Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-25012 State: PUBLISHED Published: 2020-12-31T23:28:07 Last Updated: 2024-08-05T03:00:18.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/project/webform_report/issues/3101410
CVE ID: CVE-2019-25013 State: PUBLISHED Published: 2021-01-04T00:00:00.000Z Last Updated: 2025-06-09T15:16:54.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=24973 - https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee7a3144c9922808181009b7b3e50e852fb4999b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47
50e852fb4999b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/ - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r49
04e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjir
.apache.org%3E - https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c%40%3Cissues.zookeeper.apache.org%3E - https://security.gentoo.org/glsa/202107-07 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20210205-0004/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2019-25014 State: PUBLISHED Published: 2021-01-29T06:00:23 Last Updated: 2024-08-05T03:00:18.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/istio/istio/compare/1.4.2...1.5.0-alpha.0 - https://bugzilla.redhat.com/show_bug.cgi?id=1919066
CVE ID: CVE-2019-25015 State: PUBLISHED Published: 2021-01-21T20:08:14 Last Updated: 2024-08-05T03:00:18.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openwrt/luci/commit/bc17ef673f734ea8e7e696ba5735588da9111dcd - https://openwrt.org/advisory/2019-11-05-1
CVE ID: CVE-2019-25016 State: PUBLISHED Published: 2021-01-28T19:38:24 Last Updated: 2024-08-05T03:00:19.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168 - https://github.com/Duncaen/OpenDoas/issues/45 - https://github.com/Duncaen/OpenDoas/releases/tag/v
5f32aa6da70b2032168 - https://github.com/Duncaen/OpenDoas/issues/45 - https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1 - https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d - https://security.gentoo.org/glsa/202107-11
CVE ID: CVE-2019-25017 State: PUBLISHED Published: 2021-02-02T17:23:58 Last Updated: 2024-08-05T03:00:18.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as
the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1131109
CVE ID: CVE-2019-25018 State: PUBLISHED Published: 2021-02-02T17:23:31 Last Updated: 2024-08-05T03:00:18.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. Additional Analyst Notes: - CVE Program Co
e supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1131109
CVE ID: CVE-2019-25019 State: PUBLISHED Published: 2021-02-14T03:22:02 Last Updated: 2024-08-05T03:00:18.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release_notes.txt - https://community.limesurvey.org/release/191008/
CVE ID: CVE-2019-25020 State: PUBLISHED Published: 2021-02-27T04:27:38 Last Updated: 2024-08-05T03:00:18.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI. Additional Analyst Notes: - CVE Program Container: References: - https://suid.ch/research/CVE-2019-25020.html
CVE ID: CVE-2019-25021 State: PUBLISHED Published: 2021-02-27T04:26:19 Last Updated: 2024-08-05T03:00:18.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the admin password. A different password cannot be set because of the implementation in code. Additional Analyst Notes: - CVE Program Container: References: - https://suid.ch/research/CVE-2019-25021.html
CVE ID: CVE-2019-25022 State: PUBLISHED Published: 2021-02-27T04:21:59 Last Updated: 2024-08-05T03:00:18.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event alias, because the application calls Runtime.getRuntime().exec() without validation. Additional Analyst Notes: - CVE Program Container: References: - https://suid.ch/research/CVE-2019-25022.html
CVE ID: CVE-2019-25023 State: PUBLISHED Published: 2021-02-27T04:22:59 Last Updated: 2024-08-05T03:00:19.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the internal application logs, an attacker can inject wrong IP addresses into these logs. Additional Analyst Notes: - CVE Program Container: References: - https://suid.ch/research/CVE-2019-25023.html
CVE ID: CVE-2019-25024 State: PUBLISHED Published: 2021-02-19T03:37:04.000Z Last Updated: 2025-04-16T14:35:08.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenRepeater/openrepeater/issues/66 - https://github.com/codexlynx/CVE-2019-25024 - https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2019-25024.md
CVE ID: CVE-2019-25025 State: PUBLISHED Published: 2021-03-05T05:54:10 Last Updated: 2024-08-05T03:00:18.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/activerecord-session_store/pull/151
CVE ID: CVE-2019-25026 State: PUBLISHED Published: 2021-04-06T07:59:04 Last Updated: 2024-08-05T03:00:18.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE ID: CVE-2019-25027 State: PUBLISHED Published: 2021-04-23T16:05:40.442066Z Last Updated: 2024-09-17T01:15:38.495Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Vaadin Products: Vaadin, flow-server Problem Types: CWE-81 Description: Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2019-25027 - https://github.com/vaadin/flow/pull/5498
CVE ID: CVE-2019-25028 State: PUBLISHED Published: 2021-04-23T16:05:40.548950Z Last Updated: 2024-09-16T20:57:32.611Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Vaadin Products: Vaadin, vaadin-server Problem Types: CWE-80 Description: Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2019-25028 - https://github.com/vaadin/framework/pull/11644 - https:/
ner: References: - https://vaadin.com/security/cve-2019-25028 - https://github.com/vaadin/framework/pull/11644 - https://github.com/vaadin/framework/pull/11645
CVE ID: CVE-2019-25029 State: PUBLISHED Published: 2021-05-26T18:45:32 Last Updated: 2024-08-05T03:00:18.786Z Vendors: n/a Products: Versa Director Problem Types: CWE-77 Description: In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient i
with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1168198
CVE ID: CVE-2019-25030 State: PUBLISHED Published: 2021-05-26T18:45:38 Last Updated: 2024-08-05T03:00:19.000Z Vendors: n/a Products: Versa Director, Versa Analytics, Versa VOS Problem Types: CWE-522 Description: In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive
ible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1168197
CVE ID: CVE-2019-25031 State: PUBLISHED Published: 2021-04-27T05:18:17 Last Updated: 2024-08-05T03:00:18.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-fu
itional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25032 State: PUBLISHED Published: 2021-04-27T05:18:00 Last Updated: 2024-08-05T03:00:18.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25033 State: PUBLISHED Published: 2021-04-27T05:17:53 Last Updated: 2024-08-05T03:00:18.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/n
l-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25034 State: PUBLISHED Published: 2021-04-27T05:17:43 Last Updated: 2024-08-05T03:00:18.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-
sults/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25035 State: PUBLISHED Published: 2021-04-27T05:17:34 Last Updated: 2024-08-05T03:00:18.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25036 State: PUBLISHED Published: 2021-04-27T05:17:26 Last Updated: 2024-08-05T03:00:19.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25037 State: PUBLISHED Published: 2021-04-27T05:17:13 Last Updated: 2024-11-19T14:58:40.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.
-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25038 State: PUBLISHED Published: 2021-04-27T05:17:03 Last Updated: 2024-08-05T03:00:18.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-
CVE ID: CVE-2019-25039 State: PUBLISHED Published: 2021-04-27T05:16:54 Last Updated: 2024-08-05T03:00:18.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25040 State: PUBLISHED Published: 2021-04-27T05:16:44 Last Updated: 2024-08-05T03:00:18.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25041 State: PUBLISHED Published: 2021-04-27T05:16:35 Last Updated: 2024-08-05T03:00:18.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/
CVE ID: CVE-2019-25042 State: PUBLISHED Published: 2021-04-27T05:16:24 Last Updated: 2024-08-05T03:00:19.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited Additional Analyst Notes: - CVE Program Container: References: - https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html - https://security.netapp.com/advisory/ntap-20210507-0007/