stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-24012 (severity: HIGH, weakness: CWE-295)
An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority.
CVE-2021-24013 (severity: MEDIUM, weakness: CWE-22)
Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.
CVE-2021-24014 (severity: MEDIUM, weakness: CWE-79)
Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via specifically crafted request parameters.
CVE-2021-24015 (severity: HIGH, weakness: CWE-78)
An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
CVE-2021-24016 (severity: MEDIUM, weakness: CWE-1236)
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.
CVE-2021-24017 (severity: MEDIUM, weakness: CWE-287)
An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.
CVE-2021-24018 (severity: HIGH, weakness: CWE-787)
A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted firmware image.
CVE-2021-24019 (severity: CRITICAL, weakness: CWE-613)
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
CVE-2021-2402 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2021-24020 (severity: CRITICAL, weakness: CWE-347)
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.
CVE-2021-24021 (severity: MEDIUM, weakness: CWE-79)
An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks.
CVE-2021-24022 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value.
CVE-2021-24023 (severity: HIGH, weakness: CWE-78)
An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose" command.
CVE-2021-24024 (severity: MEDIUM, weakness: CWE-532)
A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.
CVE-2021-24025 (severity: CRITICAL, weakness: CWE-122)
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
CVE-2021-24026 (severity: CRITICAL, weakness: CWE-787)
A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write.
CVE-2021-24027 (severity: HIGH, weakness: CWE-524)
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
CVE-2021-24028 (severity: CRITICAL, weakness: CWE-763)
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00.
CVE-2021-24029 (severity: HIGH, weakness: CWE-617)
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
CVE-2021-2403 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2021-24030 (severity: CRITICAL, weakness: CWE-88)
The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0.
CVE-2021-24031 (severity: MEDIUM, weakness: CWE-277)
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
CVE-2021-24032 (severity: MEDIUM, weakness: CWE-277)
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
CVE-2021-24033 (severity: MEDIUM, weakness: CWE-78)
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
CVE-2021-24035 (severity: CRITICAL, weakness: CWE-23)
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.
CVE-2021-24036 (severity: CRITICAL, weakness: CWE-122)
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
CVE-2021-24037 (severity: CRITICAL, weakness: CWE-416)
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVE-2021-24038 (severity: HIGH, weakness: CWE-269)
Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507.
CVE-2021-2404 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway product of Oracle PeopleSoft (component: e-mail notification). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Candidate Gateway. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Candidate Gateway accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Candidate Gateway accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2021-24040 (severity: CRITICAL, weakness: CWE-502)
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
CVE-2021-24041 (severity: CRITICAL, weakness: CWE-122)
A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malicious image.
CVE-2021-24042 (severity: CRITICAL, weakness: CWE-122)
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.
CVE-2021-24043 (severity: CRITICAL, weakness: CWE-125)
A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.
CVE-2021-24044 (severity: CRITICAL, weakness: CWE-843)
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
CVE-2021-24045 (severity: CRITICAL, weakness: CWE-843)
A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVE-2021-24046 (severity: MEDIUM, weakness: CWE-471)
A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affected versions of device software before 2107460.6810.0.
CVE-2021-2405 (severity: HIGH, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Engineering accessible data as well as unauthorized access to critical data or complete access to all Oracle Engineering accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2021-2406 (severity: HIGH, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Collaborative Planning product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Collaborative Planning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Collaborative Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Collaborative Planning accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2021-24066 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2021-24067 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-24068 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-24069 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-2407 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2021-24070 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-24071 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft SharePoint Information Disclosure Vulnerability
CVE-2021-24072 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-24073 (severity: HIGH, weakness: NVD-CWE-Other)
Skype for Business and Lync Spoofing Vulnerability
CVE-2021-24074 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2021-24075 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Windows VMSwitch Denial of Service Vulnerability
CVE-2021-24076 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Windows VMSwitch Information Disclosure Vulnerability
CVE-2021-24077 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Fax Service Remote Code Execution Vulnerability
CVE-2021-24078 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-24079 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Backup Engine Information Disclosure Vulnerability
CVE-2021-2408 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Notification Configuration). The supported version that is affected is 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PT PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVE-2021-24080 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Trust Verification API Denial of Service Vulnerability
CVE-2021-24081 (severity: HIGH, weakness: CWE-787)
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
CVE-2021-24082 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability
CVE-2021-24083 (severity: HIGH, weakness: CWE-787)
Windows Address Book Remote Code Execution Vulnerability
CVE-2021-24084 (severity: MEDIUM, weakness: CWE-59)
Windows Mobile Device Management Information Disclosure Vulnerability
CVE-2021-24085 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Exchange Server Spoofing Vulnerability
CVE-2021-24086 (severity: HIGH, weakness: NVD-CWE-Other)
Windows TCP/IP Denial of Service Vulnerability
CVE-2021-24087 (severity: HIGH, weakness: CWE-269)
Azure IoT CLI extension Elevation of Privilege Vulnerability
CVE-2021-24088 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Local Spooler Remote Code Execution Vulnerability
CVE-2021-24089 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-2409 (severity: HIGH, weakness: NVD-CWE-Other)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2021-24090 (severity: HIGH, weakness: CWE-269)
Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2021-24091 (severity: HIGH, weakness: CWE-787)
Windows Camera Codec Pack Remote Code Execution Vulnerability
CVE-2021-24092 (severity: HIGH, weakness: CWE-269)
Microsoft Defender Elevation of Privilege Vulnerability
CVE-2021-24093 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2021-24094 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2021-24095 (severity: HIGH, weakness: CWE-269)
DirectX Elevation of Privilege Vulnerability
CVE-2021-24096 (severity: HIGH, weakness: CWE-269)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-24098 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Console Driver Denial of Service Vulnerability
CVE-2021-24099 (severity: MEDIUM, weakness: NVD-CWE-Other)
Skype for Business and Lync Denial of Service Vulnerability
CVE-2021-2410 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2021-24100 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2021-24101 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Dataverse Information Disclosure Vulnerability
CVE-2021-24102 (severity: HIGH, weakness: CWE-269)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-24103 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-24104 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Spoofing Vulnerability