rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3862 Cross-site Scripting (XSS) - Reflected in icecoder/icecoder
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: icecoder
product: icecoder/icecoder
Published: 2022-01-17T13:50:10.000Z
CVE-2021-3863 Cross-site Scripting (XSS) - Generic in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2021-10-19T12:30:31.000Z
CVE-2021-3864 
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.
Problem types: cwe_id: CWE-284
description: CWE-284 - Improper Access Control
Affected products: vendor: n/a
product: kernel
Published: 2022-08-26T15:25:39.000Z
CVE-2021-3866 Cross-site Scripting (XSS) - Stored in zulip/zulip
Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: zulip
product: zulip/zulip
Published: 2022-01-20T10:30:11.000Z
CVE-2021-3869 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: stanfordnlp
product: stanfordnlp/corenlp
Published: 2021-10-19T12:30:32.000Z
CVE-2021-3872 Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2021-10-19T12:30:34.000Z
CVE-2021-3874 Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-10-15T13:40:18.000Z
CVE-2021-3875 Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2021-10-15T13:40:20.000Z
CVE-2021-3878 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: stanfordnlp
product: stanfordnlp/corenlp
Published: 2021-10-15T13:40:21.000Z
CVE-2021-3879 Cross-site Scripting (XSS) - Stored in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2021-10-19T12:30:35.000Z
CVE-2021-3881 Out-of-bounds Read in bfabiszewski/libmobi
libmobi is vulnerable to Out-of-bounds Read
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2021-10-15T13:40:23.000Z
CVE-2021-3882 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data by capturing network traffic. LedgerSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although an attacker can't access the information inside the cookie, nor the password of the user, possession of the cookie is enough to access the application as the user from which the cookie has been obtained. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of the attack vector. Users of LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need to take action. As a workaround, users may configure their Apache or Nginx reverse proxy to add the Secure attribute at the network boundary instead of relying on LedgerSMB. For Apache, please refer to the 'Header always edit' configuration command in the mod_headers module. For Nginx, please refer to the 'proxy_cookie_flags' configuration command.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: ledgersmb
product: ledgersmb/ledgersmb
Published: 2021-10-14T08:20:11.000Z
CVE-2021-3888 Use of Out-of-range Pointer Offset in bfabiszewski/libmobi
libmobi is vulnerable to Use of Out-of-range Pointer Offset
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2021-10-19T12:30:37.000Z
CVE-2021-3889 Use of Out-of-range Pointer Offset in bfabiszewski/libmobi
libmobi is vulnerable to Use of Out-of-range Pointer Offset
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2021-10-19T12:30:38.000Z
CVE-2021-3897 
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Lenovo
product: Fan Power Controller2 (FPC2)
vendor: Lenovo
product: Lenovo System Management Module (SMM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-22T21:10:13.000Z
CVE-2021-3898 
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Motorola
product: Device Help Android App
vendor: Motorola
product: Ready For Android App
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-04-22T20:30:35.000Z
CVE-2021-3899 
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.
Affected products: vendor: Canonical Ltd.
product: Apport
Credits: lang: en
value: Muqing Liu from Singurlar Security Lab
lang: en
value: neoni
Published: 2024-06-03T18:40:32.847Z
CVE-2021-3900 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-10-27T17:45:11.000Z
CVE-2021-3901 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-10-27T20:50:09.000Z
CVE-2021-3902 Improper Restriction of XML External Entity Reference in dompdf/dompdf
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: dompdf
product: dompdf/dompdf
Published: 2024-11-15T10:52:10.986Z
CVE-2021-3903 Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2021-10-27T21:00:13.000Z
CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav
grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: getgrav
product: getgrav/grav
Published: 2021-10-27T21:10:15.000Z
CVE-2021-3905 
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Problem types: cwe_id: CWE-401
description: CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products: vendor: n/a
product: openvswitch (ovs)
Published: 2022-08-23T00:00:00.000Z
CVE-2021-3906 Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-10-27T21:20:10.000Z
CVE-2021-3907 Arbitrary filepath traversal via URI injection
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Koen van Hove
Published: 2021-11-11T21:45:16.585Z
CVE-2021-3908 Infinite certificate chain depth results in OctoRPKI running forever
OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Koen van Hove
Published: 2021-11-11T21:45:18.120Z
CVE-2021-3909 Infinite open connection causes OctoRPKI to hang forever
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Koen van Hove
Published: 2021-11-11T21:45:19.611Z
CVE-2021-3910 NUL character in ROA causes OctoRPKI to crash
OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Koen van Hove
Published: 2021-11-11T21:45:21.177Z
CVE-2021-3911 Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Koen van Hove
Published: 2021-11-11T21:45:22.690Z
CVE-2021-3912 OctoRPKI crashes when processing GZIP bomb returned via malicious repository
OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Koen van Hove
Published: 2021-11-11T21:45:24.415Z
CVE-2021-3914 
It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: smallrye-health
Published: 2022-08-25T19:36:49.000Z
CVE-2021-3915 Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-11-13T09:15:10.000Z
CVE-2021-3916 Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-11-05T14:50:19.000Z
CVE-2021-3917 
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-276
description: CWE-276 - Incorrect Default Permissions
Affected products: vendor: n/a
product: coreos-installer
Published: 2022-08-23T19:03:22.000Z
CVE-2021-3918 Prototype Pollution in kriszyp/json-schema
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: kriszyp
product: kriszyp/json-schema
Published: 2021-11-13T00:00:00.000Z
CVE-2021-3919 
A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege and/or denial of service. HP has released software updates to mitigate the potential vulnerability.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: OMEN Gaming Hub and HP Command Center
Published: 2022-11-21T21:29:50.895Z
CVE-2021-3920 Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin
grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: getgrav
product: getgrav/grav-plugin-admin
Published: 2021-11-19T12:15:11.000Z
CVE-2021-3921 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-11-13T08:55:12.000Z
CVE-2021-3922 
A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could allow a local attacker to connect and interact with the IMController child process' named pipe.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Lenovo
product: IMController
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Rick Veldhoven from Fox-IT, part of NCC Group for reporting this issue.
Published: 2022-05-18T16:10:22.000Z
CVE-2021-3923 
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: kernel
Published: 2023-03-27T00:00:00.000Z
CVE-2021-3924 Path Traversal in getgrav/grav
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: getgrav
product: getgrav/grav
Published: 2021-11-05T14:50:20.000Z
CVE-2021-3927 Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2021-11-05T00:00:00.000Z
CVE-2021-3928 Use of Uninitialized Variable in vim/vim
vim is vulnerable to Use of Uninitialized Variable
Problem types: cwe_id: CWE-457
description: CWE-457 Use of Uninitialized Variable
Affected products: vendor: vim
product: vim/vim
Published: 2021-11-05T00:00:00.000Z
CVE-2021-3929 
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free
Affected products: vendor: n/a
product: QEMU
Published: 2022-08-25T19:36:36.000Z
CVE-2021-3930 
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
Problem types: cwe_id: CWE-193
description: CWE-193
Affected products: vendor: n/a
product: QEMU
Published: 2022-02-18T17:50:48.000Z
CVE-2021-3931 Cross-Site Request Forgery (CSRF) in snipe/snipe-it
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2021-11-13T08:50:10.000Z
CVE-2021-3932 Cross-Site Request Forgery (CSRF) in area17/twill
twill is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: area17
product: area17/twill
Published: 2021-11-13T08:45:10.000Z
CVE-2021-3933 
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: openexr
Published: 2022-03-25T00:00:00.000Z