Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-27821 State: PUBLISHED Published: 2020-12-08T21:33:02 Last Updated: 2024-08-04T16:25:42.445Z Vendors: n/a Products: QEMU Problem Types: CWE-787 Description: A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1902651 - http://www.openwall.com/lists/oss-secur
m Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1902651 - http://www.openwall.com/lists/oss-security/2020/12/16/6 - https://security.netapp.com/advisory/ntap-20210115-0006/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-27822 State: PUBLISHED Published: 2020-12-08T00:07:18 Last Updated: 2024-08-04T16:25:43.594Z Vendors: n/a Products: wildfly Problem Types: CWE-401 Description: A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1904060
CVE ID: CVE-2020-27823 State: PUBLISHED Published: 2021-05-13T14:03:50 Last Updated: 2024-08-04T16:25:43.670Z Vendors: n/a Products: openjpeg Problem Types: CWE-20 Description: A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lis
ect.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html - https://www.debian.org/security/2021/dsa-4882 - https://bugzilla.redhat.com/show_bug.cgi?id=1905762
CVE ID: CVE-2020-27824 State: PUBLISHED Published: 2021-05-13T13:56:17 Last Updated: 2024-08-04T16:25:43.431Z Vendors: n/a Products: openjpeg Problem Types: CWE-20 Description: A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/ - https://lists.fedoraproject.org/archives/list/package-a
ts.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html - https://www.debian.org/security/2021/dsa-4882 - https://bugzilla.redhat.com/show_bug.cgi?id=1905723 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-27825 State: PUBLISHED Published: 2020-12-11T17:13:31 Last Updated: 2024-08-04T16:25:43.895Z Vendors: n/a Products: kernel Problem Types: CWE-362 Description: A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1905155 - https://www.debian.org/security/2021/dsa-4843 - https
eferences: - https://bugzilla.redhat.com/show_bug.cgi?id=1905155 - https://www.debian.org/security/2021/dsa-4843 - https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - https://security.netapp.com/advisory/ntap-20210521-0008/
CVE ID: CVE-2020-27826 State: PUBLISHED Published: 2021-05-28T10:20:30 Last Updated: 2024-08-04T16:25:43.149Z Vendors: n/a Products: keycloak Problem Types: CWE-250 Description: A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1905089
CVE ID: CVE-2020-27827 State: PUBLISHED Published: 2021-03-18T00:00:00 Last Updated: 2024-08-04T16:25:43.547Z Vendors: n/a Products: lldp/openvswitch Problem Types: CWE-400 Description: A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1921438 - https://mail.openvswitch.org/pipermail/ovs-dev/2021-January/379471.html - https://cert-portal.siemens.com/productcer
8 - https://mail.openvswitch.org/pipermail/ovs-dev/2021-January/379471.html - https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D/ - https://security.gentoo.org/glsa/202311-16
CVE ID: CVE-2020-27828 State: PUBLISHED Published: 2020-12-11T03:07:09 Last Updated: 2024-08-04T16:25:43.579Z Vendors: n/a Products: jasper Problem Types: CWE-20 Description: There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1905201 - https://github.com/jasper-software/jasper/issues/252 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
re/jasper/issues/252 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBZZ2SNTQ4BSA6PNJCTOAKXIAXYNNF6V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COBEVDBUO3QTNR6YQBBTIQKNIB6W3MJ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE ID: CVE-2020-27829 State: PUBLISHED Published: 2021-03-26T16:49:00 Last Updated: 2024-08-04T16:25:43.629Z Vendors: n/a Products: ImageMagick Problem Types: CWE-122 Description: A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1922525 - https://github.com/ImageMagick/ImageMagick/commit/6ee5059cd3ac8d82714a1ab1321399b88539abf0
CVE ID: CVE-2020-27830 State: PUBLISHED Published: 2021-05-13T14:15:34 Last Updated: 2024-08-04T16:25:43.662Z Vendors: n/a Products: kernel Problem Types: CWE-476 Description: A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2020/12/08/1 - http://www.openwall.com/lists/oss-security/2020/12/08/4 - https://www.debian.org/security/2021/dsa-4843 - https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - https://bugzill
debian.org/security/2021/dsa-4843 - https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - https://bugzilla.redhat.com/show_bug.cgi?id=1919900 - https://security.netapp.com/advisory/ntap-20210625-0004/
CVE ID: CVE-2020-27831 State: PUBLISHED Published: 2021-05-26T23:46:57 Last Updated: 2024-08-04T16:25:43.401Z Vendors: n/a Products: quay Problem Types: CWE-284 Description: A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1905758
CVE ID: CVE-2020-27832 State: PUBLISHED Published: 2021-05-27T13:50:39 Last Updated: 2024-08-04T16:25:43.224Z Vendors: n/a Products: quay Problem Types: CWE-79 Description: A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notification. This flaw allows an attacker to trick a user into performing a malicious action to impersonate the target user. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1905784
CVE ID: CVE-2020-27833 State: PUBLISHED Published: 2021-05-14T20:20:45 Last Updated: 2024-08-04T16:25:43.782Z Vendors: n/a Products: openshift/oc Problem Types: CWE-20 Description: A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to the command `oc image extract`. If a symbolic link is first created pointing within the tarball, this allows further symbolic links to bypass the existing path check. This flaw allows the tarball to create links outside the tarball's parent directory, allowing for executables or
check. This flaw allows the tarball to create links outside the tarball's parent directory, allowing for executables or configuration files to be overwritten, resulting in arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions up to and including openshift-clients-4.7.0-202104250659.p0.git.95881af are affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2020-27833 - https://bugzilla.redhat.com/show_bug.cgi?id=1905945
CVE ID: CVE-2020-27834 State: REJECTED Published: N/A Last Updated: 2023-02-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-27835 State: PUBLISHED Published: 2021-01-07T17:24:30 Last Updated: 2024-08-04T16:25:43.607Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1901709
CVE ID: CVE-2020-27836 State: PUBLISHED Published: 2022-08-22T14:43:37 Last Updated: 2024-08-04T16:25:43.135Z Vendors: n/a Products: cluster-ingress-operator Problem Types: CWE-732 Description: A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1906267 - https://bugzilla.redhat.com/show_bug.cgi?
Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1906267 - https://bugzilla.redhat.com/show_bug.cgi?id=1905490 - https://access.redhat.com/security/cve/CVE-2020-27836 - https://github.com/openshift/cluster-ingress-operator/pull/507/commits/92c83f281ba5fb6a1d91ecc3beaa4bcf2647a729
CVE ID: CVE-2020-27837 State: PUBLISHED Published: 2020-12-28T18:34:04 Last Updated: 2024-08-04T16:25:43.322Z Vendors: n/a Products: gdm Problem Types: CWE-362 Description: A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1906812
CVE ID: CVE-2020-27838 State: PUBLISHED Published: 2021-03-08T21:41:27 Last Updated: 2024-08-04T16:25:43.769Z Vendors: n/a Products: keycloak Problem Types: CWE-287 Description: A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1906797
CVE ID: CVE-2020-27839 State: PUBLISHED Published: 2021-05-26T21:25:44 Last Updated: 2024-08-04T16:25:43.403Z Vendors: n/a Products: ceph-dashboard Problem Types: CWE-522 Description: A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1901330
CVE ID: CVE-2020-27840 State: PUBLISHED Published: 2021-05-12T14:06:16 Last Updated: 2024-08-04T16:25:43.194Z Vendors: n/a Products: samba Problem Types: CWE-125 Description: A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20210326-0007/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6P
0210326-0007/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html - https://www.debian.org/security/2021/dsa-4884 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/ - https://bugzilla.redhat.com/show_bug.cgi?id=1941400 - https://www.samba.org/samba/security/CVE-2020-27840.html - https://security.gentoo.org/glsa/202105-22
CVE ID: CVE-2020-27841 State: PUBLISHED Published: 2021-01-05T17:18:51 Last Updated: 2024-08-04T16:25:43.060Z Vendors: n/a Products: openjpeg Problem Types: CWE-122 Description: There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1907510 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MU
//lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://security.gentoo.org/glsa/202101-29 - https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html - https://www.debian.org/security/2021/dsa-4882 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-27842 State: PUBLISHED Published: 2021-01-05T17:21:40 Last Updated: 2024-08-04T16:25:43.575Z Vendors: n/a Products: openjpeg Problem Types: CWE-125 Description: There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1907513 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://security.gent
chives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://security.gentoo.org/glsa/202101-29 - https://www.debian.org/security/2021/dsa-4882 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html
CVE ID: CVE-2020-27843 State: PUBLISHED Published: 2021-01-05T17:22:06 Last Updated: 2024-08-04T16:25:43.322Z Vendors: n/a Products: openjpeg Problem Types: CWE-125 Description: A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1907516 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https:
aproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://security.gentoo.org/glsa/202101-29 - https://www.debian.org/security/2021/dsa-4882 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html
CVE ID: CVE-2020-27844 State: PUBLISHED Published: 2021-01-05T17:43:49 Last Updated: 2024-08-04T16:25:43.677Z Vendors: n/a Products: openjpeg Problem Types: CWE-20 Description: A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1907521 - https://security.gentoo.org/glsa/202101-29 - https://lists.debian.org/debian-lts-anno
dhat.com/show_bug.cgi?id=1907521 - https://security.gentoo.org/glsa/202101-29 - https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-27845 State: PUBLISHED Published: 2021-01-05T17:44:30 Last Updated: 2024-08-04T16:25:43.862Z Vendors: n/a Products: openjpeg Problem Types: CWE-125 Description: There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1907523 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJ
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ - https://security.gentoo.org/glsa/202101-29 - https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html - https://www.debian.org/security/2021/dsa-4882 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-27846 State: PUBLISHED Published: 2020-12-21T15:16:14 Last Updated: 2024-08-04T16:25:43.248Z Vendors: n/a Products: crewjam/saml Problem Types: CWE-115 Description: A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1907670 - https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ - https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9 - https://grafana.
ure-go-xml-vulnerabilities/ - https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9 - https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/ - https://security.netapp.com/advisory/ntap-20210205-0002/
CVE ID: CVE-2020-27847 State: PUBLISHED Published: 2021-05-28T10:20:35 Last Updated: 2024-08-04T16:25:43.583Z Vendors: n/a Products: dexidp/dex Problem Types: CWE-228 Description: A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ - https://bugzilla.redhat.com/show_bug.c
s: - https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ - https://bugzilla.redhat.com/show_bug.cgi?id=1907732 - https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5