stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-26952 (severity: HIGH, weakness: CWE-908)
An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.
CVE-2021-26953 (severity: HIGH, weakness: CWE-908)
An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.
CVE-2021-26954 (severity: MEDIUM, weakness: CWE-415)
An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop.
CVE-2021-26955 (severity: CRITICAL, weakness: CWE-252)
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
CVE-2021-26956 (severity: CRITICAL, weakness: NVD-CWE-Other)
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.
CVE-2021-26957 (severity: CRITICAL, weakness: CWE-125)
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.
CVE-2021-26958 (severity: HIGH, weakness: CWE-252)
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.
CVE-2021-26960 (severity: HIGH, weakness: CWE-352)
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
CVE-2021-26961 (severity: HIGH, weakness: CWE-352)
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
CVE-2021-26962 (severity: HIGH, weakness: CWE-78)
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.
CVE-2021-26963 (severity: HIGH, weakness: NVD-CWE-Other)
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise.
CVE-2021-26964 (severity: HIGH, weakness: CWE-863)
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.
CVE-2021-26965 (severity: MEDIUM, weakness: CWE-89)
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
CVE-2021-26966 (severity: MEDIUM, weakness: CWE-89)
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
CVE-2021-26967 (severity: MEDIUM, weakness: CWE-79)
A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of certain components of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the AirWave management interface.
CVE-2021-26968 (severity: MEDIUM, weakness: CWE-79)
A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface.
CVE-2021-26969 (severity: MEDIUM, weakness: CWE-611)
A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
CVE-2021-26970 (severity: MEDIUM, weakness: CWE-78)
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
CVE-2021-26971 (severity: MEDIUM, weakness: NVD-CWE-Other)
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
CVE-2021-26987 (severity: CRITICAL, weakness: NVD-CWE-Other)
Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
CVE-2021-26988 (severity: LOW, weakness: CWE-862)
Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to converting a 7-Mode directory to Cluster-mode such as Storage Virtual Machine (SVM) names, volume names, directory paths and Job IDs.
CVE-2021-26989 (severity: MEDIUM, weakness: NVD-CWE-Other)
Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attacker to cause a Denial of Service (DoS) on clustered Data ONTAP configured for SMB access.
CVE-2021-26990 (severity: CRITICAL, weakness: CWE-862)
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files.
CVE-2021-26991 (severity: HIGH, weakness: NVD-CWE-Other)
Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Cloud Manager.
CVE-2021-26992 (severity: HIGH, weakness: NVD-CWE-Other)
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS).
CVE-2021-26993 (severity: MEDIUM, weakness: NVD-CWE-Other)
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to cause a partial Denial of Service (DoS) to the web server.
CVE-2021-26994 (severity: MEDIUM, weakness: NVD-CWE-Other)
Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Denial of Service (DoS) on a cluster node.
CVE-2021-26995 (severity: HIGH, weakness: NVD-CWE-Other)
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow privileged attackers to execute arbitrary code.
CVE-2021-26996 (severity: HIGH, weakness: NVD-CWE-Other)
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover system configuration and application information which may aid in crafting more complex attacks.
CVE-2021-26997 (severity: MEDIUM, weakness: CWE-209)
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in crafting more complex attacks.
CVE-2021-26998 (severity: MEDIUM, weakness: CWE-532)
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
CVE-2021-26999 (severity: MEDIUM, weakness: CWE-532)
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
CVE-2021-27001 (severity: MEDIUM, weakness: NVD-CWE-Other)
Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to the end of the retention period.
CVE-2021-27002 (severity: HIGH, weakness: NVD-CWE-Other)
NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy.
CVE-2021-27003 (severity: MEDIUM, weakness: CWE-1021)
Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.
CVE-2021-27004 (severity: MEDIUM, weakness: NVD-CWE-Other)
System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local attacker to discover plaintext iSCSI CHAP credentials.
CVE-2021-27005 (severity: HIGH, weakness: NVD-CWE-Other)
Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow a remote attacker to cause a crash of the httpd server.
CVE-2021-27006 (severity: MEDIUM, weakness: NVD-CWE-Other)
StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escalate their privileges and modify settings in SANtricity System Manager.
CVE-2021-27007 (severity: CRITICAL, weakness: NVD-CWE-Other)
NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited could allow an unauthenticated attacker to takeover a Remote Desktop Session.
CVE-2021-27017 (severity: MEDIUM, weakness: CWE-502)
Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.
CVE-2021-27018 (severity: HIGH, weakness: CWE-295)
The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source.
CVE-2021-27019 (severity: MEDIUM, weakness: CWE-532)
PuppetDB logging included potentially sensitive system information.
CVE-2021-27020 (severity: HIGH, weakness: CWE-1236)
Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
CVE-2021-27021 (severity: HIGH, weakness: CWE-1027)
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
CVE-2021-27022 (severity: MEDIUM, weakness: CWE-532)
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).
CVE-2021-27023 (severity: CRITICAL, weakness: NVD-CWE-Other)
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
CVE-2021-27024 (severity: HIGH, weakness: NVD-CWE-Other)
A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0
CVE-2021-27025 (severity: MEDIUM, weakness: NVD-CWE-Other)
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
CVE-2021-27026 (severity: MEDIUM, weakness: CWE-532)
A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged
CVE-2021-27027 (severity: HIGH, weakness: CWE-125)
An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DLL files or information disclosure.
CVE-2021-27028 (severity: HIGH, weakness: CWE-787)
A Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously crafted DLL files.
CVE-2021-27029 (severity: MEDIUM, weakness: CWE-476)
The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review version 1.5.0 and prior causing the application to crash leading to a denial of service.
CVE-2021-27030 (severity: HIGH, weakness: CWE-22)
A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.
CVE-2021-27031 (severity: HIGH, weakness: CWE-416)
A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system.
CVE-2021-27032 (severity: HIGH, weakness: CWE-276)
Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools on a system to identify services that are configured with weak permissions and are running under elevated privileges. These weak permissions could allow all users on the operating system to modify the service configuration and take ownership of the service.
CVE-2021-27033 (severity: HIGH, weakness: CWE-415)
A Double Free vulnerability allows remote attackers to execute arbitrary code on PDF files within affected installations of Autodesk Design Review 2018, 2017, 2013, 2012, 2011. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVE-2021-27034 (severity: HIGH, weakness: CWE-787)
A heap-based buffer overflow could occur while parsing PICT, PCX, RCL or TIFF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code.
CVE-2021-27035 (severity: HIGH, weakness: CWE-787)
A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVE-2021-27036 (severity: HIGH, weakness: CWE-787)
A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD or TIFF files. This vulnerability can be exploited to execute arbitrary code
CVE-2021-27037 (severity: HIGH, weakness: CWE-416)
A maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by remote malicious actors to execute arbitrary code.
CVE-2021-27038 (severity: HIGH, weakness: CWE-843)
A Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. A malicious actor can leverage this to execute arbitrary code.
CVE-2021-27039 (severity: HIGH, weakness: CWE-787)
A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow. This vulnerability can be exploited to execute arbitrary code.
CVE-2021-27040 (severity: LOW, weakness: CWE-125)
A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code.
CVE-2021-27041 (severity: HIGH, weakness: CWE-787)
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code
CVE-2021-27042 (severity: HIGH, weakness: CWE-755)
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails to handle a crafted DWG file, which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code.
CVE-2021-27043 (severity: HIGH, weakness: CWE-787)
An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application.
CVE-2021-27044 (severity: HIGH, weakness: CWE-125)
A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted DLL files or information disclosure.
CVE-2021-27045 (severity: HIGH, weakness: CWE-125)
A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This vulnerability can be exploited to execute arbitrary code.
CVE-2021-27046 (severity: HIGH, weakness: CWE-787)
A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files.
CVE-2021-27047 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27048 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27049 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27050 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27051 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27052 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Information Disclosure Vulnerability
CVE-2021-27053 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-27054 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-27055 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Visio Security Feature Bypass Vulnerability
CVE-2021-27056 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft PowerPoint Remote Code Execution Vulnerability
CVE-2021-27057 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Remote Code Execution Vulnerability
CVE-2021-27058 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office ClickToRun Remote Code Execution Vulnerability
CVE-2021-27059 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Office Remote Code Execution Vulnerability
CVE-2021-27060 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-27061 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27062 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-27063 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Denial of Service Vulnerability
CVE-2021-27064 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Installer Elevation of Privilege Vulnerability
CVE-2021-27065 (severity: HIGH, weakness: CWE-22)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27066 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Admin Center Security Feature Bypass Vulnerability
CVE-2021-27067 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability