Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-36470 State: PUBLISHED Published: 2021-08-08T05:11:38 Last Updated: 2024-08-04T17:30:08.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0150.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/disrustor/RUSTSEC-2020-0150.md
CVE ID: CVE-2020-36471 State: PUBLISHED Published: 2021-08-08T05:11:22 Last Updated: 2024-08-04T17:30:07.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0151.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/generator/RUSTSEC-2020-0151.md
CVE ID: CVE-2020-36472 State: PUBLISHED Published: 2021-08-08T05:11:08 Last Updated: 2024-08-04T17:30:08.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0152.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/max7301/RUSTSEC-2020-0152.md
CVE ID: CVE-2020-36473 State: PUBLISHED Published: 2021-08-14T20:49:56 Last Updated: 2024-08-04T17:30:08.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40ciph3r/why-you-should-not-use-uc-browser-54558916d020
CVE ID: CVE-2020-36474 State: PUBLISHED Published: 2021-08-20T14:14:29 Last Updated: 2024-08-04T17:30:07.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeCurl before 0.9.2 has a DNS rebinding vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vanilla/safecurl/pull/2 - https://github.com/vanilla/safecurl/releases/tag/v0.9.2
CVE ID: CVE-2020-36475 State: PUBLISHED Published: 2021-08-23T00:00:00 Last Updated: 2024-08-04T17:30:08.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 - https://cert-p
thub.com/ARMmbed/mbedtls/releases/tag/v2.16.9 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 - https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf - https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36476 State: PUBLISHED Published: 2021-08-23T00:00:00 Last Updated: 2024-08-04T17:30:08.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 - https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html - https://li
m/ARMmbed/mbedtls/releases/tag/v2.24.0 - https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36477 State: PUBLISHED Published: 2021-08-23T00:00:00 Last Updated: 2024-08-04T17:30:08.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify) with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to any name in that extension regardless of its type. This means that an attacker could impersonate a 4-byte or 16-byte domain by getting a certificate for the corresponding IPv4 or IPv6 address (this would require the attacker to con
-byte domain by getting a certificate for the corresponding IPv4 or IPv6 address (this would require the attacker to control that IP address, though). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 - https://github.com/ARMmbed/mbedtls/issues/3498 - https://security.gentoo.org/glsa/202301-08
CVE ID: CVE-2020-36478 State: PUBLISHED Published: 2021-08-23T00:00:00 Last Updated: 2024-08-04T17:30:07.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 - https://github.com/ARM
/ARMmbed/mbedtls/releases/tag/v2.25.0 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 - https://github.com/ARMmbed/mbedtls/issues/3629 - https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf - https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36485 State: PUBLISHED Published: 2021-10-22T19:20:04 Last Updated: 2024-08-04T17:30:07.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2198
CVE ID: CVE-2020-36486 State: PUBLISHED Published: 2021-10-22T19:20:03 Last Updated: 2024-08-04T17:30:08.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2205
CVE ID: CVE-2020-36488 State: PUBLISHED Published: 2021-10-22T19:20:02 Last Updated: 2024-08-04T17:30:08.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2207
CVE ID: CVE-2020-36489 State: PUBLISHED Published: 2021-10-22T19:20:02 Last Updated: 2024-08-04T17:30:08.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the devicename parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the devicename information. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2204
CVE ID: CVE-2020-36490 State: PUBLISHED Published: 2021-10-22T19:20:01 Last Updated: 2024-08-04T17:30:08.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2195
CVE ID: CVE-2020-36491 State: PUBLISHED Published: 2021-10-22T19:20:01 Last Updated: 2024-08-04T17:30:08.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2195
CVE ID: CVE-2020-36492 State: PUBLISHED Published: 2021-10-22T19:20:00 Last Updated: 2024-08-04T17:30:07.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2195
CVE ID: CVE-2020-36493 State: PUBLISHED Published: 2021-10-22T19:19:59 Last Updated: 2024-08-04T17:30:08.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2195
CVE ID: CVE-2020-36494 State: PUBLISHED Published: 2021-10-22T19:19:59 Last Updated: 2024-08-04T17:30:08.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2194
CVE ID: CVE-2020-36495 State: PUBLISHED Published: 2021-10-22T19:19:58 Last Updated: 2024-08-04T17:30:08.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, `userid`, and `templet' parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2194
CVE ID: CVE-2020-36496 State: PUBLISHED Published: 2021-10-22T19:19:57 Last Updated: 2024-08-04T17:30:08.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2194
CVE ID: CVE-2020-36497 State: PUBLISHED Published: 2021-10-22T19:19:56 Last Updated: 2024-08-04T17:30:08.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2194
CVE ID: CVE-2020-36498 State: PUBLISHED Published: 2021-10-22T19:19:55 Last Updated: 2024-08-04T17:30:08.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Macrob7 Macs Framework Content Management System - 1.14f contains a cross-site scripting (XSS) vulnerability in the account reset function, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the e-mail input field. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2206
CVE ID: CVE-2020-36499 State: PUBLISHED Published: 2021-10-22T19:19:55 Last Updated: 2024-08-04T17:30:08.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting (XSS) vulnerability in the content parameter of the Rubric Block (Add) module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the rubric name value. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2215
CVE ID: CVE-2020-36501 State: PUBLISHED Published: 2021-10-22T19:19:54 Last Updated: 2024-08-04T17:30:08.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2249
CVE ID: CVE-2020-36502 State: PUBLISHED Published: 2021-10-22T19:19:53 Last Updated: 2024-08-04T17:30:08.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Swift File Transfer Mobile v1.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the devicename parameter which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered as the device name itself. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2205
CVE ID: CVE-2020-36503 State: PUBLISHED Published: 2021-11-01T08:45:53 Last Updated: 2024-08-04T17:30:08.250Z Vendors: Unknown Products: Connections Business Directory Problem Types: CWE-1236 Description: The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Connections-Business-Directory/Connections/issues/474 - https://wpscan.com/vulnerability/dd394b55-c86f-4fa2-aae8-5903ca0b95ec
CVE ID: CVE-2020-36504 State: PUBLISHED Published: 2021-11-01T08:45:55 Last Updated: 2024-08-04T17:30:07.697Z Vendors: Unknown Products: Wp-Pro-Quiz Problem Types: CWE-352 Description: The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40hoanhp/0-days-story-1-wp-pro-quiz-2115dd77a6d4 - https://wpscan.com/vulnerability/83679b90-faa5-454e-924c-89f388eccbd1
CVE ID: CVE-2020-36505 State: PUBLISHED Published: 2021-11-01T08:45:57 Last Updated: 2024-08-04T17:30:08.049Z Vendors: Unknown Products: Delete All Comments Easily Problem Types: CWE-352 Description: The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/239f8efa-8fa4-4274-904f-708e65083821 - https://medium.com/%40hoanhp/0-day-story-2-delete-all-comments-easily-a854e52a7d50
CVE ID: CVE-2020-36510 State: PUBLISHED Published: 2022-02-28T09:06:00 Last Updated: 2024-08-04T17:30:08.246Z Vendors: Unknown Products: 15Zine Problem Types: CWE-79 Description: The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95
CVE ID: CVE-2020-36511 State: PUBLISHED Published: 2021-12-26T21:54:11 Last Updated: 2024-08-04T17:30:08.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0153.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bite/RUSTSEC-2020-0153.md
CVE ID: CVE-2020-36512 State: PUBLISHED Published: 2021-12-26T21:53:57 Last Updated: 2024-08-04T17:30:08.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0154.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/buffoon/RUSTSEC-2020-0154.md
CVE ID: CVE-2020-36513 State: PUBLISHED Published: 2021-12-26T21:53:44 Last Updated: 2024-08-04T17:30:08.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0155.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md
CVE ID: CVE-2020-36514 State: PUBLISHED Published: 2021-12-26T21:53:29 Last Updated: 2024-08-04T17:30:07.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0155.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md
CVE ID: CVE-2020-36516 State: PUBLISHED Published: 2022-02-26T03:14:46 Last Updated: 2024-08-04T17:30:08.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. Additional Analyst Notes: - CVE Program Container: References: - https://dl.acm.org/doi/10.1145/3372297.3417884 - https://security.netapp.com/advisory/ntap-20220331-0003/
CVE ID: CVE-2020-36517 State: PUBLISHED Published: 2022-03-07T21:08:01 Last Updated: 2024-08-04T17:30:08.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/home-assistant/plugin-dns/issues/70 - https://github.com/home-assistant/plugin-dns/issues/64 - https://github.com/home-assistant/plugin-dns/pull/59 - https://github.com/home-assistant/plugin-dns/pull/58 - https://github.com/h
thub.com/home-assistant/plugin-dns/pull/59 - https://github.com/home-assistant/plugin-dns/pull/58 - https://github.com/home-assistant/plugin-dns/pull/56 - https://github.com/home-assistant/plugin-dns/pull/55 - https://github.com/home-assistant/plugin-dns/issues/54 - https://github.com/home-assistant/plugin-dns/issues/53 - https://github.com/home-assistant/plugin-dns/issues/51 - https://github.com/home-assistant/plugin-dns/issues/50 - https://github.com/home-assistant/plugin-dns/issues/22 - https://github.com/home-assistant/plugin-dns/issues/20 - https://github.com/home-assistant/plugin-dns/issues/17 - https://github.com/home-assistant/plugin-dns/issues/6 - https://community.home-assistant.io
stant/plugin-dns/issues/17 - https://github.com/home-assistant/plugin-dns/issues/6 - https://community.home-assistant.io/t/ha-os-dns-setting-configuration-not-respected/356572
CVE ID: CVE-2020-36518 State: PUBLISHED Published: 2022-03-11T00:00:00.000Z Last Updated: 2025-08-27T20:34:32.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FasterXML/jackson-databind/issues/2816 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220506-0004/ - https:
tps://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220506-0004/ - https://www.debian.org/security/2022/dsa-5283 - https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html
CVE ID: CVE-2020-36519 State: PUBLISHED Published: 2022-03-15T23:45:01 Last Updated: 2024-08-04T17:30:08.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. (The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs.) Additional Analyst Notes: - CVE Program Container: References: - https://wesleyk.me/2020/01/10/my-first-vulnerability-mimecast-sender-address-verification/
CVE ID: CVE-2020-36521 State: PUBLISHED Published: 2022-09-23T18:58:31.000Z Last Updated: 2025-05-22T15:33:57.293Z Vendors: Apple Products: iTunes for Windows, iOS and iPadOS, iCloud for Windows, watchOS Problem Types: Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0, watchOS 7.0, tvOS 14.0, iCloud for Windows 7.21, iTunes for Windows 12.10.9. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents. Additional Analyst
aliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT211843 - https://support.apple.com/en-us/HT211850 - https://support.apple.com/en-us/HT211844 - https://support.apple.com/en-us/HT211952 - https://support.apple.com/en-us/HT211847 - https://support.apple.com/en-us/HT211846