Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-16093 State: PUBLISHED Published: 2022-07-17T00:00:00 Last Updated: 2024-08-04T13:37:53.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. Additional Analyst Notes: - CVE Program Container: References: - https://lemonldap-ng.org/download - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250 - https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html
CVE ID: CVE-2020-16094 State: PUBLISHED Published: 2020-07-28T18:34:36 Last Updated: 2024-08-04T13:37:53.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree. Additional Analyst Notes: - CVE Program Container: References: - https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4313 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBLHUG2UCXVABAGN5FVTD3AB3YKE5NN/ - https://lists.fedoraproject.org/archives/list/package-annou
edoraproject.org/message/JUBLHUG2UCXVABAGN5FVTD3AB3YKE5NN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CRKHUOVTJBHT53J4CYU53PXYYQKSGEA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNJIXYDMSXYDII4ERMQ4EEKZX64U3QR4/
CVE ID: CVE-2020-16095 State: PUBLISHED Published: 2020-07-29T14:45:38 Last Updated: 2024-08-04T13:37:53.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2020-015
CVE ID: CVE-2020-16096 State: PUBLISHED Published: 2020-09-15T13:24:15 Last Updated: 2024-08-04T13:37:53.427Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-285 Description: In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be (or is) attached to a multi-server environment. This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter compon
This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter components. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16096
CVE ID: CVE-2020-16097 State: PUBLISHED Published: 2020-09-15T13:19:56 Last Updated: 2024-08-04T13:37:54.194Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Gallagher Products: Command Centre Problem Types: CWE-522 Description: On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed in v8.10.1211(MR5)), v8.00 prior to vGR8.00.165 (Distributed in v8.00.1228(MR6)), v7.90 prior to vGR7.90.165 (distributed in v7.90.1038(MRX)), v7.80 or earlier, It is possible to retrieve site keys used for securing MIFARE Plus and Desfire using debug ports on T Series readers. Additional Analyst N
retrieve site keys used for securing MIFARE Plus and Desfire using debug ports on T Series readers. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16097
CVE ID: CVE-2020-16098 State: PUBLISHED Published: 2020-09-15T13:22:55 Last Updated: 2024-08-04T13:37:53.575Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-287 Description: It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166(MR3), versions of 8.10 prior to v8.10.1211(MR5), versions of 8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. These credentials can then be used to encode low security cards to be used by the system where insecure card technologies are supported. Addition
n be used to encode low security cards to be used by the system where insecure card technologies are supported. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16098
CVE ID: CVE-2020-16099 State: PUBLISHED Published: 2020-09-15T13:17:49 Last Updated: 2024-08-04T13:37:53.440Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Gallagher Products: Command Centre Problem Types: CWE-20 Description: In Gallagher Command Centre v8.20 prior to v8.20.1093(MR2) it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16099
CVE ID: CVE-2020-16100 State: PUBLISHED Published: 2020-09-15T13:21:59 Last Updated: 2024-08-04T13:37:53.246Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-404 Description: It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket (Configuration Client) connections. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. Additional
1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16100
CVE ID: CVE-2020-16101 State: PUBLISHED Published: 2020-09-15T13:25:28 Last Updated: 2024-08-04T13:37:53.251Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-805 Description: It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16101
CVE ID: CVE-2020-16102 State: PUBLISHED Published: 2020-12-14T19:26:18 Last Updated: 2024-08-04T13:37:53.544Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-287 Description: Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration, potentially causing the server to crash and fail to restart. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1299(MR2); 8.20 versions prior to 8.20.1218(MR4); 8.10 versions prior to 8.10.1253(MR6); 8.00 versions prior to 8.00.1252(MR7); version 7.90 and p
rior to 8.20.1218(MR4); 8.10 versions prior to 8.10.1253(MR6); 8.00 versions prior to 8.00.1252(MR7); version 7.90 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16102
CVE ID: CVE-2020-16103 State: PUBLISHED Published: 2020-12-14T19:34:42 Last Updated: 2024-08-04T13:37:53.487Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-704 Description: Type confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); version 8.00 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Adv
r versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16103
CVE ID: CVE-2020-16104 State: PUBLISHED Published: 2020-12-14T19:23:30 Last Updated: 2024-08-04T13:37:54.203Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: Gallagher Products: Command Centre Problem Types: CWE-89 Description: SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); 8.00 ve
versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); 8.00 versions prior to 8.00.1228(MR6); version 7.90 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2020-16104
CVE ID: CVE-2020-16105 State: REJECTED Published: 2021-01-27T14:11:17 Last Updated: 2021-01-27T14:11:17 Description: No description available.
CVE ID: CVE-2020-16106 State: REJECTED Published: 2021-01-27T14:02:03 Last Updated: 2021-01-27T14:02:03 Description: No description available.
CVE ID: CVE-2020-16107 State: REJECTED Published: 2021-01-27T14:11:04 Last Updated: 2021-01-27T14:11:04 Description: No description available.
CVE ID: CVE-2020-16108 State: REJECTED Published: 2021-01-27T14:03:15 Last Updated: 2021-01-27T14:03:15 Description: No description available.
CVE ID: CVE-2020-16109 State: REJECTED Published: 2021-01-27T14:04:16 Last Updated: 2021-01-27T14:04:16 Description: No description available.
CVE ID: CVE-2020-16110 State: REJECTED Published: 2021-01-27T14:04:56 Last Updated: 2021-01-27T14:04:56 Description: No description available.
CVE ID: CVE-2020-16111 State: REJECTED Published: 2021-01-27T14:10:35 Last Updated: 2021-01-27T14:10:35 Description: No description available.
CVE ID: CVE-2020-16112 State: REJECTED Published: 2021-01-27T14:06:07 Last Updated: 2021-01-27T14:06:07 Description: No description available.
CVE ID: CVE-2020-16113 State: REJECTED Published: 2021-01-27T14:06:38 Last Updated: 2021-01-27T14:06:38 Description: No description available.
CVE ID: CVE-2020-16114 State: REJECTED Published: 2021-01-27T14:07:09 Last Updated: 2021-01-27T14:07:09 Description: No description available.
CVE ID: CVE-2020-16115 State: REJECTED Published: 2021-01-27T14:07:39 Last Updated: 2021-01-27T14:07:39 Description: No description available.
CVE ID: CVE-2020-16116 State: PUBLISHED Published: 2020-08-03T19:34:07 Last Updated: 2024-08-04T13:37:53.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KDE/ark/commits/master - https://www.debian.org/security/2020/dsa-4738 - https://kde.org/info/security/advisory-20200730-1.txt - https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74ddf8a196bc9ffdb92f - https://security.gentoo.org/glsa/202008-03 - https://lists.fedoraproject.org/archi
2524fed305d6fbe74ddf8a196bc9ffdb92f - https://security.gentoo.org/glsa/202008-03 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYRKQKUVU45ANH5TFYCYZN6HVP34N3UL/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00023.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMVXSQNCBILVSJLX32ODNU6KUY2X7HRM/ - https://usn.ubuntu.com/4461-1/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00026.html
CVE ID: CVE-2020-16117 State: PUBLISHED Published: 2020-07-29T17:59:10 Last Updated: 2024-08-04T13:37:53.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189 - https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/2cc39592b532cf0dc994fd3694b8e6bf924c9ab5 - https://gitlab.gnome
://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/2cc39592b532cf0dc994fd3694b8e6bf924c9ab5 - https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/627c3cdbfd077e59aa288c85ff8272950577f1d7 - https://lists.debian.org/debian-lts-announce/2020/08/msg00005.html
CVE ID: CVE-2020-16118 State: PUBLISHED Published: 2020-07-29T17:58:51 Last Updated: 2024-08-04T13:37:53.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/balsa/-/issues/23 - https://gitlab.gnome.org/GNOME/balsa/-/commit/4e245d758e1c826a01080d40c22ca8706f0339e5 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00035.html - http://lists.opensuse.org/opensu
6f0339e5 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00045.html
CVE ID: CVE-2020-16119 State: PUBLISHED Published: 2021-01-14T01:10:20.401115Z Last Updated: 2024-09-16T18:19:48.160Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Canonical Products: Linux kernel Problem Types: CWE-416 Description: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1883840 - https://ubuntu.com/US
itional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1883840 - https://ubuntu.com/USN-4576-1 - https://ubuntu.com/USN-4577-1 - https://ubuntu.com/USN-4578-1 - https://ubuntu.com/USN-4579-1 - https://ubuntu.com/USN-4580-1 - https://lore.kernel.org/netdev/20201013171849.236025-1-kleber.souza%40canonical.com/T/ - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=01872cb896c76cedeabe93a08456976ab55ad695 - https://security.netapp.com/advisory/ntap-20210304-0006/ - https://www.debian.org/security/2021/dsa-4978 - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-lts-announce/2021
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE ID: CVE-2020-16120 State: PUBLISHED Published: 2021-02-10T19:45:26.096560Z Last Updated: 2024-09-16T18:49:11.997Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux kernel Products: Linux kernel Problem Types: CWE-266 Description: Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack fi
olled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user names
ession in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11. Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/USN-4576-1 - https://ubuntu.com/USN-4577-1 - https://ubuntu.com/USN-4578-1 - https://www.openwall.com/lists/oss-security/2020/10/14/2 - https://launchpad.net/bugs/1894980 - https://launchpad.net/bugs/1900141 - https://git.kernel.org/linus/56230d956739b9cb1cbde439d76227d77979a04d - https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f - https://git.kernel
9cb1cbde439d76227d77979a04d - https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f - https://git.kernel.org/linus/05acefb4872dae89e772729efb194af754c877e8 - https://git.kernel.org/linus/d1d04ef8572bc8c22265057bd3d5a79f223f8f52 - https://git.kernel.org/linus/b6650dab404c701d7fe08a108b746542a934da84
CVE ID: CVE-2020-16121 State: PUBLISHED Published: 2020-11-07T04:10:19.447213Z Last Updated: 2024-09-17T04:04:03.119Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: PackageKit Products: PackageKit Problem Types: CWE-209 Description: PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own. Additional Analyst Notes: - CVE Program Container: References: - https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html - https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887
CVE ID: CVE-2020-16122 State: PUBLISHED Published: 2020-11-07T04:10:19.889638Z Last Updated: 2024-09-16T16:13:16.633Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: PackageKit Products: packagekit Problem Types: CWE-269 Description: PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098
CVE ID: CVE-2020-16123 State: PUBLISHED Published: 2020-12-03T23:15:20.305816Z Last Updated: 2024-09-16T19:20:12.173Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Canonical Products: pulseaudio Problem Types: CWE-362 Description: An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu
to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1895928 - https://ubuntu.com/USN-4640-1
CVE ID: CVE-2020-16124 State: PUBLISHED Published: 2020-10-13T14:50:16.060098Z Last Updated: 2024-09-16T20:57:43.059Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: openrobotics Products: ros_comm ROS communications packages Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to cause unexpected behavior. This issue affects: OpenRobotics ros_comm communications packages Noetic and prior versions. Fixed in https://github.com/ros/ros_comm/pull/2065. Additional Analyst Notes: - CVE Program Container: References: - https://gi
n https://github.com/ros/ros_comm/pull/2065. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ros/ros_comm/pull/2065
CVE ID: CVE-2020-16125 State: PUBLISHED Published: 2020-11-10T04:20:13.785444Z Last Updated: 2024-09-17T03:59:24.216Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Gnome Products: GDM3 Problem Types: CWE-754 Description: gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a local user to create a new privileged account. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gdm/-/issues/642 - https://bugs.launchpad.net
tes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gdm/-/issues/642 - https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/1900314 - https://securitylab.github.com/advisories/GHSL-2020-202-gdm3-LPE-unresponsive-accounts-daemon
CVE ID: CVE-2020-16126 State: PUBLISHED Published: 2020-11-11T04:10:15.043946Z Last Updated: 2024-09-16T17:15:27.923Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Freedesktop Products: accountsservice Problem Types: CWE-269 Description: An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2020-187-accountsservice-drop-privs-DOS
CVE ID: CVE-2020-16127 State: PUBLISHED Published: 2020-11-11T04:10:15.512976Z Last Updated: 2024-09-16T17:58:49.219Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Freedesktop Products: accountsservice Problem Types: CWE-20 Description: An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2020-187-accountsservice-drop-privs-DOS