08-23T15:52:50.000Z
CVE-2021-3828 Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: nltk
product: nltk/nltk
Credits: lang: en
value: Srikanth Prathi (@srikanthprathi)
lang: en
value: Tom Aarsen (@tomaarsen)
Published: 2021-09-27T12:25:30.000Z
CVE-2021-3829 Open Redirect in openwhyd/openwhyd
openwhyd is vulnerable to URL Redirection to Untrusted Site
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: openwhyd
product: openwhyd/openwhyd
Published: 2021-12-10T15:25:10.000Z
CVE-2021-3830 Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: btcpayserver
product: btcpayserver/btcpayserver
Published: 2021-09-26T08:15:14.000Z
CVE-2021-3831 Cross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5
gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gnuboard
product: gnuboard/gnuboard5
Published: 2021-12-14T10:50:10.000Z
CVE-2021-3832 Integria IMS Remote Code Execution
Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload() function in order to exploit the vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Ártica
product: Integria IMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by @nag0mez (special mention to @_Barriuso).
Published: 2021-10-07T13:33:19.417Z
CVE-2021-3833 Integria IMS incorrect authorization
Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords.
Problem types: cwe_id: CWE-697
description: CWE-697 Incorrect Comparison
Affected products: vendor: Ártica
product: Integria IMS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by @nag0mez (special mention to @_Barriuso).
Published: 2021-10-07T15:10:07.808Z
CVE-2021-3834 Integria IMS vulnerable to Cross Site Scripting (XSS)
Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Ártica
product: Integria IMS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Discovered by @_Barriuso (special mention to @nag0mez ).
Published: 2021-10-07T15:14:35.381Z
CVE-2021-3835 Buffer overflow in usb device class
Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2022-02-07T22:00:12.211Z
CVE-2021-3836 Improper Restriction of XML External Entity Reference in dbeaver/dbeaver
dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: dbeaver
product: dbeaver/dbeaver
Published: 2021-12-14T15:20:13.000Z
CVE-2021-3837 Improper Authorization in openwhyd/openwhyd
openwhyd is vulnerable to Improper Authorization
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: openwhyd
product: openwhyd/openwhyd
Published: 2022-01-03T15:05:11.000Z
CVE-2021-3838 PHAR Deserialization in dompdf/dompdf
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: dompdf
product: dompdf/dompdf
Published: 2024-11-15T10:51:36.766Z
CVE-2021-3839 
A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
Problem types: cwe_id: CWE-125
description: CWE-125 - Out-of-bounds Read | CWE-787 - Out-of-bounds Write
Affected products: vendor: n/a
product: dpdk
Published: 2022-08-23T15:52:42.000Z
CVE-2021-3840 
A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Antilles
product: Antilles
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: The Antilles team thanks Kotko Vladyslav for reporting this issue.
Published: 2021-11-12T22:05:54.000Z
CVE-2021-3841 Stored Cross-site Scripting (XSS) in sylius/sylius
sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: sylius
product: sylius/sylius
Published: 2024-11-15T10:52:01.371Z
CVE-2021-3842 Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: nltk
product: nltk/nltk
Published: 2022-01-04T14:50:09.000Z
CVE-2021-3843 
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: ThinkPad BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas.
Published: 2021-11-12T22:05:56.000Z
CVE-2021-3844 Rapid7 InsightVM Insufficient Session Expiration
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.  This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Rapid7
product: InsightVM
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Ashutosh Barot
Published: 2023-03-24T16:37:56.633Z
CVE-2021-3845 External Control of File Name or Path in netristv/ws-scrcpy
ws-scrcpy is vulnerable to External Control of File Name or Path
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: netristv
product: netristv/ws-scrcpy
Published: 2022-01-04T16:35:09.000Z
CVE-2021-3846 Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-10-19T12:30:26.000Z
CVE-2021-3847 
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
Problem types: cwe_id: CWE-281
description: CWE-281
Affected products: vendor: n/a
product: kernel
Published: 2022-04-01T22:17:29.000Z
CVE-2021-3848 
An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Arbitrary File Creation by Privliege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-10-06T09:50:57.000Z
CVE-2021-3849 
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Lenovo
product: Fan Power Controller2 (FPC2)
vendor: Lenovo
product: Lenovo System Management Module (SMM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-22T21:10:11.000Z
CVE-2021-3850 Authentication Bypass by Primary Weakness in adodb/adodb
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: adodb
product: adodb/adodb
Published: 2022-01-25T14:20:11.000Z
CVE-2021-3851 Open Redirect in firefly-iii/firefly-iii
firefly-iii is vulnerable to URL Redirection to Untrusted Site
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-10-19T12:30:28.000Z
CVE-2021-3852 Authorization Bypass Through User-Controlled Key in weseek/growi
growi is vulnerable to Authorization Bypass Through User-Controlled Key
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: weseek
product: weseek/growi
Published: 2022-01-12T10:15:11.000Z
CVE-2021-3853 Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chaskiq
product: chaskiq/chaskiq
Published: 2022-01-17T11:25:09.000Z
CVE-2021-3854 SQLi in Glox Technology's Useroam Hotspot
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. This issue affects Useroam Hotspot: before 5.1.0.15.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Glox Technology
product: Useroam Hotspot
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Abdullah KALA
Published: 2023-03-02T11:01:05.232Z
CVE-2021-3855 Command Injection in Liman Central Management System
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.

This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Liman Central Management System
product: Liman Central Management System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Mehmet INCE from PRODAFT
Published: 2023-02-24T13:02:08.734Z
CVE-2021-3856 
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Problem types: cwe_id: CWE-552
description: CWE-552 - Files or Directories Accessible to External Parties
Affected products: vendor: n/a
product: keycloak
Published: 2022-08-26T15:25:39.000Z
CVE-2021-3857 Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chaskiq
product: chaskiq/chaskiq
Published: 2022-01-17T11:35:09.000Z
CVE-2021-3858 Cross-Site Request Forgery (CSRF) in snipe/snipe-it
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2021-10-19T12:30:29.000Z
CVE-2021-3859 
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
Problem types: cwe_id: CWE-214
description: CWE-214 - Invocation of Process Using Visible Sensitive Information
Affected products: vendor: n/a
product: undertow
Published: 2022-08-26T00:00:00.000Z
CVE-2021-3860 
JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: JFrog
product: JFrog Artifactory
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2021-12-20T00:00:00.000Z
CVE-2021-3861 The RNDIS USB device class includes a buffer overflow vulnerability
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2022-02-07T22:00:13.805Z