Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7371 State: PUBLISHED Published: 2020-10-20T16:40:25.065097Z Last Updated: 2024-09-16T22:50:27.553Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Raise IT Solutions Products: RITS Browser Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html
Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html - https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE ID: CVE-2020-7373 State: PUBLISHED Published: 2020-10-30T16:50:16 Last Updated: 2024-08-04T09:25:49.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ - https://forum.vbulletin.com/forum/vbullet
- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch - https://seclists.org/fulldisclosure/2020/Aug/5 - https://github.com/rapid7/metasploit-framework/pull/13970
CVE ID: CVE-2020-7374 State: PUBLISHED Published: 2020-08-12T17:25:17.985247Z Last Updated: 2024-09-17T02:26:23.622Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Documalis Products: Free PDF Editor, Free PDF Scanner Problem Types: CWE-120 Description: Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software. Additional Analyst Notes: - CVE P
the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/13517
CVE ID: CVE-2020-7376 State: PUBLISHED Published: 2020-08-24T19:10:17.594819Z Last Updated: 2024-09-16T23:35:28.125Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Rapid7 Products: Metasploit Framework Problem Types: CWE-23 Description: The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/issues/14008
CVE ID: CVE-2020-7377 State: PUBLISHED Published: 2020-08-24T19:10:18.025073Z Last Updated: 2024-09-17T03:43:45.123Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Rapid7 Products: Metasploit Framework Problem Types: CWE-23 Description: The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/issues/140
ditional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/issues/14015
CVE ID: CVE-2020-7378 State: PUBLISHED Published: 2020-11-24T16:35:15.035583Z Last Updated: 2024-09-16T20:37:06.713Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: CRIXP Products: OpenCRX Problem Types: CWE-620 Description: CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2020/11/2
ed September 4, 2020. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/
CVE ID: CVE-2020-7381 State: PUBLISHED Published: 2020-09-03T13:55:25 Last Updated: 2024-08-04T09:25:49.053Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Rapid7 Products: Nexpose Problem Types: CWE-94 Description: In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Security Console installation and any arbitrary code executable using the same file name. Additional Analyst Notes: - CVE Program Container: References: - http
rbitrary code executable using the same file name. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40
CVE ID: CVE-2020-7382 State: PUBLISHED Published: 2020-09-03T13:55:26 Last Updated: 2024-08-04T09:25:49.039Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Rapid7 Products: Nexpose Problem Types: CWE-428 Description: Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.40
CVE ID: CVE-2020-7383 State: PUBLISHED Published: 2020-10-14T19:45:15.276787Z Last Updated: 2024-09-16T20:31:39.664Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Rapid7 Products: Nexpose Problem Types: CWE-89 Description: A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & make changes they should not have been able to access. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/insightvm/en-us/release-notes/index.html?pid=6.6.49
CVE ID: CVE-2020-7384 State: PUBLISHED Published: 2020-10-29T14:05:16 Last Updated: 2024-08-04T09:25:48.998Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rapid7 Products: Metasploit Problem Types: CWE-77 Description: Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/14288 - http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.html - http://packetstorm
msecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.html - http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection.html
CVE ID: CVE-2020-7385 State: PUBLISHED Published: 2021-04-23T15:35:19.277046Z Last Updated: 2024-09-17T01:30:50.001Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Rapid7 Products: Metasploit Framework Problem Types: CWE-502 Description: By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in
ivileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/14300 - https://help.rapid7.com/metasploit/release-notes/archive/2020/10/ - https://github.com/rapid7/metasploit-framework/pull/14335
CVE ID: CVE-2020-7387 State: PUBLISHED Published: 2021-07-22T18:27:13.578830Z Last Updated: 2024-09-17T01:36:06.790Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Sage Products: X3 Problem Types: CWE-200 Description: Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Pay
es for on-premises versions of Sage X3 Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor. Additional Analyst Notes: - CVE Program Container: References: - https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed - https://www.sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alerts/147993/sage-x3-latest-patches
CVE ID: CVE-2020-7388 State: PUBLISHED Published: 2021-07-22T18:27:14.638718Z Last Updated: 2024-09-16T22:09:12.522Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Sage Products: X3 Problem Types: CWE-290 Description: Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by exploiting CVE-2020-7387. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 including Version 9 (co
ssue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 including Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor. Additional Analyst Notes: - CVE Program Container: References: - https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed - https://www.sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alert
age-x3-multiple-vulnerabilities-fixed - https://www.sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alerts/147993/sage-x3-latest-patches
CVE ID: CVE-2020-7389 State: PUBLISHED Published: 2021-07-22T18:27:15.586124Z Last Updated: 2024-09-16T16:53:13.741Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Sage Products: X3 Problem Types: CWE-306 Description: Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production. Additional Analyst Notes: - CVE Program Container: References: - https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed
CVE ID: CVE-2020-7390 State: PUBLISHED Published: 2021-07-22T18:27:16.507491Z Last Updated: 2024-09-16T19:35:11.250Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Sage Products: X3 Problem Types: CWE-79 Description: Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor. Additional Analyst Notes: - CVE Progra
ther on-premises versions of Sage X3 are unaffected or unsupported by the vendor. Additional Analyst Notes: - CVE Program Container: References: - https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed - https://www.sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alerts/147993/sage-x3-latest-patches
CVE ID: CVE-2020-7450 State: PUBLISHED Published: 2020-02-18T15:26:42 Last Updated: 2024-08-04T09:25:49.035Z Vendors: n/a Products: FreeBSD Problem Types: Heap-based buffer overflow Description: In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:01.libfetch.asc
CVE ID: CVE-2020-7451 State: PUBLISHED Published: 2020-04-28T19:11:42 Last Updated: 2024-08-04T09:25:48.993Z Vendors: n/a Products: FreeBSD Problem Types: Improper initialization Description: In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE-p7, a TCP SYN-ACK or challenge TCP-ACK segment over IPv6 that is transmitted or retransmitted does not properly initialize the Traffic Class field disclosing one byte of kernel memory over the network. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:04.tcp.asc
CVE ID: CVE-2020-7452 State: PUBLISHED Published: 2020-04-28T23:36:47 Last Updated: 2024-08-04T09:25:49.075Z Vendors: n/a Products: FreeBSD Problem Types: Improper use of user-controlled data Description: In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE-p7, incorrect use of a user-controlled pointer in the epair virtual network module allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc
CVE ID: CVE-2020-7453 State: PUBLISHED Published: 2020-04-28T23:36:45 Last Updated: 2024-08-04T09:25:49.043Z Vendors: n/a Products: FreeBSD Problem Types: Improper Null Termination Description: In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE-p7, a missing null termination check in the jail_set configuration option "osrelease" may return more bytes with a subsequent jail_get system call allowing a malicious jail superuser with permission to create nested jails to read kernel memory. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:0
Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:08.jail.asc
CVE ID: CVE-2020-7454 State: PUBLISHED Published: 2020-05-13T15:31:29 Last Updated: 2024-08-04T09:25:49.117Z Vendors: n/a Products: FreeBSD Problem Types: Out-of-bounds read/write Description: In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not properly validate packet length resulting in modules causing an out of bounds read/write condition if no checking was built into the module. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:12.libalias.asc - https://security.netapp.com/advisory/ntap-20200518-0005/ - https://www.
D.org/advisories/FreeBSD-SA-20:12.libalias.asc - https://security.netapp.com/advisory/ntap-20200518-0005/ - https://www.zerodayinitiative.com/advisories/ZDI-20-660/ - https://www.zerodayinitiative.com/advisories/ZDI-20-659/
CVE ID: CVE-2020-7455 State: PUBLISHED Published: 2020-05-13T15:31:36 Last Updated: 2024-08-04T09:25:48.972Z Vendors: n/a Products: FreeBSD Problem Types: Out-of-bounds read Description: In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, the FTP packet handler in libalias incorrectly calculates some packet length allowing disclosure of small amounts of kernel (for kernel NAT) or natd process space (for userspace natd). Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:13.libalias.asc - https://security.netapp.com/advisory/ntap-20200518-
ps://security.FreeBSD.org/advisories/FreeBSD-SA-20:13.libalias.asc - https://security.netapp.com/advisory/ntap-20200518-0005/ - https://www.zerodayinitiative.com/advisories/ZDI-20-661/
CVE ID: CVE-2020-7456 State: PUBLISHED Published: 2020-06-09T18:44:58 Last Updated: 2024-08-04T09:25:48.974Z Vendors: n/a Products: FreeBSD Problem Types: Out-of-bounds Read/Write Description: In FreeBSD 12.1-STABLE before r361918, 12.1-RELEASE before p6, 11.4-STABLE before r361919, 11.3-RELEASE before p10, and 11.4-RC2 before p1, an invalid memory location may be used for HID items if the push/pop level is not restored within the processing of that HID item allowing an attacker with physical access to a USB port to be able to use a specially crafted USB device to gain kernel or user-space code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeB
el or user-space code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:17.usb.asc - https://security.netapp.com/advisory/ntap-20200625-0005/
CVE ID: CVE-2020-7457 State: PUBLISHED Published: 2020-07-09T13:46:41 Last Updated: 2024-08-04T09:25:49.099Z Vendors: n/a Products: FreeBSD Problem Types: Race Condition Description: In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:20.ipv6.asc - https://security.netapp.com/a
ntainer: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:20.ipv6.asc - https://security.netapp.com/advisory/ntap-20200724-0002/ - http://packetstormsecurity.com/files/158695/FreeBSD-ip6_setpktopt-Use-After-Free-Privilege-Escalation.html
CVE ID: CVE-2020-7458 State: PUBLISHED Published: 2020-07-09T13:47:03 Last Updated: 2024-08-04T09:25:48.986Z Vendors: n/a Products: FreeBSD Problem Types: Buffer Overflow Description: In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH environment variable cause posix_spawnp to write beyond the end of the heap allocated stack possibly leading to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:18.posix_spawnp.asc - https://security.netapp.com/advisory/ntap-20200724-0002/
CVE ID: CVE-2020-7459 State: PUBLISHED Published: 2020-08-06T16:49:19 Last Updated: 2024-08-04T09:25:49.099Z Vendors: n/a Products: FreeBSD Problem Types: Kernel out of bounds write Description: In FreeBSD 12.1-STABLE before r362166, 12.1-RELEASE before p8, 11.4-STABLE before r362167, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, missing length validation code common to mulitple USB network drivers allows a malicious USB device to write beyond the end of an allocated network packet buffer. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:21.usb_net.asc - https://security.netapp.com/advisory/ntap-20200821-0005/
CVE ID: CVE-2020-7460 State: PUBLISHED Published: 2020-08-06T16:49:16 Last Updated: 2024-08-04T09:25:49.126Z Vendors: n/a Products: FreeBSD Problem Types: Kernel out of bounds write Description: In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:23.sendmsg.asc - https
tes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:23.sendmsg.asc - https://www.zerodayinitiative.com/advisories/ZDI-20-949/ - https://security.netapp.com/advisory/ntap-20200821-0005/
CVE ID: CVE-2020-7461 State: PUBLISHED Published: 2021-03-26T20:55:08 Last Updated: 2024-08-04T09:25:49.113Z Vendors: n/a Products: FreeBSD Problem Types: Heap-based Buffer Overflow Description: In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit. Additional Analyst Notes: - CVE Program C
privileges in a Capsicum sandbox, limiting the immediate impact of an exploit. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:26.dhclient.asc - https://cert-portal.siemens.com/productcert/pdf/ssa-288459.pdf