Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-20903 State: PUBLISHED Published: 2020-10-01T01:30:19.624410Z Last Updated: 2024-09-17T01:41:38.289Z Vendors: Atlassian Products: @atlaskit/editor-core Problem Types: Cross-Site Scripting (XSS) Description: The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1021244735 - https://atlaskit.atlassian.com/packages/editor/editor-core/changelog/113.1.5 - https://www.npmjs.com/package/%40atlaskit/editor-co
laskit.atlassian.com/packages/editor/editor-core/changelog/113.1.5 - https://www.npmjs.com/package/%40atlaskit/editor-core
CVE ID: CVE-2019-20907 State: PUBLISHED Published: 2020-07-13T00:00:00 Last Updated: 2024-08-05T02:53:09.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/ - https://usn.ub
.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/ - https://usn.ubuntu.com/4428-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/ - https://security.gentoo.org/g
ist/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/ - https://security.gentoo.org/glsa/202008-01 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/ - https://lists.fedoraproject.org/
/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg000
g/opensuse-security-announce/2020-08/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/ - https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://bugs.python.org/issue39017 - https://github.com/python/cpython/pull/21454 - https://security.netapp.com/advisory/ntap-20200731-0002/ - https://lists.
https://github.com/python/cpython/pull/21454 - https://security.netapp.com/advisory/ntap-20200731-0002/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
CVE ID: CVE-2019-20908 State: PUBLISHED Published: 2020-07-15T21:24:27 Last Updated: 2024-08-05T02:53:09.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032. Additional Analyst Notes: - CVE Program Container: References: - https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language.sh - https://mailarchives.bentasker.co.uk/Mirrors/OSSSec/2020/06-Jun/msg00035.html - https://git.kernel.org/pub/scm/linux/kernel/git/torval
chives.bentasker.co.uk/Mirrors/OSSSec/2020/06-Jun/msg00035.html - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1957a85b0032a81e6482ca4aab883643b8dae06e - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4 - http://www.openwall.com/lists/oss-security/2020/07/20/6 - https://usn.ubuntu.com/4427-1/ - http://www.openwall.com/lists/oss-security/2020/07/29/3 - http://www.openwall.com/lists/oss-security/2020/07/30/3 - http://www.openwall.com/lists/oss-security/2020/07/30/2 - https://usn.ubuntu.com/4439-1/ - https://usn.ubuntu.com/4426-1/ - https://usn.ubuntu.com/4440-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
CVE ID: CVE-2019-20909 State: PUBLISHED Published: 2020-07-16T17:46:49 Last Updated: 2024-08-05T02:53:09.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/d7913b893bfa98fab27f05825dc4cab2d3a20c83
CVE ID: CVE-2019-20910 State: PUBLISHED Published: 2020-07-16T17:46:41 Last Updated: 2024-08-05T02:53:09.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in decode_R13_R2000 in decode.c, a different vulnerability than CVE-2019-20011. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/f878ba67b638f0d5050b6dba61b9737f64fc53de
CVE ID: CVE-2019-20911 State: PUBLISHED Published: 2020-07-16T17:46:34 Last Updated: 2024-08-05T02:53:09.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to denial of service in bit_calc_CRC in bits.c, related to a for loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/c6f6668b82bfe595899cc820279ac37bb9ef16f5
CVE ID: CVE-2019-20912 State: PUBLISHED Published: 2020-07-16T17:46:26 Last Updated: 2024-08-05T03:00:17.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a stack overflow in bits.c, possibly related to bit_read_TF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/b84c2cab55948a5ee70860779b2640913e3ee1ed
CVE ID: CVE-2019-20913 State: PUBLISHED Published: 2020-07-16T17:46:18 Last Updated: 2024-08-05T03:00:17.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in dwg_encode_entity in common_entity_data.spec. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/3f503dd294efc63a59608d8a16058c41d44ba13a
CVE ID: CVE-2019-20914 State: PUBLISHED Published: 2020-07-16T17:46:10 Last Updated: 2024-08-05T03:00:19.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_common_entity_handle_data in common_entity_handle_data.spec. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/3b837bb72d6b9ab4d563faa211f90efc257e3c96
CVE ID: CVE-2019-20915 State: PUBLISHED Published: 2020-07-16T17:46:03 Last Updated: 2024-08-05T03:00:17.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/178 - https://github.com/LibreDWG/libredwg/commit/95cc9300430d35feb05b06a9badf678419463dbe
CVE ID: CVE-2019-20916 State: PUBLISHED Published: 2020-09-04T19:20:55 Last Updated: 2024-08-05T03:00:17.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pypa/pip/issues/6413 - https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace - https://github.com/pypa/pip/compare/19.1
tps://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace - https://github.com/pypa/pip/compare/19.1.1...19.2 - https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2019-20917 State: PUBLISHED Published: 2020-09-11T04:43:48 Last Updated: 2024-08-05T03:00:18.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.inspircd.org/security/2019-02/ - https://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff8
ttps://docs.inspircd.org/security/2019-02/ - https://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162 - https://github.com/inspircd/inspircd/commit/8745660fcdac7c1b80c94cfc0ff60928cd4dd4b7 - https://www.debian.org/security/2020/dsa-4764 - https://lists.debian.org/debian-lts-announce/2020/09/msg00015.html
CVE ID: CVE-2019-20918 State: PUBLISHED Published: 2020-09-11T04:43:40 Last Updated: 2024-08-05T03:00:17.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crashing of an InspIRCd server by any user able to fully connect to a server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.inspircd.org/security/2019-01/ - https://github.com/inspircd/inspircd/commit/bcd65de1ec4bb71591ae417fee649d7ecd37cd57 - https://github.com/inspircd/inspircd/commit/7b47de3c194f239c5fea09a0e49696c9af017d51
CVE ID: CVE-2019-20919 State: PUBLISHED Published: 2020-09-17T17:35:43 Last Updated: 2024-08-05T03:00:18.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643-... - https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc67ff - https://usn.ubuntu.com/4534-1/ - https://lists.fedoraproject.org/archives/li
/eca7d7c8f43d96f6277e86d1000e842eb4cc67ff - https://usn.ubuntu.com/4534-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXLKODJ7B57GITDEZZXNSHPK4VBYXYHR/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00013.html
CVE ID: CVE-2019-20920 State: PUBLISHED Published: 2020-09-30T12:30:56 Last Updated: 2024-08-05T03:00:18.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS). Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/1316 - https://www.npmjs.com/advisories/1324 - https://snyk.io/vuln/SNYK-JS-H
rences: - https://www.npmjs.com/advisories/1316 - https://www.npmjs.com/advisories/1324 - https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478
CVE ID: CVE-2019-20921 State: PUBLISHED Published: 2020-09-30T12:30:36 Last Updated: 2024-11-25T17:45:55.390652 Vendors: n/a Products: n/a Problem Types: n/a Description: bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/1522 - https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457 - https://github.com/advisories/GHSA-9r7h-6639-v5mw - https://github.com/snapappointments/bootstrap-select/issues/2199 - https://issues.jtl-software.de/issues/SHOP-7964
CVE ID: CVE-2019-20922 State: PUBLISHED Published: 2020-09-30T12:30:22 Last Updated: 2024-08-05T03:00:18.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/1300 - https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388 - https://github.com/handlebars-lang/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b
CVE ID: CVE-2019-20923 State: PUBLISHED Published: 2020-11-23T15:30:20.507217Z Last Updated: 2024-09-16T17:03:47.113Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-749 Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVE
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-39481
CVE ID: CVE-2019-20924 State: PUBLISHED Published: 2020-11-23T15:30:16.137845Z Last Updated: 2024-09-16T20:21:35.290Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-394 Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-44377
CVE ID: CVE-2019-20925 State: PUBLISHED Published: 2020-11-24T11:00:16.027516Z Last Updated: 2024-09-16T23:45:46.251Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-839 Description: An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24. Additional Analyst Notes: - CVE Program Conta
versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-43751
CVE ID: CVE-2019-20933 State: PUBLISHED Published: 2020-11-19T01:50:50 Last Updated: 2024-08-05T03:00:18.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/influxdata/influxdb/issues/12927 - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6 - https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0 - https://lists.debian.org/debian-lts-announce/2020/12/msg00030.h
fluxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0 - https://lists.debian.org/debian-lts-announce/2020/12/msg00030.html - https://www.debian.org/security/2021/dsa-4823
CVE ID: CVE-2019-20934 State: PUBLISHED Published: 2020-11-28T06:20:36 Last Updated: 2024-08-05T03:00:18.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.6 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16d51a590a8ce3befb1308e0e7ab77f3b661af33 - https://bugs.chromium.org/p/project-zero/issues/detail?id=191
.git/commit/?id=16d51a590a8ce3befb1308e0e7ab77f3b661af33 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1913
CVE ID: CVE-2019-25001 State: PUBLISHED Published: 2020-12-31T08:33:20 Last Updated: 2024-08-05T03:00:19.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0025.html
CVE ID: CVE-2019-25002 State: PUBLISHED Published: 2020-12-31T08:33:09 Last Updated: 2024-08-05T03:00:18.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0026.html
CVE ID: CVE-2019-25003 State: PUBLISHED Published: 2020-12-31T08:32:57 Last Updated: 2024-08-05T03:00:18.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0027.html
CVE ID: CVE-2019-25004 State: PUBLISHED Published: 2020-12-31T08:32:41 Last Updated: 2024-08-05T03:00:18.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0028.html
CVE ID: CVE-2019-25005 State: PUBLISHED Published: 2020-12-31T08:32:30 Last Updated: 2024-08-05T03:00:18.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0029.html
CVE ID: CVE-2019-25006 State: PUBLISHED Published: 2020-12-31T08:32:18 Last Updated: 2024-08-05T03:00:18.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0030.html
CVE ID: CVE-2019-25007 State: PUBLISHED Published: 2020-12-31T08:32:09 Last Updated: 2024-08-05T03:00:18.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0030.html
CVE ID: CVE-2019-25008 State: REJECTED Published: 2020-12-31T08:32:00 Last Updated: 2021-03-07T19:23:00 Description: No description available.
CVE ID: CVE-2019-25009 State: PUBLISHED Published: 2020-12-31T08:31:47 Last Updated: 2024-08-05T03:00:18.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0034.html
CVE ID: CVE-2019-25010 State: PUBLISHED Published: 2020-12-31T08:31:16 Last Updated: 2024-08-05T03:00:19.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-lang-nursery/failure/issues/336 - https://rustsec.org/advisories/RUSTSEC-2019-0036.html
CVE ID: CVE-2019-25011 State: PUBLISHED Published: 2020-12-31T19:09:30 Last Updated: 2024-08-05T03:00:18.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netbox-community/netbox/issues/3471 - http://www.cinquino.eu/NetBox.htm