Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28502 State: PUBLISHED Published: 2021-03-05T17:25:16.408867Z Last Updated: 2024-09-16T22:55:22.529Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: xmlhttprequest, xmlhttprequest-ssl Problem Types: Arbitrary Code Injection Description: This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935 - htt
ditional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935 - https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082937 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082938 - https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js%23L480
CVE ID: CVE-2020-28503 State: PUBLISHED Published: 2021-03-23T10:00:18.136762Z Last Updated: 2024-09-17T03:08:12.852Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O) Vendors: n/a Products: copy-props Problem Types: Prototype Pollution Description: The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-COPYPROPS-1082870 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088047 - https://github.com/gulpjs/copy-props/pull/7
CVE ID: CVE-2020-28572 State: PUBLISHED Published: 2020-11-18T18:45:38 Last Updated: 2024-08-04T16:40:59.599Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Local Privilege Escalation Description: A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281949
CVE ID: CVE-2020-28573 State: PUBLISHED Published: 2020-12-01T18:40:37 Last Updated: 2024-08-04T16:40:59.551Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan Problem Types: Improper Access Control Information Disclosure Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/adviso
ro.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-20-1374/
CVE ID: CVE-2020-28574 State: PUBLISHED Published: 2020-11-18T18:45:39 Last Updated: 2024-08-04T16:40:59.630Z Vendors: Trend Micro Products: Trend Micro Worry-Free Business Security Problem Types: Unauthenticated Path Traversal Arbitrary Remote File Deletion Description: A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281948 - https://www.tenable.com/security/resear
ram Container: References: - https://success.trendmicro.com/solution/000281948 - https://www.tenable.com/security/research/tra-2020-62
CVE ID: CVE-2020-28575 State: PUBLISHED Published: 2020-12-01T18:40:38 Last Updated: 2024-08-04T16:40:58.911Z Vendors: Trend Micro Products: Trend Micro ServerProtect for Linux Problem Types: Heap-based Buffer Overflow Privilege Escalation Description: A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281950 - https://www.zerodayinit
otes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281950 - https://www.zerodayinitiative.com/advisories/ZDI-20-1378/
CVE ID: CVE-2020-28576 State: PUBLISHED Published: 2020-12-01T18:40:38 Last Updated: 2024-08-04T16:40:59.867Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan Problem Types: Improper Access Control Information Disclosure Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version and build information. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-
lution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-20-1375/
CVE ID: CVE-2020-28577 State: PUBLISHED Published: 2020-12-01T18:40:38 Last Updated: 2024-08-04T16:40:59.382Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan Problem Types: Improper Access Control Information Disclosure Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-2
ution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-20-1376/
CVE ID: CVE-2020-28578 State: PUBLISHED Published: 2020-11-18T18:45:39 Last Updated: 2024-08-04T16:40:59.453Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: Unauthenticated Remote Stack Buffer Overflow Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281954 - https://www.tenable.com/security/research/tra-2020-63
CVE ID: CVE-2020-28579 State: PUBLISHED Published: 2020-11-18T18:45:40 Last Updated: 2024-08-04T16:40:59.158Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: Authenticated Remote Stack Buffer Overflow Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281954 - https://www.tenable.com/security/research/tra-2020-63
CVE ID: CVE-2020-28580 State: PUBLISHED Published: 2020-11-18T18:45:40 Last Updated: 2024-08-04T16:40:59.935Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: Authenticated Command Injection Description: A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281954 - https://www.tenable.com/security/research/tra-2020-63
CVE ID: CVE-2020-28581 State: PUBLISHED Published: 2020-11-18T18:45:41 Last Updated: 2024-08-04T16:40:59.456Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: Authenticated Command Injection Description: A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281954 - https://www.tenable.com/security/research/tra-2020-63
CVE ID: CVE-2020-28582 State: PUBLISHED Published: 2020-12-01T18:40:39 Last Updated: 2024-08-04T16:40:59.354Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan Problem Types: Improper Access Control Information Disclosure Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal number of managed agents. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-20-13
n/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-20-1386/
CVE ID: CVE-2020-28583 State: PUBLISHED Published: 2020-12-01T18:40:39 Last Updated: 2024-08-04T16:40:59.251Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan Problem Types: Improper Access Control Information Disclosure Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version, build and patch information. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisori
.com/solution/000281949 - https://success.trendmicro.com/solution/000281947 - https://www.zerodayinitiative.com/advisories/ZDI-20-1387/
CVE ID: CVE-2020-28587 State: PUBLISHED Published: 2021-02-23T18:11:31 Last Updated: 2024-08-04T16:40:59.084Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Softmaker Problem Types: CWE-122 Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. An attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). Additional Analyst Notes: - CVE Progra
affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210
CVE ID: CVE-2020-28588 State: PUBLISHED Published: 2021-05-10T18:54:40 Last Updated: 2024-08-04T16:40:59.170Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Linux Kernel Problem Types: CWE-681 Description: An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory conten
d. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211
CVE ID: CVE-2020-28589 State: PUBLISHED Published: 2021-08-11T12:37:20 Last Updated: 2024-08-04T16:40:59.534Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: tinyobjloader Problem Types: CWE-129 Description: An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A specially crafted file could lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1212
CVE ID: CVE-2020-28590 State: PUBLISHED Published: 2021-04-13T18:06:48 Last Updated: 2024-08-04T16:40:59.932Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Slic3r Problem Types: CWE-20 Description: An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted obj file could lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1213
CVE ID: CVE-2020-28591 State: PUBLISHED Published: 2021-03-03T17:50:56 Last Updated: 2024-08-04T16:40:59.455Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Slic3r Problem Types: CWE-20 Description: An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1215 - https://lists.fedoraproj
Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1215 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCSYYURJTUKJSEZIPDAXK4NHRXZMHIVA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJPM24DY36EH3HFJGAXDLGFT43VZWLJ7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBEK4H23AS6TKTGU2OTMHAZZYNECQVCB/
CVE ID: CVE-2020-28592 State: PUBLISHED Published: 2021-04-15T13:40:35 Last Updated: 2024-08-04T16:40:59.264Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Cosori Problem Types: CWE-120 Description: A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1216
CVE ID: CVE-2020-28593 State: PUBLISHED Published: 2021-04-15T13:41:22 Last Updated: 2024-08-04T16:40:59.283Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Cosori Problem Types: CWE-912 Description: A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1217
CVE ID: CVE-2020-28594 State: PUBLISHED Published: 2021-08-17T19:15:53 Last Updated: 2024-08-04T16:40:59.436Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Prusa Research Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1218
CVE ID: CVE-2020-28595 State: PUBLISHED Published: 2021-02-10T21:51:37 Last Updated: 2024-08-04T16:40:59.620Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Prusa Research Problem Types: CWE-122 Description: An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted obj file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1219
CVE ID: CVE-2020-28596 State: PUBLISHED Published: 2021-02-10T21:51:30 Last Updated: 2024-08-04T16:40:59.261Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Prusa Research Problem Types: stack-based buffer overflow Description: A stack-based buffer overflow vulnerability exists in the Objparser::objparse() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted obj file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1220
CVE ID: CVE-2020-28597 State: PUBLISHED Published: 2021-03-03T17:47:57 Last Updated: 2024-08-04T16:40:59.576Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Epignosis Problem Types: CWE-337 Description: A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TA
Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221
CVE ID: CVE-2020-28598 State: PUBLISHED Published: 2021-07-08T11:29:57 Last Updated: 2024-08-04T16:40:59.267Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Prusa Research Problem Types: CWE-122 Description: An out-of-bounds write vulnerability exists in the Admesh stl_fix_normal_directions() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted AMF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1222
CVE ID: CVE-2020-28599 State: PUBLISHED Published: 2021-02-24T15:58:26 Last Updated: 2024-08-04T16:40:59.678Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Openscad Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1223 - https://lists.fedoraproject.org/archives/list/package-
s://talosintelligence.com/vulnerability_reports/TALOS-2020-1223 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRHYUWXQ7QQIC6TXDYYLYFFF7B7L3EBD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFXQZK6BAYARVVWBBXDKPVPN3N77PPDX/ - https://security.gentoo.org/glsa/202107-35 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1224
CVE ID: CVE-2020-28600 State: PUBLISHED Published: 2021-05-10T19:18:39 Last Updated: 2024-08-04T16:40:59.592Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Openscad Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1224
CVE ID: CVE-2020-28601 State: PUBLISHED Published: 2021-03-04T00:00:00.000Z Last Updated: 2025-04-23T19:45:02.229Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: CGAL Problem Types: CWE-129 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - http
ainer: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-28602 State: PUBLISHED Published: 2022-04-18T16:55:46.638Z Last Updated: 2025-04-23T18:38:46.786Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CGAL Project Products: libcgal Problem Types: CWE-129 Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_vertex() Halfedge_of[]. Additi
ities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_vertex() Halfedge_of[]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34