deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6012
Published: 2020-08-04
Description: ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. This allows an unprivileged user to enable escalation of privilege via local access.
CVSS Score: 7.4 (HIGH)
CWE: CWE-59, CWE-59
References: https://danishcyberdefence.dk/blog/zonealarm-check-point; https://www.zonealarm.com/anti-ransomware/release-history; https://www.zonealarm.com/software/extreme-security/release-history
CVE: CVE-2020-7822
Published: 2020-08-04
Description: DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://www.hmtalk.com/; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35545; https://www.hmtalk.com/
CVE: CVE-2020-7823
Published: 2020-08-04
Description: DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://www.hmtalk.com/; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35545; https://www.hmtalk.com/
CVE: CVE-2020-4396
Published: 2020-08-04
Description: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179359.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179359; https://www.ibm.com/support/pages/node/6255694; https://exchange.xforce.ibmcloud.com/vulnerabilities/179359
CVE: CVE-2020-4410
Published: 2020-08-04
Description: IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the server that they should not have access to. IBM X-Force ID: 179539.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179539; https://www.ibm.com/support/pages/node/6255694; https://exchange.xforce.ibmcloud.com/vulnerabilities/179539
CVE: CVE-2020-4459
Published: 2020-08-04
Description: IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 181395.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181395; https://www.ibm.com/support/pages/node/6255614; https://exchange.xforce.ibmcloud.com/vulnerabilities/181395
CVE: CVE-2020-4525
Published: 2020-08-04
Description: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182435.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182435; https://www.ibm.com/support/pages/node/6255694; https://exchange.xforce.ibmcloud.com/vulnerabilities/182435
CVE: CVE-2020-4542
Published: 2020-08-04
Description: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 183046.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183046; https://www.ibm.com/support/pages/node/6255694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183046
CVE: CVE-2020-4631
Published: 2020-08-04
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185372; https://www.ibm.com/support/pages/node/6255116; https://exchange.xforce.ibmcloud.com/vulnerabilities/185372
CVE: CVE-2020-13523
Published: 2020-08-04
Description: An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-862
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1122; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1122
CVE: CVE-2020-16134
Published: 2020-08-04
Description: An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.01.20, and Internet Box light prior to 08.06.06. Given the (user-configurable) credentials for the local Web interface or physical access to a device's plus or reset button, an attacker can create a user with elevated privileges on the Sysbus-API. This can then be used to modify local or remote SSH access, thus allowing a login session as the superuser.
CVSS Score: 8.0 (HIGH)
References: https://www.swisscom.ch; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2020-16134.txt; https://www.swisscom.ch
CVE: CVE-2020-16199
Published: 2020-08-04
Description: Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01; https://www.zerodayinitiative.com/advisories/ZDI-20-939/; https://www.zerodayinitiative.com/advisories/ZDI-20-940/
CVE: CVE-2020-16201
Published: 2020-08-04
Description: Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01; https://www.zerodayinitiative.com/advisories/ZDI-20-941/; https://www.zerodayinitiative.com/advisories/ZDI-20-942/
CVE: CVE-2020-16203
Published: 2020-08-04
Description: Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01; https://www.zerodayinitiative.com/advisories/ZDI-20-948/; https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01
CVE: CVE-2020-13522
Published: 2020-08-04
Description: An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1121; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1121
CVE: CVE-2020-15943
Published: 2020-08-04
Description: An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability, an attacker has to be authenticated.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-862
References: http://packetstormsecurity.com/files/158751/Gantt-Chart-For-Jira-5.5.3-Missing-Privilege-Check.html; http://seclists.org/fulldisclosure/2020/Aug/0; https://marketplace.atlassian.com/apps/28997/gantt-chart-for-jira?hosting=cloud&tab=overview
CVE: CVE-2020-15944
Published: 2020-08-04
Description: An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158752/Gantt-Chart-For-Jira-5.5.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2020/Aug/1; https://marketplace.atlassian.com/apps/28997/gantt-chart-for-jira?hosting=cloud&tab=overview
CVE: CVE-2020-15956
Published: 2020-08-04
Description: ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application termination via a malformed payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://packetstormsecurity.com/files/158771/ACTi-NVR3-Standard-Professional-Server-3.0.12.42-Denial-Of-Service.html; https://github.com/megamagnus/cve-2020-15956; https://www2.acti.com/nvr3
CVE: CVE-2020-16843
Published: 2020-08-04
Description: In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial of service on the microVM when it is configured with a single network interface, and an availability problem for the microVM network interface on which the issue is triggered.
CVSS Score: 5.9 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/08/13/1; https://github.com/firecracker-microvm/firecracker/issues/2057; https://www.openwall.com/lists/oss-security/2020/08/13/1
CVE: CVE-2020-15135
Published: 2020-08-04
Description: save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff; https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f; https://www.npmjs.com/package/save-server
CVE: CVE-2020-16847
Published: 2020-08-04
Description: Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.extremenetworks.com/release_notes/netsight/XMC_8.5.0_Release_Notes.pdf; https://gtacknowledge.extremenetworks.com/articles/Solution/000051136; https://documentation.extremenetworks.com/release_notes/netsight/XMC_8.5.0_Release_Notes.pdf
CVE: CVE-2020-15109
Published: 2020-08-04
Description: In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-862
References: https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d; https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph; https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d
CVE: CVE-2017-18112
Published: 2020-08-05
Description: Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jira.atlassian.com/browse/FE-7309; https://jira.atlassian.com/browse/FE-7309
CVE: CVE-2020-13151
Published: 2020-08-05
Description: Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-Command-Execution.html; http://packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-Execution.html; https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html
CVE: CVE-2020-13819
Published: 2020-08-05
Description: Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.extremenetworks.com/release_notes/netsight/XMC_8.5.0_Release_Notes.pdf; https://gtacknowledge.extremenetworks.com; https://gtacknowledge.extremenetworks.com/articles/Solution/000051136
CVE: CVE-2020-13921
Published: 2020-08-05
Description: **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2020/08/05/3; https://github.com/apache/skywalking/pull/4970; https://lists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6%40%3Cdev.skywalking.apache.org%3E
CVE: CVE-2020-14344
Published: 2020-08-05
Description: An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html
CVE: CVE-2020-14347
Published: 2020-08-05
Description: A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665, CWE-665
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00075.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14347
CVE: CVE-2020-16252
Published: 2020-08-05
Description: The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/ankane/field_test; https://github.com/ankane/field_test/issues/28; https://github.com/ankane/field_test
CVE: CVE-2020-16253
Published: 2020-08-05
Description: The PgHero gem through 2.6.0 for Ruby allows CSRF.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/ankane/pghero/; https://github.com/ankane/pghero/issues/330; https://github.com/ankane/pghero/
CVE: CVE-2020-17353
Published: 2020-08-05
Description: scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
CVSS Score: 9.8 (CRITICAL)
References: http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f[PII_REDACTED]c5db05f4074e777c16ff; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.html
CVE: CVE-2020-4243
Published: 2020-08-05
Description: IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle techniques due to not properly invalidating session tokens. IBM X-Force ID: 175420.
CVSS Score: 3.7 (LOW)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175420; https://www.ibm.com/support/pages/node/6255972; https://exchange.xforce.ibmcloud.com/vulnerabilities/175420
CVE: CVE-2020-4481
Published: 2020-08-05
Description: IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181848.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181848; https://www.ibm.com/support/pages/node/6256128; https://exchange.xforce.ibmcloud.com/vulnerabilities/181848
CVE: CVE-2020-5608
Published: 2020-08-05
Description: CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered communication packets via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://jvn.jp/vu/JVNVU97997181/index.html; https://web-material3.yokogawa.com/1/29820/files/YSAR-20-0001-E.pdf; https://jvn.jp/vu/JVNVU97997181/index.html
CVE: CVE-2020-5609
Published: 2020-08-05
Description: Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to create or overwrite arbitrary files and run arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://jvn.jp/vu/JVNVU97997181/index.html; https://web-material3.yokogawa.com/1/29820/files/YSAR-20-0001-E.pdf; https://jvn.jp/vu/JVNVU97997181/index.html
CVE: CVE-2020-8607
Published: 2020-08-05
Description: An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://jvn.jp/en/vu/JVNVU99160193/index.html; https://jvn.jp/vu/JVNVU99160193/; https://success.trendmicro.com/jp/solution/000260748
CVE: CVE-2020-17364
Published: 2020-08-05
Description: USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/usvn/usvn/compare/1.0.8...1.0.9; https://sysdream.com/news/lab/; https://github.com/usvn/usvn/compare/1.0.8...1.0.9
CVE: CVE-2020-16192
Published: 2020-08-05
Description: LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/pull/1479/commits/4109a8d157e46c48ca34b995ef61a6e0f6905236; https://github.com/LimeSurvey/LimeSurvey/pull/1479/commits/4109a8d157e46c48ca34b995ef61a6e0f6905236
CVE: CVE-2020-15106
Published: 2020-08-05
Description: In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/; https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
CVE: CVE-2020-15112
Published: 2020-08-05
Description: In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-129
References: https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/; https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93