{"vulnerability": "CVE-2021-3750", "sightings": [{"uuid": "8e9e94c0-3cb1-4713-84bd-e670ed93c425", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-3750", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5893", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-3929\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.\n\ud83d\udccf Published: 2022-08-25T19:36:36.000Z\n\ud83d\udccf Modified: 2025-02-28T13:07:25.655Z\n\ud83d\udd17 References:\n1. https://gitlab.com/qemu-project/qemu/-/issues/556\n2. https://bugzilla.redhat.com/show_bug.cgi?id=2020298\n3. https://access.redhat.com/security/cve/CVE-2021-3929\n4. https://gitlab.com/qemu-project/qemu/-/issues/782\n5. https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385\n6. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I/", "creation_timestamp": "2025-02-28T13:27:01.000000Z"}, {"uuid": "76628575-1a2c-4e24-99dc-0703678a26b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-37502", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8914", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-37502\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.\n\ud83d\udccf Published: 2023-02-03T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-26T18:20:51.481Z\n\ud83d\udd17 References:\n1. https://github.com/marcantondahmen/automad/issues/29", "creation_timestamp": "2025-03-26T18:25:20.000000Z"}, {"uuid": "cfad36f1-b469-4825-b476-3b8ac85ab51a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-37500", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10258", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-37500\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server.\n\ud83d\udccf Published: 2023-01-20T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-03T16:02:57.996Z\n\ud83d\udd17 References:\n1. http://reprise.com\n2. http://reprisesoftware.com\n3. https://github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md", "creation_timestamp": "2025-04-03T16:34:51.000000Z"}, {"uuid": "6e627956-11bd-4324-8798-a8707a31a836", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-3750", "type": "seen", "source": "Telegram/IMjYnrTnDPu711BdX6XuiN74-ZdPF2Mf9LMjtAfCMo13fBTS", "content": "", "creation_timestamp": "2025-03-02T11:44:22.000000Z"}, {"uuid": "3d501979-3a21-4a98-8b61-7289b1eaaf23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-3750", "type": "seen", "source": "https://t.me/cibsecurity/70412", "content": "\u203c CVE-2023-2680 \u203c\n\nThis CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-13T20:24:02.000000Z"}, {"uuid": "0816c286-e1e2-4831-ada4-3f4b7d442afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-3750", "type": "seen", "source": "https://t.me/cibsecurity/41754", "content": "\u203c CVE-2021-3750 \u203c\n\nA DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-02T23:47:04.000000Z"}, {"uuid": "20afacff-1877-4e1f-8df1-6076f54d3c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-37501", "type": "seen", "source": "https://t.me/cibsecurity/57482", "content": "\u203c CVE-2021-37501 \u203c\n\nBuffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-03T20:21:02.000000Z"}, {"uuid": "d7011ff8-3458-4153-b152-1edcd271a3c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-3750", "type": "seen", "source": "https://t.me/cibsecurity/48817", "content": "\u203c CVE-2021-3929 \u203c\n\nA DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-26T00:24:07.000000Z"}, {"uuid": "288561c5-de6e-4b9d-9c32-a5c8d7124546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-37500", "type": "seen", "source": "https://t.me/cibsecurity/56750", "content": "\u203c CVE-2021-37500 \u203c\n\nDirectory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-20T14:26:47.000000Z"}]}