deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-25009
Published: 2020-12-31
Description: An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2019-0034.html; https://rustsec.org/advisories/RUSTSEC-2019-0034.html
CVE: CVE-2019-25010
Published: 2020-12-31
Description: An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://github.com/rust-lang-nursery/failure/issues/336; https://rustsec.org/advisories/RUSTSEC-2019-0036.html; https://github.com/rust-lang-nursery/failure/issues/336
CVE: CVE-2020-35857
Published: 2020-12-31
Description: An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/bluejekyll/trust-dns/commit/8b9eab05795fdc[PII_REDACTED]53b2498055c7a8f3; https://rustsec.org/advisories/RUSTSEC-2020-0001.html; https://github.com/bluejekyll/trust-dns/commit/8b9eab05795fdc[PII_REDACTED]53b2498055c7a8f3
CVE: CVE-2020-35858
Published: 2020-12-31
Description: An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service (e.g., x86) or possibly remote code execution (e.g., ARM).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0002.html; https://rustsec.org/advisories/RUSTSEC-2020-0002.html
CVE: CVE-2020-35859
Published: 2020-12-31
Description: An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information, or guest programs can experience memory corruption.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0004.html; https://rustsec.org/advisories/RUSTSEC-2020-0004.html
CVE: CVE-2020-35860
Published: 2020-12-31
Description: An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://rustsec.org/advisories/RUSTSEC-2020-0005.html; https://rustsec.org/advisories/RUSTSEC-2020-0005.html
CVE: CVE-2020-35861
Published: 2020-12-31
Description: An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://rustsec.org/advisories/RUSTSEC-2020-0006.html; https://rustsec.org/advisories/RUSTSEC-2020-0006.html
CVE: CVE-2020-35862
Published: 2020-12-31
Description: An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0007.html; https://rustsec.org/advisories/RUSTSEC-2020-0007.html
CVE: CVE-2020-35863
Published: 2020-12-31
Description: An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://rustsec.org/advisories/RUSTSEC-2020-0008.html; https://rustsec.org/advisories/RUSTSEC-2020-0008.html
CVE: CVE-2020-35864
Published: 2020-12-31
Description: An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0009.html; https://rustsec.org/advisories/RUSTSEC-2020-0009.html
CVE: CVE-2020-35865
Published: 2020-12-31
Description: An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. It has false expectations about char::from_u32_unchecked behavior.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0012.html; https://rustsec.org/advisories/RUSTSEC-2020-0012.html
CVE: CVE-2020-35866
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35867
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35868
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35869
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35870
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35871
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35872
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35873
Published: 2020-12-31
Description: An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/rusqlite/rusqlite/releases/tag/0.23.0; https://rustsec.org/advisories/RUSTSEC-2020-0014.html; https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
CVE: CVE-2020-35874
Published: 2020-12-31
Description: An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0017.html; https://rustsec.org/advisories/RUSTSEC-2020-0017.html
CVE: CVE-2020-35875
Published: 2020-12-31
Description: An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0019.html; https://rustsec.org/advisories/RUSTSEC-2020-0019.html
CVE: CVE-2020-35876
Published: 2020-12-31
Description: An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-772
References: https://rustsec.org/advisories/RUSTSEC-2020-0021.html; https://rustsec.org/advisories/RUSTSEC-2020-0021.html
CVE: CVE-2020-35877
Published: 2020-12-31
Description: An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://rustsec.org/advisories/RUSTSEC-2020-0022.html; https://rustsec.org/advisories/RUSTSEC-2020-0022.html
CVE: CVE-2020-35878
Published: 2020-12-31
Description: An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2020-0022.html; https://rustsec.org/advisories/RUSTSEC-2020-0022.html
CVE: CVE-2020-35879
Published: 2020-12-31
Description: An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut.
CVSS Score: 9.8 (CRITICAL)
References: https://rustsec.org/advisories/RUSTSEC-2020-0023.html; https://rustsec.org/advisories/RUSTSEC-2020-0023.html
CVE: CVE-2020-35880
Published: 2020-12-31
Description: An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation.
CVSS Score: 9.8 (CRITICAL)
References: https://rustsec.org/advisories/RUSTSEC-2020-0025.html; https://rustsec.org/advisories/RUSTSEC-2020-0025.html
CVE: CVE-2020-35881
Published: 2020-12-31
Description: An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0027.html; https://rustsec.org/advisories/RUSTSEC-2020-0027.html
CVE: CVE-2020-35882
Published: 2020-12-31
Description: An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0028.html; https://rustsec.org/advisories/RUSTSEC-2020-0028.html
CVE: CVE-2020-35883
Published: 2020-12-31
Description: An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://rustsec.org/advisories/RUSTSEC-2020-0030.html; https://rustsec.org/advisories/RUSTSEC-2020-0030.html
CVE: CVE-2020-35884
Published: 2020-12-31
Description: An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3JDNRE5RXJOWZZZF5QSCG4GUCSLTHF2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO6SRTCEPEYO2OX647I3H5XUWLFDRDWL/; https://rustsec.org/advisories/RUSTSEC-2020-0031.html
CVE: CVE-2020-35885
Published: 2020-12-31
Description: An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2020-0032.html; https://rustsec.org/advisories/RUSTSEC-2020-0032.html
CVE: CVE-2020-35886
Published: 2020-12-31
Description: An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0034.html; https://rustsec.org/advisories/RUSTSEC-2020-0034.html
CVE: CVE-2020-35887
Published: 2020-12-31
Description: An issue was discovered in the arr crate through 2020-08-25 for Rust. There is a buffer overflow in Index and IndexMut.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://rustsec.org/advisories/RUSTSEC-2020-0034.html; https://rustsec.org/advisories/RUSTSEC-2020-0034.html
CVE: CVE-2020-35888
Published: 2020-12-31
Description: An issue was discovered in the arr crate through 2020-08-25 for Rust. Uninitialized memory is dropped by Array::new_from_template.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2020-0034.html; https://rustsec.org/advisories/RUSTSEC-2020-0034.html
CVE: CVE-2020-35889
Published: 2020-12-31
Description: An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://rustsec.org/advisories/RUSTSEC-2020-0037.html; https://rustsec.org/advisories/RUSTSEC-2020-0037.html
CVE: CVE-2020-35890
Published: 2020-12-31
Description: An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via out-of-bounds access for large capacity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://rustsec.org/advisories/RUSTSEC-2020-0038.html; https://rustsec.org/advisories/RUSTSEC-2020-0038.html
CVE: CVE-2020-35891
Published: 2020-12-31
Description: An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via a remove() double free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2020-0038.html; https://rustsec.org/advisories/RUSTSEC-2020-0038.html
CVE: CVE-2020-35892
Published: 2020-12-31
Description: An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://rustsec.org/advisories/RUSTSEC-2020-0039.html; https://rustsec.org/advisories/RUSTSEC-2020-0039.html
CVE: CVE-2020-35893
Published: 2020-12-31
Description: An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193, CWE-401, CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2020-0039.html; https://rustsec.org/advisories/RUSTSEC-2020-0039.html
CVE: CVE-2020-35894
Published: 2020-12-31
Description: An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: https://rustsec.org/advisories/RUSTSEC-2020-0040.html; https://rustsec.org/advisories/RUSTSEC-2020-0040.html
CVE: CVE-2020-35895
Published: 2020-12-31
Description: An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0042.html; https://rustsec.org/advisories/RUSTSEC-2020-0042.html
CVE: CVE-2020-35896
Published: 2020-12-31
Description: An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://rustsec.org/advisories/RUSTSEC-2020-0043.html; https://rustsec.org/advisories/RUSTSEC-2020-0043.html
CVE: CVE-2020-35897
Published: 2020-12-31
Description: An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0044.html; https://rustsec.org/advisories/RUSTSEC-2020-0044.html
CVE: CVE-2018-19941
Published: 2020-12-31
Description: A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)
CVSS Score: 7.5 (HIGH)
CWE: CWE-315, CWE-312
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-23; https://www.qnap.com/zh-tw/security-advisory/qsa-20-23
CVE: CVE-2018-19944
Published: 2020-12-31
Description: A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remote attacker to gain access to sensitive information. QNAP have already fixed this vulnerability in the following versions: QTS 4.4.3.1354 build 20200702 (and later)
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-319, CWE-319
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-22; https://www.qnap.com/zh-tw/security-advisory/qsa-20-22
CVE: CVE-2018-19945
Published: 2020-12-31
Description: A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-22, CWE-73, CWE-284, CWE-22
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-21; https://www.qnap.com/zh-tw/security-advisory/qsa-20-21
CVE: CVE-2020-11832
Published: 2020-12-31
Description: In functions charging_limit_current_write and charging_limit_time_write in /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_charger.c have not checked the parameters, which causes a vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336
CVE: CVE-2020-11833
Published: 2020-12-31
Description: In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_mp2650.c, the function mp2650_data_log_write in mp2650_data_log_write does not check the parameter len which causes a vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336
CVE: CVE-2020-11834
Published: 2020-12-31
Description: In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_vooc.c, the function proc_fastchg_fw_update_write in proc_fastchg_fw_update_write does not check the parameter len, resulting in a vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336
CVE: CVE-2020-11835
Published: 2020-12-31
Description: In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_da9313.c, failure to check the parameter buf in the function proc_work_mode_write in proc_work_mode_write causes a vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]610830336
CVE: CVE-2020-25797
Published: 2020-12-31
Description: LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.limesurvey.org/view.php?id=15680; https://github.com/LimeSurvey/LimeSurvey/commit/0a7bdfa1c166f734d11a1528c8d9a7d61b670ad7; https://bugs.limesurvey.org/view.php?id=15680
CVE: CVE-2020-25799
Published: 2020-12-31
Description: LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.limesurvey.org/view.php?id=15681; https://github.com/LimeSurvey/LimeSurvey/commit/a5f317817da4577d9ff457fea9c96482b3d1df23; https://bugs.limesurvey.org/view.php?id=15681
CVE: CVE-2019-25011
Published: 2020-12-31
Description: NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.cinquino.eu/NetBox.htm; https://github.com/netbox-community/netbox/issues/3471; http://www.cinquino.eu/NetBox.htm
CVE: CVE-2020-35930
Published: 2020-12-31
Description: Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/seopanel/Seo-Panel/issues/201; https://github.com/seopanel/Seo-Panel/issues/201
CVE: CVE-2020-26165
Published: 2020-12-31
Description: qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/160733/qdPM-9.1-PHP-Object-Injection.html; http://qdpm.net/qdpm-release-notes-free-project-management; http://seclists.org/fulldisclosure/2021/Jan/10
CVE: CVE-2020-35931
Published: 2020-12-31
Description: An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and before 4.1.1 on macOS). An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subtype entry of the Annotation dictionary, in an incremental update.
CVSS Score: 7.8 (HIGH)
CWE: CWE-754
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2016-20006
Published: 2021-01-01
Description: The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVSS Score: 7.5 (HIGH)
References: https://www.drupal.org/node/2744889; https://www.drupal.org/node/2744889
CVE: CVE-2016-20007
Published: 2021-01-01
Description: The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://www.drupal.org/node/2744889; https://www.drupal.org/node/2744889
CVE: CVE-2016-20008
Published: 2021-01-01
Description: The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVSS Score: 7.5 (HIGH)
References: https://www.drupal.org/node/2744889; https://www.drupal.org/node/2744889
CVE: CVE-2016-20001
Published: 2021-01-01
Description: The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.drupal.org/node/2744889; https://www.drupal.org/node/2744889