Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8595 State: PUBLISHED Published: 2020-02-12T14:10:15 Last Updated: 2024-08-04T10:03:45.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/istio/istio/commits/master - https://is
itional Analyst Notes: - CVE Program Container: References: - https://github.com/istio/istio/commits/master - https://istio.io/news/security/ - https://access.redhat.com/errata/RHSA-2020:0477 - https://access.redhat.com/security/cve/cve-2020-8595 - https://istio.io/news/security/istio-security-2020-001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8595
CVE ID: CVE-2020-8596 State: PUBLISHED Published: 2020-02-10T21:37:28 Last Updated: 2024-08-04T10:03:46.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met). Additional Analyst Notes: - CVE Program Container: References: - https://blog.impenetrable.tech/cve-2020-8596 - https://wpvulndb.com/vulnerabilities/10068
CVE ID: CVE-2020-8597 State: PUBLISHED Published: 2020-02-03T22:58:21 Last Updated: 2024-08-04T10:03:46.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426 - https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html - https://www.debian.org/security/2020/dsa-4632 - https://access.redhat.com/errata/RHSA-2020:0631 - https://access.redhat.com/errata/RHSA-2020:0634 - https://access.redhat.com/errata/RHSA-2020:06
/errata/RHSA-2020:0631 - https://access.redhat.com/errata/RHSA-2020:0634 - https://access.redhat.com/errata/RHSA-2020:0633 - https://access.redhat.com/errata/RHSA-2020:0630 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00006.html - https://usn.ubuntu.com/4288-1/ - https://www.kb.cert.org/vuls/id/782301 - http://seclists.org/fulldisclosure/2020/Mar/6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNJNHWOO4XF73M2W56ILZUY4JQG3JXIR/ - http://packetstormsecurity.com/files/156662/pppd-2.4.8-Buffer-Overflow.html - https://www.synology.com/security/advisory/Synology_SA_20_02 - https://lists.fedoraproject.org/archives/list/packag
ml - https://www.synology.com/security/advisory/Synology_SA_20_02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOFDAIOWSWPG732ASYUZNINMXDHY4APE/ - https://security.netapp.com/advisory/ntap-20200313-0004/ - https://security.gentoo.org/glsa/202003-19 - https://usn.ubuntu.com/4288-2/ - http://packetstormsecurity.com/files/156802/pppd-2.4.8-Buffer-Overflow.html - https://kb.netgear.com/000061806/Security-Advisory-for-Unauthenticated-Remote-Buffer-Overflow-Attack-in-PPPD-on-WAC510-PSV-2020-0136 - https://cert-portal.siemens.com/productcert/pdf/ssa-809841.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-224-04
CVE ID: CVE-2020-8598 State: PUBLISHED Published: 2020-03-18T00:30:44 Last Updated: 2024-08-04T10:03:45.801Z Vendors: Trend Micro Products: Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) Problem Types: Directory Traversal Description: Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a remote attacker to execute arbitrary code on affected installations with SYSTEM level privileges. Authentication is not required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solu
this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000245571 - https://success.trendmicro.com/jp/solution/000244253 - https://success.trendmicro.com/solution/000245572 - https://success.trendmicro.com/jp/solution/000244836
CVE ID: CVE-2020-8599 State: PUBLISHED Published: 2020-03-18T00:30:44.000Z Last Updated: 2025-10-21T23:35:47.710Z Vendors: Trend Micro Products: Trend Micro OfficeScan, Trend Micro Apex One Problem Types: Arbitrary File Upload Directory Traversal Description: Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000245571 - https://success.trendmic
ner: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000245571 - https://success.trendmicro.com/jp/solution/000244253
CVE ID: CVE-2020-8600 State: PUBLISHED Published: 2020-03-18T00:30:45 Last Updated: 2024-08-04T10:03:46.241Z Vendors: Trend Micro Products: Trend Micro Worry-Free Business Security (WFBS) Problem Types: Directory Traversal Auth Bypass Description: Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key file to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-307/ - https://success.trendmicro.com/solution/000245572 - https://success.trendmicro.com/jp/solution/000244836
CVE ID: CVE-2020-8601 State: PUBLISHED Published: 2020-02-20T22:50:23 Last Updated: 2024-08-04T10:03:46.282Z Vendors: Trend Micro Products: Trend Micro Vulnerability Protection Problem Types: DLL Side-Load Description: Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located in the same directory. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000241963
CVE ID: CVE-2020-8602 State: PUBLISHED Published: 2020-08-27T20:35:19 Last Updated: 2024-08-04T10:03:46.269Z Vendors: Trend Micro Products: Trend Micro Deep Security, Trend Micro Vulnerability Management Problem Types: Integrity Verification Bypass Description: A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow an authenticated attacker with full control privileges to bypass file integrity checks, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000252039
CVE ID: CVE-2020-8603 State: PUBLISHED Published: 2020-05-27T22:45:21 Last Updated: 2024-08-04T10:03:46.332Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: XSS Description: A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-675/ - https://success.trendmicro.c
Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-675/ - https://success.trendmicro.com/solution/000253095
CVE ID: CVE-2020-8604 State: PUBLISHED Published: 2020-05-27T22:45:22 Last Updated: 2024-08-04T10:03:46.361Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: Information Disclosure Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-678/ - https://success.trendmicro.com/solution/000253095 - http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html -
5 - http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html
CVE ID: CVE-2020-8605 State: PUBLISHED Published: 2020-05-27T22:45:22 Last Updated: 2024-08-04T10:03:46.260Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: RCE Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-676/ - https://success.trendmicro.com/solution/000253095 - http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Applianc
rendmicro.com/solution/000253095 - http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html
CVE ID: CVE-2020-8606 State: PUBLISHED Published: 2020-05-27T22:45:23 Last Updated: 2024-08-04T10:03:46.240Z Vendors: Trend Micro Products: Trend Micro InterScan Web Security Virtual Appliance Problem Types: Authentication Bypass Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-677/ - https://success.trendmicro.com/solution/000253095 - http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-V
tps://success.trendmicro.com/solution/000253095 - http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html
CVE ID: CVE-2020-8607 State: PUBLISHED Published: 2020-08-05T14:05:23 Last Updated: 2024-08-04T10:03:46.363Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Deep Security, Trend Micro Worry-Free Business Security, Trend Micro Security (Consumer Family), Trend Micro Safe Lock, Trend Micro ServerProtect, Trend Micro Portable Security, Trend Micro HouseCall, Trend Micro Anti-Threat Toolkit (ATTK), Trend Micro Rootkit Buster Problem Types: Improper Input Validation Description: An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode
cro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000260713 - https://success.trendmicro.com/jp/solution/000260748 - https://jvn.jp/vu/JVNVU99160193/ - https://jvn.jp/en/vu/JVNVU99160193/index
ccess.trendmicro.com/jp/solution/000260748 - https://jvn.jp/vu/JVNVU99160193/ - https://jvn.jp/en/vu/JVNVU99160193/index.html
CVE ID: CVE-2020-8608 State: PUBLISHED Published: 2020-02-06T16:45:25 Last Updated: 2024-08-04T10:03:46.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/slirp/libslirp/commit/68ccb8021a838066f0951d4b2817eb6b6f10a843 - https://www.openwall.com/lists/oss-security/2020/02/06/2 - https://gitlab.freedesktop.org/slirp/libslirp/-/tags/v4.1.0 - https://usn.ubuntu.com/4283-1/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00015.html - https://lists.debia
ttps://usn.ubuntu.com/4283-1/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00017.html - https://security.gentoo.org/glsa/202003-66 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html - https://www.debian.org/security/2020/dsa-4733 - https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html - https://security.netapp.com/advisory/ntap-20201001-0002/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00012.html
CVE ID: CVE-2020-8611 State: PUBLISHED Published: 2020-02-14T17:59:01 Last Updated: 2024-08-04T10:03:46.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements.
structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm - https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020 - https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm - https://status.moveitcloud.com/
CVE ID: CVE-2020-8612 State: PUBLISHED Published: 2020-02-14T18:02:08 Last Updated: 2024-08-04T10:03:46.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm - https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020 - https://docs.ipswitch.com/MOVEit/Transfe
nity.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020 - https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm - https://status.moveitcloud.com/
CVE ID: CVE-2020-8614 State: PUBLISHED Published: 2020-02-13T15:23:04 Last Updated: 2024-08-04T10:03:46.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted network packer to the bd_svr service listening on TCP port 54188. Additional Analyst Notes: - CVE Program Container: References: - https://improsec.com/tech-blog/RCE-Askey
CVE ID: CVE-2020-8615 State: PUBLISHED Published: 2020-02-04T19:01:06 Last Updated: 2024-08-04T10:03:46.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors). Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10058 - https://www.themeum.com/tutor-lms-updated-v1-5-3/ - https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/ - https://www.jinsonvarghese.com/cross-site-request-for
1/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/ - https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/ - http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-8616 State: PUBLISHED Published: 2020-05-19T14:05:15.798991Z Last Updated: 2024-09-16T23:55:28.601Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In order for a server performing recursion to locate records in the DNS graph it must be capable of processing referrals, such as those received when it attempts to query an authoritative server for a record which is delegated elsewhere. In its original design BIND (as well as other nameservers) does not sufficiently limit the number of fetches which may be performed while processing a referral response. BIND 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.1
hich may be performed while processing a referral response. BIND 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1. Description: A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential e
server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8616 - http://www.nxnsattack.com - http://www.openwall.com/lists/oss-security/2020/05/19/4 - https://www.debian.org/security/2020/dsa-4689 - https://security.netapp.com/advisory/ntap-20200522-0002/ - https
/19/4 - https://www.debian.org/security/2020/dsa-4689 - https://security.netapp.com/advisory/ntap-20200522-0002/ - https://usn.ubuntu.com/4365-2/ - https://www.synology.com/security/advisory/Synology_SA_20_12 - https://usn.ubuntu.com/4365-1/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-
ttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8617 State: PUBLISHED Published: 2020-05-19T14:05:16.241486Z Last Updated: 2024-09-16T20:26:32.566Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: An error in BIND code which checks the validity of messages containing TSIG resource records can be exploited by an attacker to trigger an assertion failure in tsig.c, resulting in denial of service to clients. BIND 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Previ
evelopment branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1. Description: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to
rom March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8617 - http://www.openwall.com/lists/oss-security/2020/05/19/4 - https://www.debian.org/security/2020/dsa-4689 - https://security.netapp.com/advisory/ntap-20200522-0002/ - http://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html - https://usn.ubuntu.com/4365-2/ - https://usn.ubuntu.com/4365-1/ - https://lists.debian.org/debian-lts-ann
Service.html - https://usn.ubuntu.com/4365-2/ - https://usn.ubuntu.com/4365-1/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8618 State: PUBLISHED Published: 2020-06-17T21:20:13.188206Z Last Updated: 2024-09-16T23:36:09.070Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: An assertion check in BIND (that is meant to prevent going beyond the end of a buffer when processing incoming data) can be incorrectly triggered by a large response during zone transfer. Versions affected: BIND 9.16.0 -> 9.16.3 Description: An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients. Additional Analyst N
onally trigger the assertion failure with a specially constructed zone, denying service to clients. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8618 - https://security.netapp.com/advisory/ntap-20200625-0003/ - https://usn.ubuntu.com/4399-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html