deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8339
Published: 2020-09-15
Description: A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to version 3.68n [BPET68N]. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a malicious web site, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the malicious web site. Impact is limited to the normal access restrictions of the user visiting the malicious web site, and subject to the user being logged into AMM, being able to connect to both AMM and the malicious web site while the web browser is open, and using a web browser that does not inherently protect against this class of attack. The JavaScript code is not executed on AMM itself.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522, CWE-79
References: https://support.lenovo.com/us/en/product_security/LEN-38385; https://support.lenovo.com/us/en/product_security/LEN-38385
CVE: CVE-2020-8340
Published: 2020-09-15
Description: A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, embedded Baseboard Management Controller (BMC) web interface during an internal security review. This vulnerability could allow JavaScript code to be executed in the user's web browser if the user is convinced to visit a crafted URL, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the crafted URL. Impact is limited to the normal access restrictions and permissions of the user clicking the crafted URL, and subject to the user being able to connect to and already being authenticated to IMM2 or other systems. The JavaScript code is not executed on IMM2 itself.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.lenovo.com/us/en/product_security/LEN-44717; https://support.lenovo.com/us/en/product_security/LEN-44717
CVE: CVE-2020-8342
Published: 2020-09-15
Description: A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.
CVSS Score: 7.3 (HIGH)
CWE: CWE-367, CWE-362
References: https://support.lenovo.com/us/en/product_security/LEN-42150; https://support.lenovo.com/us/en/product_security/LEN-42150
CVE: CVE-2020-8346
Published: 2020-09-15
Description: A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.1.19.5 that could allow configuration files to be written to non-standard locations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-38717; https://support.lenovo.com/us/en/product_security/LEN-38717
CVE: CVE-2020-15178
Published: 2020-09-15
Description: In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/PrestaShop/contactform/commit/ecd9f5d14920ec00885766a7cb41bcc5ed8bfa09; https://github.com/PrestaShop/contactform/security/advisories/GHSA-95hx-62rh-gg96; https://packagist.org/packages/prestashop/contactform
CVE: CVE-2020-15179
Published: 2020-09-15
Description: The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/InternationalScratchWiki/wiki-scratchsig/commit/4160a39a20eebeb63a59eb7597a91b961eca6388; https://github.com/InternationalScratchWiki/wiki-scratchsig/security/advisories/GHSA-gp9v-pg9f-vmp6; https://github.com/InternationalScratchWiki/wiki-scratchsig/commit/4160a39a20eebeb63a59eb7597a91b961eca6388
CVE: CVE-2020-25071
Published: 2020-09-15
Description: Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created, but the alert won't be executed as those attributes are now stripped.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8648d7; https://niftypm.com/security; https://medium.com/%40muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8648d7
CVE: CVE-2020-10759
Published: 2020-09-15
Description: A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://bugzilla.redhat.com/show_bug.cgi?id=1844316; https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.md; https://bugzilla.redhat.com/show_bug.cgi?id=1844316
CVE: CVE-2020-14331
Published: 2020-09-15
Description: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1858679; https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
CVE: CVE-2020-14346
Published: 2020-09-15
Description: A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access of memory contents. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191, CWE-191
References: https://bugzilla.redhat.com/show_bug.cgi?id=1862246; https://lists.x.org/archives/xorg-announce/2020-August/003058.html; https://security.gentoo.org/glsa/202012-01
CVE: CVE-2020-14361
Published: 2020-09-15
Description: A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191, CWE-191
References: https://bugzilla.redhat.com/show_bug.cgi?id=1869142; https://lists.x.org/archives/xorg-announce/2020-August/003058.html; https://security.gentoo.org/glsa/202012-01
CVE: CVE-2020-14362
Published: 2020-09-15
Description: A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191, CWE-191
References: https://bugzilla.redhat.com/show_bug.cgi?id=1869144; https://lists.x.org/archives/xorg-announce/2020-August/003058.html; https://security.gentoo.org/glsa/202012-01
CVE: CVE-2020-15148
Published: 2020-09-15
Description: Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
CVSS Score: 8.9 (HIGH)
CWE: CWE-502
References: https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99; https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj; https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99
CVE: CVE-2020-15172
Published: 2020-09-15
Description: The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module with `unload act` can render this exploit inaccessible.
CVSS Score: 8.7 (HIGH)
CWE: CWE-502
References: https://github.com/zephyrkul/FluffyCogs/commit/6b9f3b862e1f0a5429c62f3090f814e53a242347; https://github.com/zephyrkul/FluffyCogs/security/advisories/GHSA-rm7m-j4xp-rv2p; https://github.com/zephyrkul/FluffyCogs/commit/6b9f3b862e1f0a5429c62f3090f814e53a242347
CVE: CVE-2020-9416
Published: 2020-09-15
Description: The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire; http://www.tibco.com/services/support/advisories
CVE: CVE-2020-11977
Published: 2020-09-15
Description: In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
CVSS Score: 7.2 (HIGH)
References: https://syncope.apache.org/security#CVE-2020-11977:_Remote_Code_Execution_via_Flowable_workflow_definition; https://syncope.apache.org/security#CVE-2020-11977:_Remote_Code_Execution_via_Flowable_workflow_definition
CVE: CVE-2020-14304
Published: 2020-09-15
Description: A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-460, CWE-755
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960702; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14304; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960702
CVE: CVE-2020-14314
Published: 2020-09-15
Description: A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14314; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5872331b3d91820e14716632ebb56b1399b34fe1; https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
CVE: CVE-2020-24561
Published: 2020-09-15
Description: A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attacker must first obtain admin/root privileges on the SPLX console to exploit this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://success.trendmicro.com/solution/000268419; https://success.trendmicro.com/solution/000268419
CVE: CVE-2020-14385
Published: 2020-09-15
Description: A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-131, CWE-131
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14385; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933
CVE: CVE-2020-23828
Published: 2020-09-15
Description: A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE) on the hosting webserver by uploading a crafted PHP web-shell that bypasses the image upload filters. An attack uses /Online%20Course%20Registration/my-profile.php with the POST parameter photo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/48704; https://www.sourcecodester.com/php/14251/online-course-registration.html; https://www.exploit-db.com/exploits/48704
CVE: CVE-2020-23833
Published: 2020-09-15
Description: Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/158811/House-Rental-1.0-SQL-Injection.html; https://projectworlds.in; https://projectworlds.in/wp-content/uploads/2019/06/home-rental.zip
CVE: CVE-2020-25453
Published: 2020-09-15
Description: An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/159237/BlackCat-CMS-1.3.6-Cross-Site-Request-Forgery.html; https://github.com/BlackCatDevelopment/BlackCatCMS/issues/389; http://packetstormsecurity.com/files/159237/BlackCat-CMS-1.3.6-Cross-Site-Request-Forgery.html
CVE: CVE-2020-10766
Published: 2020-09-15
Description: A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-440
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10766; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbbe2ad02e9df26e372f38cc3e70dab9222c832e; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10766
CVE: CVE-2020-10767
Published: 2020-09-15
Description: A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-440
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10767; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=21998a351512eba4ed5969006f0c55882d995ada; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10767
CVE: CVE-2020-7293
Published: 2020-09-15
Description: Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password via improper access controls in the user interface.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-7294
Published: 2020-09-15
Description: Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-7295
Published: 2020-09-15
Description: Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.
CVSS Score: 3.5 (LOW)
CWE: CWE-287, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-7296
Published: 2020-09-15
Description: Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files via improper access control in the user interface.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-10768
Published: 2020-09-16
Description: A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-440
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10768; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4d8df8cbb9156b0a0ab3f802b80cb5db57acc0bf; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10768
CVE: CVE-2020-7297
Published: 2020-09-16
Description: Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-7268
Published: 2020-09-16
Description: Path Traversal vulnerability in McAfee McAfee Email Gateway (MEG) prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-10781
Published: 2020-09-16
Description: A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10781; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=853eab68afc80f59f36bbdeb715e5c88c501e680; https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
CVE: CVE-2020-14386
Published: 2020-09-16
Description: A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-250, CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html; http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html; http://www.openwall.com/lists/oss-security/2021/09/17/2
CVE: CVE-2020-14392
Published: 2020-09-16
Description: An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-822, CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00074.html; https://bugzilla.redhat.com/show_bug.cgi?id=1877402
CVE: CVE-2020-25559
Published: 2020-09-16
Description: gnuplot 5.5 is affected by double free when executing print_set_output. This may result in context-dependent arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://sourceforge.net/p/gnuplot/bugs/2312/; https://sourceforge.net/p/gnuplot/bugs/2312/
CVE: CVE-2020-14315
Published: 2020-09-16
Description: A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1856747; https://www.openwall.com/lists/oss-security/2020/07/09/2; https://www.x41-dsec.de/lab/advisories/x41-2020-006-bspatch/
CVE: CVE-2020-14393
Published: 2020-09-16
Description: A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-121, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00074.html; https://bugzilla.redhat.com/show_bug.cgi?id=1877409
CVE: CVE-2020-25412
Published: 2020-09-16
Description: com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://sourceforge.net/p/gnuplot/bugs/2303/; https://sourceforge.net/p/gnuplot/bugs/2303/