Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-27716 State: PUBLISHED Published: 2020-12-24T15:06:46 Last Updated: 2024-08-04T16:18:45.546Z Vendors: n/a Products: BIG-IP APM Problem Types: DoS Description: On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K51574311
CVE ID: CVE-2020-27717 State: PUBLISHED Published: 2020-12-24T15:11:59 Last Updated: 2024-08-04T16:18:45.542Z Vendors: n/a Products: BIG-IP DNS Problem Types: DoS Description: On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may cause TMM to restart and generate a core file. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43850230
CVE ID: CVE-2020-27718 State: PUBLISHED Published: 2020-12-24T14:57:33 Last Updated: 2024-08-04T16:18:45.680Z Vendors: n/a Products: BIG-IP ASM & Advanced WAF Problem Types: DoS Description: When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K58102101
CVE ID: CVE-2020-27719 State: PUBLISHED Published: 2020-12-24T15:16:36 Last Updated: 2024-08-04T16:18:45.657Z Vendors: n/a Products: BIG-IP Problem Types: XSS Description: On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K19166530
CVE ID: CVE-2020-27720 State: PUBLISHED Published: 2020-12-24T15:15:03 Last Updated: 2024-08-04T16:18:45.659Z Vendors: n/a Products: BIG-IP LTM/CGNAT Problem Types: DoS Description: On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Block Allocation (PBA) mode and SP-DAG enabled, and dag-ipv6-prefix-len configured with a value less than the default of 128, an undisclosed traffic pattern may cause the Traffic Management Microkernel (TMM) to restart. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04048104
CVE ID: CVE-2020-27721 State: PUBLISHED Published: 2020-12-24T14:52:59 Last Updated: 2024-08-04T16:18:45.676Z Vendors: n/a Products: BIG-IP GTM & DNS Problem Types: DoS Description: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K52035247
CVE ID: CVE-2020-27722 State: PUBLISHED Published: 2020-12-24T15:13:24 Last Updated: 2024-08-04T16:18:45.602Z Vendors: n/a Products: BIG-IP APM Problem Types: DoS Description: In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K73657294
CVE ID: CVE-2020-27723 State: PUBLISHED Published: 2020-12-24T15:09:19 Last Updated: 2024-08-04T16:18:45.561Z Vendors: n/a Products: BIG-IP APM Problem Types: DoS Description: In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the Traffic Management Microkernel (TMM) process. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K42933418
CVE ID: CVE-2020-27724 State: PUBLISHED Published: 2020-12-24T15:00:27 Last Updated: 2024-08-04T16:18:45.540Z Vendors: n/a Products: BIG-IP APM Problem Types: DoS Description: In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic over the tunnel. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K04518313
CVE ID: CVE-2020-27725 State: PUBLISHED Published: 2020-12-24T15:01:46 Last Updated: 2024-08-04T16:18:45.663Z Vendors: n/a Products: BIG-IP DNS, GTM, and Link Controller Problem Types: DoS Description: In version 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 of BIG-IP DNS, GTM, and Link Controller, zxfrd leaks memory when listing DNS zones. Zones can be listed via TMSH, iControl or SNMP; only users with access to those services can trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K25595031
CVE ID: CVE-2020-27726 State: PUBLISHED Published: 2020-12-24T15:05:03 Last Updated: 2024-08-04T16:18:45.873Z Vendors: n/a Products: BIG-IP APM Problem Types: XSS Description: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K30343902
CVE ID: CVE-2020-27727 State: PUBLISHED Published: 2020-12-24T15:03:09 Last Updated: 2024-08-04T16:18:45.668Z Vendors: n/a Products: BIG-IP Problem Types: Information disclosure Description: On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K50343630
CVE ID: CVE-2020-27728 State: PUBLISHED Published: 2020-12-24T15:33:32 Last Updated: 2024-08-04T16:18:45.524Z Vendors: n/a Products: BIG-IP ASM & Advanced WAF Problem Types: DoS Description: On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, and Reporting daemon (AVRD) may generate a core file and restart on the BIG-IP system when processing requests sent from mobile devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K45143221
CVE ID: CVE-2020-27729 State: PUBLISHED Published: 2020-12-24T15:17:55 Last Updated: 2024-08-04T16:18:45.570Z Vendors: n/a Products: BIG-IP APM Problem Types: Malicious redirect Description: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K15310332
CVE ID: CVE-2020-27730 State: PUBLISHED Published: 2020-12-11T19:03:21 Last Updated: 2024-08-04T16:18:45.601Z Vendors: n/a Products: NGINX Controller Problem Types: privilege escalation Description: In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K43530108 - https://security.netapp.com/advisory/ntap-20210115-0004/
CVE ID: CVE-2020-27731 State: REJECTED Published: 2022-07-07T19:44:57 Last Updated: 2022-07-07T19:44:57 Description: No description available.
CVE ID: CVE-2020-27732 State: REJECTED Published: 2022-07-07T19:45:02 Last Updated: 2022-07-07T19:45:02 Description: No description available.
CVE ID: CVE-2020-27733 State: PUBLISHED Published: 2021-01-19T15:53:26 Last Updated: 2024-08-04T16:18:45.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/issues.html#v14880 - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-27733.html
CVE ID: CVE-2020-27735 State: PUBLISHED Published: 2021-01-20T22:56:37 Last Updated: 2024-08-04T16:18:45.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.wftpserver.com/serverhistory.htm - https://wshenk.blogspot.com/2021/01/xss-in-wing-ftps-web-interface-cve-2020.html
CVE ID: CVE-2020-27736 State: PUBLISHED Published: 2021-04-22T20:42:19 Last Updated: 2024-08-04T16:18:45.573Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Nucleus NET, Nucleus ReadyStart V3, Nucleus ReadyStart V4, Nucleus Source Code, SIMOTICS CONNECT 400, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-170 Description: A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P
APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malf
me label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
CVE ID: CVE-2020-27737 State: PUBLISHED Published: 2021-04-22T20:42:19 Last Updated: 2024-08-04T16:18:45.586Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Nucleus NET, Nucleus ReadyStart V3, Nucleus ReadyStart V4, Nucleus Source Code, SIMOTICS CONNECT 400, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-125 Description: A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P
APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed resp
parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the memory past the allocated structure. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
CVE ID: CVE-2020-27738 State: PUBLISHED Published: 2021-04-22T20:42:20 Last Updated: 2024-08-04T16:18:45.774Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Nucleus NET, Nucleus ReadyStart V3, Nucleus ReadyStart V4, Nucleus Source Code, SIMOTICS CONNECT 400, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-788 Description: A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P
APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed res
me record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
CVE ID: CVE-2020-27739 State: PUBLISHED Published: 2020-10-28T18:44:39 Last Updated: 2024-08-04T16:18:45.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread. Additional Analyst Notes: - CVE Program Container: References: - https://www.citadel.org/ - http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE ID: CVE-2020-27740 State: PUBLISHED Published: 2020-10-28T18:44:30 Last Updated: 2024-08-04T16:18:45.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread. Additional Analyst Notes: - CVE Program Container: References: - https://www.citadel.org/ - http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE ID: CVE-2020-27741 State: PUBLISHED Published: 2020-10-28T18:44:34 Last Updated: 2024-08-04T16:18:45.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread. Additional Analyst Notes: - CVE Program Container: References: - https://www.citadel.org/ - http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE ID: CVE-2020-27742 State: PUBLISHED Published: 2020-10-28T18:44:36 Last Updated: 2024-08-04T16:18:45.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread. Additional Analyst Notes: - CVE Program Container: References: - https://www.citadel.org/ - http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE ID: CVE-2020-27743 State: PUBLISHED Published: 2020-10-26T21:40:19 Last Updated: 2024-08-04T16:18:45.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kravietz/pam_tacplus/pull/163 - https://tools.ietf.org/html/rfc8907
CVE ID: CVE-2020-27744 State: PUBLISHED Published: 2020-10-29T16:14:43 Last Updated: 2024-08-04T16:18:45.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 - https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
CVE ID: CVE-2020-27745 State: PUBLISHED Published: 2020-11-27T17:01:00 Last Updated: 2024-08-04T16:18:45.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://www.debian.org/security/2021/dsa-4841 - https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html
CVE ID: CVE-2020-27746 State: PUBLISHED Published: 2020-11-27T17:03:03 Last Updated: 2024-08-04T16:18:45.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://www.debian.org/security/2021/dsa-4841
CVE ID: CVE-2020-27747 State: PUBLISHED Published: 2020-10-29T17:26:05 Last Updated: 2024-08-04T16:18:45.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator (4 digits), a remote attacker has the opportunity to conduct a brute force attack on this PIN code. As result, remote attacker retrieves all passwords from another systems, available for affected account. Additional Analyst Notes: - CVE Program Container: References: - https://www.clickstudios.com.au/ - https://github.com/jet-pentest/CV
alyst Notes: - CVE Program Container: References: - https://www.clickstudios.com.au/ - https://github.com/jet-pentest/CVE-2020-27747
CVE ID: CVE-2020-27748 State: PUBLISHED Published: 2021-06-01T13:15:11 Last Updated: 2024-08-04T16:18:45.682Z Vendors: n/a Products: xdg-utils Problem Types: CWE-201 Description: A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-emai
s could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1899769 - https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177
CVE ID: CVE-2020-27749 State: PUBLISHED Published: 2021-03-03T16:40:30 Last Updated: 2024-08-04T16:18:45.656Z Vendors: n/a Products: grub2 Problem Types: CWE-121 Description: A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from thi
t the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1899966 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/ - https://security.gentoo.org/glsa/202104-05 - https://security.netapp.com/advisory/ntap-20220325-0001/
CVE ID: CVE-2020-27750 State: PUBLISHED Published: 2020-12-08T00:00:00 Last Updated: 2024-08-04T16:18:45.842Z Vendors: n/a Products: ImageMagick Problem Types: CWE-369 Description: A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68. Additional Analyst Notes: -
ms related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1891984 - https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html - https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html