stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-26194 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_is_lexical_environment in the ecma-helpers.c file.
CVE-2021-26195 (severity: HIGH, weakness: CWE-787)
An issue was discovered in JerryScript 2.4.0. There is a heap-buffer-overflow in lexer_parse_number in js-lexer.c file.
CVE-2021-26197 (severity: MEDIUM, weakness: CWE-754)
An issue was discovered in JerryScript 2.4.0. There is a SEGV in main_print_unhandled_exception in main-utils.c file.
CVE-2021-26198 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in JerryScript 2.4.0. There is a SEVG in ecma_deref_bigint in ecma-helpers.c file.
CVE-2021-26199 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_bytecode_ref in ecma-helpers.c file.
CVE-2021-26200 (severity: CRITICAL, weakness: CWE-89)
The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user.
CVE-2021-26201 (severity: CRITICAL, weakness: CWE-89)
The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attacker can obtain access to the admin panel by injecting a SQL query in the username field of the login page.
CVE-2021-26215 (severity: MEDIUM, weakness: CWE-352)
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
CVE-2021-26216 (severity: MEDIUM, weakness: CWE-352)
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
CVE-2021-26220 (severity: HIGH, weakness: CWE-787)
The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
CVE-2021-26221 (severity: HIGH, weakness: CWE-787)
The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
CVE-2021-26222 (severity: HIGH, weakness: CWE-787)
The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
CVE-2021-26223 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_pay.php.
CVE-2021-26224 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php.
CVE-2021-26226 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_user.php.
CVE-2021-26227 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the student information parameters to edit_stud.php.
CVE-2021-26228 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_class1.php.
CVE-2021-26229 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_stud.php.
CVE-2021-26230 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to save_user.php.
CVE-2021-26231 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to category.php.
CVE-2021-26232 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php.
CVE-2021-26233 (severity: HIGH, weakness: CWE-787)
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVE-2021-26234 (severity: HIGH, weakness: CWE-787)
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVE-2021-26235 (severity: HIGH, weakness: CWE-476)
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVE-2021-26236 (severity: HIGH, weakness: CWE-787)
FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BITMAPINFOHEADER Structure, 'BitCount' file format field), that will end up corrupting the Structure Exception Handler (SEH). Attackers could exploit this issue to achieve code execution when a user opens or views a malformed/specially crafted CUR file.
CVE-2021-26237 (severity: HIGH, weakness: CWE-787)
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVE-2021-26247 (severity: MEDIUM, weakness: CWE-79)
As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter.
CVE-2021-26248 (severity: MEDIUM, weakness: CWE-708)
Philips MRI 1.5T and MRI 3T Version 5.x.x assigns an owner who is outside the intended control sphere to a resource.
CVE-2021-26251 (severity: MEDIUM, weakness: CWE-20)
Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Toolkit may allow an authenticated user to potentially enable denial of service via network access.
CVE-2021-26252 (severity: HIGH, weakness: CWE-787)
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
CVE-2021-26253 (severity: HIGH, weakness: CWE-287)
A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service.
CVE-2021-26254 (severity: MEDIUM, weakness: CWE-125)
Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable denial of service via local access.
CVE-2021-26256 (severity: MEDIUM, weakness: CWE-79)
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
CVE-2021-26257 (severity: MEDIUM, weakness: CWE-119)
Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2021-26258 (severity: HIGH, weakness: NVD-CWE-Other)
Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potentially enable escalation of privilege via local access.
CVE-2021-26259 (severity: HIGH, weakness: CWE-787)
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in render_table_row(),in ps-pdf.cxx may lead to arbitrary code execution and denial of service.
CVE-2021-26260 (severity: MEDIUM, weakness: CWE-400)
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
CVE-2021-26262 (severity: MEDIUM, weakness: CWE-284)
Philips MRI 1.5T and MRI 3T Version 5.x.x does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2021-26263 (severity: HIGH, weakness: CWE-79)
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
CVE-2021-26264 (severity: MEDIUM, weakness: CWE-306)
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
CVE-2021-26266 (severity: HIGH, weakness: NVD-CWE-Other)
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
CVE-2021-26267 (severity: HIGH, weakness: NVD-CWE-Other)
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
CVE-2021-26271 (severity: MEDIUM, weakness: CWE-829)
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
CVE-2021-26272 (severity: MEDIUM, weakness: CWE-829)
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
CVE-2021-26273 (severity: HIGH, weakness: CWE-863)
The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
CVE-2021-26274 (severity: HIGH, weakness: CWE-276)
The Agent in NinjaRMM 5.0.909 has Insecure Permissions.
CVE-2021-26275 (severity: CRITICAL, weakness: CWE-77)
The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted
CVE-2021-26276 (severity: MEDIUM, weakness: CWE-913)
scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data
CVE-2021-26277 (severity: CRITICAL, weakness: CWE-94)
The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions.
CVE-2021-26278 (severity: MEDIUM, weakness: CWE-306)
The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.
CVE-2021-26279 (severity: MEDIUM, weakness: CWE-200)
Some parameters of the weather module are improperly stored, leaking some sensitive information.
CVE-2021-26280 (severity: HIGH, weakness: CWE-306)
Locally installed application can bypass the permission check and perform system operations that require permission.
CVE-2021-26281 (severity: MEDIUM, weakness: CWE-200)
Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.
CVE-2021-26291 (severity: CRITICAL, weakness: CWE-346)
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CVE-2021-26293 (severity: CRITICAL, weakness: CWE-22)
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
CVE-2021-26294 (severity: HIGH, weakness: CWE-22)
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
CVE-2021-26295 (severity: CRITICAL, weakness: CWE-502)
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
CVE-2021-26296 (severity: HIGH, weakness: CWE-352)
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
CVE-2021-26303 (severity: MEDIUM, weakness: CWE-79)
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.
CVE-2021-26304 (severity: MEDIUM, weakness: CWE-79)
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.
CVE-2021-26305 (severity: CRITICAL, weakness: CWE-908)
An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.
CVE-2021-26306 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.
CVE-2021-26307 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruction, which is unsound and causes a deterministic crash.
CVE-2021-26308 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness.
CVE-2021-26309 (severity: LOW, weakness: CWE-668)
Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.
CVE-2021-26310 (severity: HIGH, weakness: NVD-CWE-Other)
In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.
CVE-2021-26311 (severity: HIGH, weakness: CWE-77)
In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
CVE-2021-26312 (severity: MEDIUM, weakness: CWE-665)
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
CVE-2021-26313 (severity: MEDIUM, weakness: CWE-208)
Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.
CVE-2021-26314 (severity: MEDIUM, weakness: CWE-208)
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
CVE-2021-26315 (severity: HIGH, weakness: CWE-345)
When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used.
CVE-2021-26316 (severity: HIGH, weakness: CWE-20)
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.
CVE-2021-26317 (severity: HIGH, weakness: NVD-CWE-Other)
Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution.
CVE-2021-26318 (severity: MEDIUM, weakness: CWE-208)
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
CVE-2021-26320 (severity: MEDIUM, weakness: CWE-295)
Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP
CVE-2021-26321 (severity: MEDIUM, weakness: CWE-20)
Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.
CVE-2021-26322 (severity: HIGH, weakness: CWE-320)
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
CVE-2021-26323 (severity: HIGH, weakness: CWE-20)
Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.
CVE-2021-26324 (severity: HIGH, weakness: NVD-CWE-Other)
A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.
CVE-2021-26325 (severity: MEDIUM, weakness: CWE-20)
Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.
CVE-2021-26326 (severity: HIGH, weakness: CWE-665)
Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
CVE-2021-26327 (severity: MEDIUM, weakness: CWE-20)
Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.
CVE-2021-26328 (severity: MEDIUM, weakness: CWE-358)
Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
CVE-2021-26329 (severity: MEDIUM, weakness: CWE-130)
AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.
CVE-2021-26330 (severity: MEDIUM, weakness: CWE-122)
AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
CVE-2021-26331 (severity: HIGH, weakness: CWE-20)
AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution.
CVE-2021-26332 (severity: HIGH, weakness: NVD-CWE-Other)
Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.
CVE-2021-26333 (severity: MEDIUM, weakness: CWE-200)
An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow low privileged users to open a handle and send requests to the driver resulting in a potential data leak from uninitialized physical pages.
CVE-2021-26334 (severity: CRITICAL, weakness: CWE-284)
The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
CVE-2021-26335 (severity: HIGH, weakness: NVD-CWE-Other)
Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution.
CVE-2021-26336 (severity: MEDIUM, weakness: CWE-119)
Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other components.
CVE-2021-26337 (severity: MEDIUM, weakness: NVD-CWE-Other)
Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in SMU not servicing further requests.
CVE-2021-26338 (severity: HIGH, weakness: CWE-284)
Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources.
CVE-2021-26339 (severity: MEDIUM, weakness: NVD-CWE-Other)
A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers.
CVE-2021-26340 (severity: HIGH, weakness: NVD-CWE-Other)
A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).
CVE-2021-26341 (severity: MEDIUM, weakness: CWE-212)
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.
CVE-2021-26342 (severity: LOW, weakness: NVD-CWE-Other)
In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a new virtual machine control block (VMCB). The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for disclosure of SEV guest memory contents. Users of SEV-ES/SEV-SNP guest VMs are not impacted by this vulnerability.
CVE-2021-26343 (severity: MEDIUM, weakness: CWE-668)
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.
CVE-2021-26344 (severity: HIGH, weakness: CWE-787)
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to sign the resulting image, to potentially modify the APCB block resulting in arbitrary code execution.
CVE-2021-26345 (severity: MEDIUM, weakness: CWE-125)
Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service.