yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-32966: Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDAP system credentials.
Key phrases: remotely read LDAP system credentials, clear text transmission, sensitive information
CVE-2021-32967: Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which may allow the attacker to log in and use the device with administrative privileges.
Key phrases: add a new administrative user without being authenticated, log in and use the device with administrative
CVE-2021-32968: Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-of-service condition.
Key phrases: cause a denial-of-service condition, buffer overflows, denial of service
CVE-2021-32969: Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result in a system crash or allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, out-of-bounds write condition, system crash, out of bounds write
CVE-2021-3297: On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.
Key phrases: login cookie, administrator access
CVE-2021-32970: Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attacker to cause denial-of-service conditions.
Key phrases: cause denial-of-service conditions, denial of service
CVE-2021-32971: Null pointer dereference in SuiteLink server while processing command 0x07
Key phrases: null pointer dereference
CVE-2021-32972: Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.
Key phrases: craft a project file specifying a URI that, disclose information that is accessible in the context
CVE-2021-32974: Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.
Key phrases: execute commands, improper input validation
CVE-2021-32975: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2021-32976: Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.
Key phrases: execute arbitrary code, initiate a denial-of-service attack, buffer overflows, denial of service
CVE-2021-32977: AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.
CVE-2021-32978: The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00.
Key phrases: be read by an attacker, lock state
CVE-2021-32979: Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
Key phrases: null pointer dereference
CVE-2021-3298: Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter.
Key phrases: XSS when an authenticated user enters an XSS, xss, xss payload
CVE-2021-32980: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.
Key phrases: software programming connections
CVE-2021-32981: AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2021-32982: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange.
Key phrases: plaintext, network visibility
CVE-2021-32983: A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\\\\MSSQLSERVER.
Key phrases: execute arbitrary code, blind sql injection
CVE-2021-32984: All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project without authorization.
Key phrases: unlocked privileges, privilege escalation
CVE-2021-32985: AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.
CVE-2021-32986: After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without authorization. The PLC is only relocked by a power cycle, or when the programming software disconnects correctly.
CVE-2021-32987: Null pointer dereference in SuiteLink server while processing command 0x0b
Key phrases: null pointer dereference
CVE-2021-32988: FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2021-32989: When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
Key phrases: reflected cross-site scripting
CVE-2021-32990: FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds read, out of bounds read
CVE-2021-32991: Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally.
Key phrases: cause a user to carry out an action, cross-site request forgery, action unintentionally, cross site request forgery
CVE-2021-32992: FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out of bounds memory
CVE-2021-32993: IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2021-32994: Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.
Key phrases: crash the software by sending a variety of, unexpected memory locations
CVE-2021-32995: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds write, out of bounds write, execute code
CVE-2021-32996: The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash. A restart is required.
Key phrases: integer coercion errors, crash
CVE-2021-32997: The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01 versions 5.05 and prior) utilize a weak encryption algorithm for storage and transmission of sensitive data, which may allow an attacker to more easily obtain credentials used for access.
Key phrases: obtain credentials, more easily obtain credentials used for access, weak encryption algorithm
CVE-2021-32998: The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT START/restore from backup required.
Key phrases: execute arbitrary code, remotely execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2021-32999: Improper handling of exceptional conditions in SuiteLink server while processing command 0x01
Key phrases: exceptional conditions
CVE-2021-33000: Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
Key phrases: perform arbitrary code execution, heap-based buffer overflow, heap based buffer overflow
CVE-2021-33001: xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
Key phrases: execute arbitrary code, cross-site scripting
CVE-2021-33002: Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2021-33003: Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm.
Key phrases: retrieve passwords in cleartext due to a weak, weak hashing algorithm
CVE-2021-33004: The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
Key phrases: execute arbitrary code, memory corruption condition
CVE-2021-33005: mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.
Key phrases: upload arbitrary files, upload arbitrary files to arbitrary directories
CVE-2021-33007: A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, heap-based buffer overflow, heap based buffer overflow
CVE-2021-33008: AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.
CVE-2021-33009: mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
Key phrases: upload arbitrary files, upload arbitrary files to the file system
CVE-2021-33010: An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.
Key phrases: denial-of-service condition, denial of service
CVE-2021-33011: All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly process an ICMP flood, which may allow an attacker to deny Ethernet communications between affected devices.
Key phrases: deny Ethernet communications between affected devices, icmp flood
CVE-2021-33012: Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when the controller is switched to RUN mode, which results in a denial-of-service condition. If successfully exploited, this vulnerability will cause the controller to fault whenever the controller is switched to RUN mode.
Key phrases: cause the PLC to fault when the controller, denial-of-service condition, denial of service
CVE-2021-33013: mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.
Key phrases: unauthorized read access, sensitive system information
CVE-2021-33014: An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
Key phrases: gain VxWorks Shell, vxworks shell, hard-coded credentials, hard coded credentials
CVE-2021-33015: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds write, uninitialized pointer, out of bounds write, execute code
CVE-2021-33016: An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
Key phrases: gain full access, hard-coded credentials, hard coded credentials
CVE-2021-33017: The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
CVE-2021-33018: The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.
Key phrases: unnecessary risk, exposure of sensitive information
CVE-2021-33019: A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2021-33020: Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Key phrases: safety, timing window
CVE-2021-33021: xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
Key phrases: execute arbitrary code, cross-site scripting
CVE-2021-33022: Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Key phrases: cleartext
CVE-2021-33023: Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
Key phrases: remotely execute code, heap-based buffer overflow, heap based buffer overflow
CVE-2021-33024: Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.
Key phrases: insecure method
CVE-2021-33025: xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
Key phrases: unvalidated registry keys
CVE-2021-33026: The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision
Key phrases: remote code execution, local privilege escalation, exploitation
CVE-2021-33027: Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.
Key phrases: insufficient entropy
CVE-2021-33031: In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email address if the attacker knows details of the victim such as the exact roles and group roles, ID, and remote authentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03.
Key phrases: gain access, exploitation
CVE-2021-33032: A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.
Key phrases: execute system commands as root via a simple, remote code execution (rce)
CVE-2021-33033: The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
Key phrases: use-after-free, arbitrary value, use after free
CVE-2021-33034: In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
Key phrases: use-after-free, arbitrary value, use after free
CVE-2021-33035: Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
Key phrases: arbitrary code
CVE-2021-33036: In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Key phrases: run arbitrary commands
CVE-2021-33037: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Key phrases: request smuggling
CVE-2021-33038: An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.
Key phrases: publicly visible, sensitive information
CVE-2021-3304: Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.
Key phrases: buffer overflow
CVE-2021-33040: managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
Key phrases: XSS, xss
CVE-2021-33041: vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Key phrases: ['\\'div class="markdown-body"\\' XSS', 'xss', 'remote code execution']
CVE-2021-33044: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Key phrases: bypass device identity authentication, authentication bypass, identity authentication bypass
CVE-2021-33045: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Key phrases: bypass device identity authentication, authentication bypass, identity authentication bypass
CVE-2021-33046: Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.
Key phrases: access control, specific deployments
CVE-2021-3305: Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.
Key phrases: untrusted search path
CVE-2021-33054: SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Key phrases: impersonate
CVE-2021-33055: Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
Key phrases: unauthenticated remote code execution in non-English
CVE-2021-33056: Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.
Key phrases: crash, invalid from header
CVE-2021-33057: The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.
CVE-2021-33058: Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2021-33059: Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2021-33060: Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out-of-bounds write, out of bounds write, escalation privilege
CVE-2021-33061: Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, insufficient control flow management
CVE-2021-33062: Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2021-33063: Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2021-33064: Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2021-33068: Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, null pointer dereference
CVE-2021-33069: Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper resource shutdown
CVE-2021-33071: Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2021-33073: Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, uncontrolled resource consumption
CVE-2021-33074: Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, protection mechanism failure
CVE-2021-33075: Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, race condition
CVE-2021-33076: Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Key phrases: potentially enable escalation of privilege via physical access, improper authentication, escalation privilege
CVE-2021-33077: Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Key phrases: potentially enable escalation of privilege via physical access, insufficient control flow management, escalation privilege
CVE-2021-33078: Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, race condition
CVE-2021-33079: Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, protection mechanism failure
CVE-2021-3308: An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.
Key phrases: Denial of Service (DoS), work properly, vector exhaustion, denial of service (dos), reboot
CVE-2021-33080: Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access.
Key phrases: potentially enable information disclosure or escalation of privilege, uncleared debug information, physical access, escalation privilege
CVE-2021-33081: Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, protection mechanism failure
CVE-2021-33082: Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, sensitive information
CVE-2021-33083: Improper authentication in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow an privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper authentication
CVE-2021-33086: Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, out-of-bounds write, out of bounds write
CVE-2021-33087: Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper authentication
CVE-2021-33088: Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2021-33089: Improper access control in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5BE, NUC8i7BE before version 1.78.4.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2021-3309: packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
CVE-2021-33090: Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, escalation privilege
CVE-2021-33091: Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, insecure inherited permissions, escalation privilege
CVE-2021-33092: Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2021-33093: Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, insecure inherited permissions, escalation privilege
CVE-2021-33094: Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, insecure inherited permissions, escalation privilege
CVE-2021-33095: Unquoted search path in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, unquoted search path, escalation privilege
CVE-2021-33096: Improper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper isolation of shared resources
CVE-2021-33097: Time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via network access.
Key phrases: potentially enable escalation of privilege via network access, time-of-check time-of-use, escalation privilege
CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper input validation
CVE-2021-3310: Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
Key phrases: symbolic link following, code execution, information disclosure
CVE-2021-33101: Uncontrolled search path in the Intel(R) GPA software before version 21.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2021-33103: Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Key phrases: potentially enable aescalation of privilege via local access, unintended intermediary
CVE-2021-33104: Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2021-33105: Out-of-bounds read in some Intel(R) Core(TM) processors with Radeon(TM) RX Vega M GL integrated graphics before version 21.10 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, out-of-bounds read, out of bounds read
CVE-2021-33106: Integer overflow in the Safestring library maintained by Intel(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, integer overflow, escalation privilege
CVE-2021-33107: Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before versions 11.0.0.0012, 12.0.0.0011, 14.0.0.0004 and 15.0.0.0004 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, insufficiently protected credentials
CVE-2021-33108: Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2021-3311: An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Key phrases: relevant, old session id
CVE-2021-33110: Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, improper input validation
CVE-2021-33113: Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.
Key phrases: potentially enable denial of service or information disclosure, improper input validation, adjacent access
CVE-2021-33114: Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, improper input validation
CVE-2021-33115: Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, improper input validation, escalation privilege
CVE-2021-33117: Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper access control
CVE-2021-33118: Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2021-33119: Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper access control
CVE-2021-3312: An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Key phrases: exfiltrate files from the server's file system, xml external entity (xxe)
CVE-2021-33120: Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.
Key phrases: potentially enable information disclosure or cause denial of, out of bounds read, denial of service
CVE-2021-33122: Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Key phrases: potentially enable aescalation of privilege via local access, insufficient control flow management
CVE-2021-33123: Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Key phrases: potentially enable aescalation of privilege via local access, improper access control
CVE-2021-33124: Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Key phrases: potentially enable aescalation of privilege via local access, out-of-bounds write, out of bounds write
CVE-2021-33126: Improper access control in the firmware for some Intel(R) 700 and 722 Series Ethernet Controllers and Adapters before versions 8.5 and 1.5.5 may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2021-33128: Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.0.6 may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2021-33129: Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2021-3313: Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.
Key phrases: execute JavaScript in the context of the victim, cross-site scripting (xss), xss payload, file upload
CVE-2021-33130: Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, insecure default variable initialization
CVE-2021-33135: Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, uncontrolled resource consumption
CVE-2021-33137: Out-of-bounds write in the Intel(R) Kernelflinger project may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out-of-bounds write, out of bounds write, escalation privilege
CVE-2021-33139: Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access
CVE-2021-3314: Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Key phrases: supply dangerous content to the vulnerable page, common logviewer logviewer.jsf xss
CVE-2021-33147: Improper conditions check in the Intel(R) IPP Crypto library before version 2021.2 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper conditions check
CVE-2021-33149: Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, observable behavioral discrepancy
CVE-2021-3315: In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.
Key phrases: stored xss
CVE-2021-33150: Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Key phrases: potentially enable escalation of privilege via physical access, escalation privilege
CVE-2021-33155: Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, improper input validation
CVE-2021-33159: Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper authentication, escalation privilege