rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-37131 
There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.
Problem types: description: CSV Injection
Affected products: vendor: n/a
product: ManageOne;iManager NetEco;iManager NetEco 6000
Published: 2021-10-27T00:29:32.000Z
CVE-2021-37132 
PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-party apps can obtain the complete list of Harmony apps without permission.
Problem types: description: Permissions, Privileges, and Access Controls
Affected products: vendor: Huawei
product: HarmonyOS
Published: 2022-01-03T21:07:18.000Z
CVE-2021-37133 
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
Problem types: description: Unauthorized file access vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
vendor: Huawei
product: HarmonyOS
Published: 2022-01-03T21:07:40.000Z
CVE-2021-37134 
Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components.
Problem types: description: Race Condition
Affected products: vendor: Huawei
product: HarmonyOS
Published: 2022-01-03T21:07:19.000Z
CVE-2021-37136 
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: The Netty project
product: Netty
Published: 2021-10-19T00:00:00.000Z
CVE-2021-37137 
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: The Netty project
product: Netty
Published: 2021-10-19T00:00:00.000Z
CVE-2021-37144 
CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-29T17:25:02.000Z
CVE-2021-37145 
A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and Remote Code Execution capability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T22:22:41.000Z
CVE-2021-37146 
An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers to cause a Denial of Service in ros_comm via a crafted XMLRPC call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T12:08:38.000Z
CVE-2021-37147 Request Smuggling - LF line ending
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Mattias Grenfeldt and Asta Olofsson for reporting this issue.
Published: 2021-11-03T15:20:19.000Z
CVE-2021-37148 Request Smuggling - transfer encoding validation
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Mattias Grenfeldt and Asta Olofsson for reporting this issue
Published: 2021-11-03T15:20:20.000Z
CVE-2021-37149 Request Smuggling - multiple attacks
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Mattias Grenfeldt and Asta Olofsson for reporting this issue
Published: 2021-11-03T15:20:22.000Z
CVE-2021-37150 Protocol vs scheme mismatch
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Published: 2022-08-10T00:00:00.000Z
CVE-2021-37151 
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.
Problem types: description: Username Enumeration Vulnerability
Affected products: vendor: CyberArk
product: Identity
Published: 2021-09-01T12:35:08.000Z
CVE-2021-37152 
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T13:25:43.000Z
CVE-2021-37153 
ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T20:05:54.000Z
CVE-2021-37154 
In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T20:02:53.000Z
CVE-2021-37155 
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-21T13:43:01.000Z
CVE-2021-37156 
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-05T20:36:35.000Z
CVE-2021-37157 
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T23:12:44.000Z
CVE-2021-37158 
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike server and using the map field to enter a Bash command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T23:11:10.000Z
CVE-2021-37159 
hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-21T00:00:00.000Z
CVE-2021-37160 
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:43:57.000Z
CVE-2021-37161 
A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released versions of software before Nexus Software 7.2.5.7. A buffer overflow allows an attacker to overwrite an internal queue data structure and can lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:42:47.000Z
CVE-2021-37162 
A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. If an attacker sends a malformed UDP message, a buffer underflow occurs, leading to an out-of-bounds copy and possible remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:49:00.000Z
CVE-2021-37163 
An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software 7.2.5.7. The device has two user accounts with passwords that are hardcoded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:46:57.000Z
CVE-2021-37164 
A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. In the tcpTxThread function, the received data is copied to a stack buffer. An off-by-3 condition can occur, resulting in a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:47:50.000Z
CVE-2021-37165 
A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When a message is sent to the HMI TCP socket, it is forwarded to the hmiProcessMsg function through the pendingQ, and may lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T10:48:40.000Z
CVE-2021-37166 
A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by an external attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:44:43.000Z
CVE-2021-37167 
An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A user logged in using the default credentials can gain root access to the device, which provides permissions for all of the functionality of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-02T12:45:52.000Z
CVE-2021-37172 
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC. The vulnerability does not occur when TIA Portal V13 SP1 or any later version was used to provision the device.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Published: 2021-08-10T10:35:34.000Z
CVE-2021-37173 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The command line interface of affected devices insufficiently restrict file read and write operations for low privileged users. This could allow an authenticated remote attacker to escalate privileges and gain root access to the device.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
vendor: Siemens
product: RUGGEDCOM ROX RX1400
vendor: Siemens
product: RUGGEDCOM ROX RX1500
vendor: Siemens
product: RUGGEDCOM ROX RX1501
vendor: Siemens
product: RUGGEDCOM ROX RX1510
vendor: Siemens
product: RUGGEDCOM ROX RX1511
vendor: Siemens
product: RUGGEDCOM ROX RX1512
vendor: Siemens
product: RUGGEDCOM ROX RX1524
vendor: Siemens
product: RUGGEDCOM ROX RX1536
vendor: Siemens
product: RUGGEDCOM ROX RX5000
Published: 2021-09-14T10:47:41.000Z
CVE-2021-37174 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices have a privilege escalation vulnerability, if exploited, an attacker could gain root user access.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
vendor: Siemens
product: RUGGEDCOM ROX RX1400
vendor: Siemens
product: RUGGEDCOM ROX RX1500
vendor: Siemens
product: RUGGEDCOM ROX RX1501
vendor: Siemens
product: RUGGEDCOM ROX RX1510
vendor: Siemens
product: RUGGEDCOM ROX RX1511
vendor: Siemens
product: RUGGEDCOM ROX RX1512
vendor: Siemens
product: RUGGEDCOM ROX RX1524
vendor: Siemens
product: RUGGEDCOM ROX RX1536
vendor: Siemens
product: RUGGEDCOM ROX RX5000
Published: 2021-09-14T10:47:42.000Z
CVE-2021-37175 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices do not properly handle permissions to traverse the file system. If exploited, an attacker could gain access to an overview of the complete file system on the affected devices.
Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
vendor: Siemens
product: RUGGEDCOM ROX RX1400
vendor: Siemens
product: RUGGEDCOM ROX RX1500
vendor: Siemens
product: RUGGEDCOM ROX RX1501
vendor: Siemens
product: RUGGEDCOM ROX RX1510
vendor: Siemens
product: RUGGEDCOM ROX RX1511
vendor: Siemens
product: RUGGEDCOM ROX RX1512
vendor: Siemens
product: RUGGEDCOM ROX RX1524
vendor: Siemens
product: RUGGEDCOM ROX RX1536
vendor: Siemens
product: RUGGEDCOM ROX RX5000
Published: 2021-09-14T10:47:43.000Z
CVE-2021-37176 
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). The femap.exe application lacks proper validation of user-supplied data when parsing modfem files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14260)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Simcenter Femap V2020.2
vendor: Siemens
product: Simcenter Femap V2021.1
Published: 2021-09-14T10:47:44.000Z
CVE-2021-37177 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by the syslog clients managed by the affected software can be manipulated by an unauthenticated attacker in the same network of the affected system.
Problem types: cwe_id: CWE-471
description: CWE-471: Modification of Assumed-Immutable Data (MAID)
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2021-09-14T10:47:45.000Z
CVE-2021-37178 
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the underlying XML parser could cause the affected application to disclose arbitrary files to remote attackers by loading a specially crafted xml file.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: Siemens
product: Solid Edge SE2021
Published: 2021-08-10T10:35:34.000Z
CVE-2021-37179 
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library in affected application lacks proper validation while parsing user-supplied OBJ files that could lead to a use-after-free condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13777)
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Siemens
product: Solid Edge SE2021
Published: 2021-08-10T10:35:35.000Z
CVE-2021-37180 
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while parsing user-supplied OBJ files that could cause an out of bounds access to an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13775)
Problem types: cwe_id: CWE-824
description: CWE-824: Access of Uninitialized Pointer
Affected products: vendor: Siemens
product: Solid Edge SE2021
Published: 2021-08-10T10:35:36.000Z
CVE-2021-37181 
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Siemens
product: Cerberus DMS V4.0
vendor: Siemens
product: Cerberus DMS V4.1
vendor: Siemens
product: Cerberus DMS V4.2
vendor: Siemens
product: Cerberus DMS V5.0
vendor: Siemens
product: Desigo CC Compact V4.0
vendor: Siemens
product: Desigo CC Compact V4.1
vendor: Siemens
product: Desigo CC Compact V4.2
vendor: Siemens
product: Desigo CC Compact V5.0
vendor: Siemens
product: Desigo CC V4.0
vendor: Siemens
product: Desigo CC V4.1
vendor: Siemens
product: Desigo CC V4.2
vendor: Siemens
product: Desigo CC V5.0
Published: 2021-09-14T10:47:46.000Z
CVE-2021-37183 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software allows sending send-to-sleep notifications to the managed devices. An unauthenticated attacker in the same network of the affected system can abuse these notifications to cause a Denial-of-Service condition in the managed devices.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2021-09-14T10:47:47.000Z
CVE-2021-37184 
A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system.
Problem types: cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: Siemens
product: Industrial Edge Management
Published: 2021-09-14T10:47:48.000Z