Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-36379 State: PUBLISHED Published: 2021-10-31T19:51:58 Last Updated: 2024-08-04T17:23:10.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shenzhim/aaptjs/issues/2
CVE ID: CVE-2020-36380 State: PUBLISHED Published: 2021-10-31T19:51:57 Last Updated: 2024-08-04T17:23:10.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shenzhim/aaptjs/issues/2
CVE ID: CVE-2020-36381 State: PUBLISHED Published: 2021-10-31T19:51:58 Last Updated: 2024-08-04T17:23:10.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shenzhim/aaptjs/issues/2
CVE ID: CVE-2020-36382 State: PUBLISHED Published: 2021-06-04T10:47:15 Last Updated: 2024-08-04T17:23:10.453Z Vendors: n/a Products: OpenVPN Access Server Problem Types: CWE-754 Description: OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-server-resources/release-notes/ - https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/
CVE ID: CVE-2020-36383 State: PUBLISHED Published: 2021-06-07T10:19:38 Last Updated: 2024-08-04T17:23:10.499Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: PageLayer before 1.3.5 allows reflected XSS via the font-size parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-affects-over-200000-wordpress-sites/
CVE ID: CVE-2020-36384 State: PUBLISHED Published: 2021-06-07T10:19:27 Last Updated: 2024-08-04T17:23:10.531Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: PageLayer before 1.3.5 allows reflected XSS via color settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-affects-over-200000-wordpress-sites/
CVE ID: CVE-2020-36385 State: PUBLISHED Published: 2021-06-07T00:00:00 Last Updated: 2024-08-04T17:23:10.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c. Additional Analyst Notes: - CVE Program Container: References: - https://syzkaller.appspot.com/bug?id=457491c4672d7b52c1007db213d93e47c711fae6 - https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-ucma_close-2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi
w/syzscope/kasan-use-after-free-read-in-ucma_close-2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5449e74802c1112dea984aec8af7a33c4516af1 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10 - https://security.netapp.com/advisory/ntap-20210720-0004/ - https://www.starwindsoftware.com/security/sw-20220802-0002/
CVE ID: CVE-2020-36386 State: PUBLISHED Published: 2021-06-07T19:20:02 Last Updated: 2024-08-04T17:23:10.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.1 - https://syzkaller.appspot.com/text?tag=ReproC&x=15ca2f46900000 - https://sites.google.com/view/syzscope/kasan-slab-out-of-bounds-read-in-hci_extended_inquiry_result_evt - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin
lab-out-of-bounds-read-in-hci_extended_inquiry_result_evt - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51c19bf3d5cfaa66571e4b88ba2a6f6295311101 - https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8d2
CVE ID: CVE-2020-36387 State: PUBLISHED Published: 2021-06-07T19:19:39 Last Updated: 2024-08-04T17:23:10.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.2 - https://syzkaller.appspot.com/bug?id=ce5f07d6ec3b5050b8f0728a3b389aa510f2591b - https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-io_async_task_func - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
yzscope/kasan-use-after-free-read-in-io_async_task_func - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d816e088c359866f9867057e04f244c608c42fe - https://security.netapp.com/advisory/ntap-20210727-0006/
CVE ID: CVE-2020-36388 State: PUBLISHED Published: 2021-06-17T00:00:00 Last Updated: 2024-08-04T17:23:10.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive. Additional Analyst Notes: - CVE Program Container: References: - https://civicrm.org/advisory/civi-sa-2020-03 - https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/
CVE ID: CVE-2020-36389 State: PUBLISHED Published: 2021-06-17T00:00:00 Last Updated: 2024-08-04T17:23:10.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-form - https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/
CVE ID: CVE-2020-36394 State: PUBLISHED Published: 2021-06-22T20:43:26 Last Updated: 2024-08-04T17:23:10.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesystem, in certain situations where the attacker's home directory is a FUSE filesystem mounted under /home. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2020/q2/169
CVE ID: CVE-2020-36395 State: PUBLISHED Published: 2021-07-02T17:51:26 Last Updated: 2024-08-04T17:23:10.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LavaLite/cms/issues/321
CVE ID: CVE-2020-36396 State: PUBLISHED Published: 2021-07-02T17:51:28 Last Updated: 2024-08-04T17:23:10.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LavaLite/cms/issues/322
CVE ID: CVE-2020-36397 State: PUBLISHED Published: 2021-07-02T17:51:29 Last Updated: 2024-08-04T17:23:10.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LavaLite/cms/issues/323
CVE ID: CVE-2020-36398 State: PUBLISHED Published: 2021-07-02T17:51:30 Last Updated: 2024-08-04T17:23:10.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpList/phplist3/issues/676
CVE ID: CVE-2020-36399 State: PUBLISHED Published: 2021-07-02T17:51:32 Last Updated: 2024-08-04T17:23:10.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpList/phplist3/issues/675
CVE ID: CVE-2020-36400 State: PUBLISHED Published: 2021-07-01T02:50:56 Last Updated: 2024-08-04T17:23:10.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml - https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306
CVE ID: CVE-2020-36401 State: PUBLISHED Published: 2021-07-01T02:51:06 Last Updated: 2024-08-04T17:23:10.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015503 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744.yaml
CVE ID: CVE-2020-36402 State: PUBLISHED Published: 2021-07-01T02:51:21 Last Updated: 2024-08-04T17:23:10.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the OSV "fixed" field but does not have a code change. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/solidity/OSV-2020-2131.yaml - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26997 - https://github.com/ethereum/solidity/commit/c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e
CVE ID: CVE-2020-36403 State: PUBLISHED Published: 2021-07-01T02:51:43 Last Updated: 2024-08-04T17:23:10.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097 - https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yaml - https://github.com/samtools/htslib/pull/1447
CVE ID: CVE-2020-36404 State: PUBLISHED Published: 2021-07-01T02:52:05 Last Updated: 2024-08-04T17:23:10.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-1506.yaml - https://github.com/keystone-engine/keystone/releases
CVE ID: CVE-2020-36405 State: PUBLISHED Published: 2021-07-01T02:52:16 Last Updated: 2024-08-04T17:23:10.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keystone-engine/keystone/releases - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22850 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-789.yaml
CVE ID: CVE-2020-36406 State: PUBLISHED Published: 2021-07-01T02:52:36 Last Updated: 2024-08-04T17:23:10.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's position is that this is "a minor issue or not even an issue at all" because the developer of an application (that uses uWebSockets) should not be allowing the large number of triggered topics to accumulate Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yaml - https://bu
iner: References: - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yaml - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381 - https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759
CVE ID: CVE-2020-36407 State: PUBLISHED Published: 2021-07-01T02:53:11 Last Updated: 2024-08-04T17:23:10.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AOMediaCodec/libavif/commit/0a8e7244d494ae98e9756355dfbfb6697ded2ff9 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24811 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libavif/OSV-2020-1597.yaml
CVE ID: CVE-2020-36408 State: PUBLISHED Published: 2021-07-02T17:51:33 Last Updated: 2024-08-04T17:23:10.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36409 State: PUBLISHED Published: 2021-07-02T17:51:34 Last Updated: 2024-08-04T17:23:10.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36410 State: PUBLISHED Published: 2021-07-02T17:51:36 Last Updated: 2024-08-04T17:23:10.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36411 State: PUBLISHED Published: 2021-07-02T17:51:38 Last Updated: 2024-08-04T17:23:10.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36412 State: PUBLISHED Published: 2021-07-02T17:51:40 Last Updated: 2024-08-04T17:30:07.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36413 State: PUBLISHED Published: 2021-07-02T17:51:54 Last Updated: 2024-08-04T17:30:06.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36414 State: PUBLISHED Published: 2021-07-02T17:51:56 Last Updated: 2024-08-04T17:30:06.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36415 State: PUBLISHED Published: 2021-07-02T17:51:58 Last Updated: 2024-08-04T17:30:06.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36416 State: PUBLISHED Published: 2021-07-02T17:52:00 Last Updated: 2024-08-04T17:30:06.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12325
CVE ID: CVE-2020-36420 State: PUBLISHED Published: 2021-07-14T23:23:21 Last Updated: 2024-08-04T17:30:06.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/11/18/1 - https://bugs.gentoo.org/755896 - https://github.com/jech/polipo/commit/4d42ca1b5849518762d110f34b6ce2e03d6df9ec - http://www.openwall.com/lists/oss
896 - https://github.com/jech/polipo/commit/4d42ca1b5849518762d110f34b6ce2e03d6df9ec - http://www.openwall.com/lists/oss-security/2021/07/18/1
CVE ID: CVE-2020-36421 State: PUBLISHED Published: 2021-07-19T00:00:00 Last Updated: 2024-08-04T17:30:06.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arm Mbed TLS before 2.23.0. Because of a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.7 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.23.0 - https://github.com/ARMmbed/mbedtls/issues/3394 - https://bugs.gentoo.org/730752 - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36422 State: PUBLISHED Published: 2021-07-19T00:00:00 Last Updated: 2024-08-04T17:30:06.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arm Mbed TLS before 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.7 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.23.0 - https://bugs.gentoo.org/730752 - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36423 State: PUBLISHED Published: 2021-07-19T00:00:00 Last Updated: 2024-08-04T17:30:07.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.7 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.23.0 - https://bugs.gentoo.org/730752 - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36424 State: PUBLISHED Published: 2021-07-19T00:00:00 Last Updated: 2024-08-04T17:30:07.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack against generation of base blinding/unblinding values. Additional Analyst Notes: - CVE Program Container: References: - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 - https://github.com/ARMmbed/mbedtls/releases/tag/v
ag/v2.7.17 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 - https://bugs.gentoo.org/740108 - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-36425 State: PUBLISHED Published: 2021-07-19T00:00:00 Last Updated: 2024-08-04T17:30:06.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 - https://bugs.gentoo.org/740108 - https://github.com