deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44875
Published: 2021-12-21
Description: Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the password recovery procedure for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.systeam.com.br/cve/userenum-2-en.txt; https://www.systeam.com.br/cve/userenum-2-en.txt
CVE: CVE-2021-44876
Published: 2021-12-21
Description: Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the identification of the correct tenant for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.systeam.com.br/cve/userenum-1-en.txt; https://www.systeam.com.br/cve/userenum-1-en.txt
CVE: CVE-2021-44877
Published: 2021-12-21
Description: Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability has been found while using a temporary generated token in order to consume api resources. The vulnerability allows an unauthenticated attacker to use an api endpoint to generate a temporary JWT token that is designed to reference the correct tenant prior to authentication, to request system configuration parameters using direct api requests. The correct exploitation of this vulnerability causes sensitive information exposure. In case the tenant has an smtp credential set, the full credential information is disclosed.
CVSS Score: 7.5 (HIGH)
References: https://www.systeam.com.br/cve/broken-access-control-en.txt; https://www.systeam.com.br/cve/broken-access-control-en.txt
CVE: CVE-2021-45288
Published: 2021-12-21
Description: A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/gpac/gpac/issues/1956; https://github.com/gpac/gpac/issues/1956
CVE: CVE-2020-19770
Published: 2021-12-21
Description: A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/180; https://github.com/wuzhicms/wuzhicms/issues/180
CVE: CVE-2021-27445
Published: 2021-12-21
Description: Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-732
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03
CVE: CVE-2021-27447
Published: 2021-12-21
Description: Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-77
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-147-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-147-03
CVE: CVE-2021-27449
Published: 2021-12-21
Description: Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03
CVE: CVE-2021-27451
Published: 2021-12-21
Description: Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03
CVE: CVE-2021-27453
Published: 2021-12-21
Description: Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03
CVE: CVE-2021-44207
Published: 2021-12-21
Description: Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0012/MNDT-2021-0012.md; https://www.acclaimsystems.com; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0012/MNDT-2021-0012.md
CVE: CVE-2021-45289
Published: 2021-12-21
Description: A vulnerability exists in GPAC 1.0.1 due to an omission of security-relevant Information, which could cause a Denial of Service. The program terminates with signal SIGKILL.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/gpac/gpac/issues/1972; https://github.com/gpac/gpac/issues/1972
CVE: CVE-2021-45290
Published: 2021-12-21
Description: A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/WebAssembly/binaryen/issues/4383; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKGCHPS7UAIOOBGSXDJAUFE5CROTTF6J/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCWLB4PWYQO55F7IGNC7KUYN2MFZE3JP/
CVE: CVE-2021-45291
Published: 2021-12-21
Description: The gf_dump_setup function in GPAC 1.0.1 allows malicoius users to cause a denial of service (Invalid memory address dereference) via a crafted file in the MP4Box command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/gpac/gpac/issues/1955; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1955
CVE: CVE-2021-45292
Published: 2021-12-21
Description: The gf_isom_hint_rtp_read function in GPAC 1.0.1 allows attackers to cause a denial of service (Invalid memory address dereference) via a crafted file in the MP4Box command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1958; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1958
CVE: CVE-2021-45293
Published: 2021-12-21
Description: A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/WebAssembly/binaryen/issues/4384; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKGCHPS7UAIOOBGSXDJAUFE5CROTTF6J/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCWLB4PWYQO55F7IGNC7KUYN2MFZE3JP/
CVE: CVE-2021-38893
Published: 2021-12-21
Description: IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209512; https://www.ibm.com/support/pages/node/6526488; https://www.ibm.com/support/pages/node/6527782
CVE: CVE-2021-38900
Published: 2021-12-21
Description: IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209607; https://www.ibm.com/support/pages/node/6527776; https://www.ibm.com/support/pages/node/6528296
CVE: CVE-2021-38966
Published: 2021-12-21
Description: IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212357; https://www.ibm.com/support/pages/node/6526488; https://exchange.xforce.ibmcloud.com/vulnerabilities/212357
CVE: CVE-2021-44422
Published: 2021-12-21
Description: An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. Crafted data in a BMP file can trigger a write operation past the end of an allocated buffer, or lead to a heap-based buffer overflow. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2021-44423
Published: 2021-12-21
Description: An out-of-bounds read vulnerability exists when reading a BMP file using Open Design Alliance (ODA) Drawings Explorer before 2022.12. The specific issue exists after loading BMP files. Unchecked input data from a crafted BMP file leads to an out-of-bounds read. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2021-44859
Published: 2021-12-21
Description: An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TGA files. An unchecked input data from a crafted TGA file leads to an out-of-bounds read. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2021-44860
Published: 2021-12-21
Description: An out-of-bounds read vulnerability exists when reading a TIF file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TIF files. An unchecked input data from a crafted TIF file leads to an out-of-bounds read. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2021-45297
Published: 2021-12-21
Description: An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/gpac/gpac/issues/1973; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1973
CVE: CVE-2021-44917
Published: 2021-12-21
Description: A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://sourceforge.net/p/gnuplot/bugs/2358/; https://sourceforge.net/p/gnuplot/bugs/2474/; https://sourceforge.net/p/gnuplot/bugs/2358/
CVE: CVE-2021-44918
Published: 2021-12-21
Description: A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1968; https://github.com/gpac/gpac/issues/1968
CVE: CVE-2021-44919
Published: 2021-12-21
Description: A Null Pointer Dereference vulnerability exists in the gf_sg_vrml_mf_alloc function in gpac 1.1.0-DEV, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1963; https://github.com/gpac/gpac/issues/1963
CVE: CVE-2021-44920
Published: 2021-12-21
Description: An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump_od_to_saf.isra function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/gpac/gpac/issues/1957; https://github.com/gpac/gpac/issues/1957
CVE: CVE-2021-44921
Published: 2021-12-21
Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1964; https://github.com/gpac/gpac/issues/1964
CVE: CVE-2021-44922
Published: 2021-12-21
Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1969; https://github.com/gpac/gpac/issues/1969
CVE: CVE-2021-44923
Published: 2021-12-21
Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1962; https://github.com/gpac/gpac/issues/1962
CVE: CVE-2021-44924
Published: 2021-12-21
Description: An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/gpac/gpac/issues/1959; https://github.com/gpac/gpac/issues/1959
CVE: CVE-2021-44925
Published: 2021-12-21
Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1967; https://github.com/gpac/gpac/issues/1967
CVE: CVE-2021-44926
Published: 2021-12-21
Description: A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf_node_get_tag function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1961; https://github.com/gpac/gpac/issues/1961
CVE: CVE-2021-44927
Published: 2021-12-21
Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_sg_vrml_mf_append function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1960; https://github.com/gpac/gpac/issues/1960
CVE: CVE-2021-43851
Published: 2021-12-22
Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/anuko/timetracker/commit/0cf32f1046418aa2e5218b0b370064820c330c6a; https://github.com/anuko/timetracker/commit/94fda0cc0c9c20ab98d38ccc75ff040d13dc7f1b; https://github.com/anuko/timetracker/security/advisories/GHSA-wx6x-6rq3-pqcc
CVE: CVE-2021-44028
Published: 2021-12-22
Description: XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2; https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE: CVE-2021-44029
Published: 2021-12-22
Description: An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2; https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE: CVE-2021-44030
Published: 2021-12-22
Description: Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2; https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE: CVE-2021-44031
Published: 2021-12-22
Description: An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2; https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE: CVE-2021-45459
Published: 2021-12-22
Description: lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/coreybutler/node-windows/compare/1.0.0-beta.5...1.0.0-beta.6; https://github.com/dwisiswant0/advisory/issues/4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-40836
Published: 2021-12-22
Description: A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
CVSS Score: 4.6 (MEDIUM)
References: https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE: CVE-2021-40612
Published: 2021-12-22
Description: An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes.
CVSS Score: 9.8 (CRITICAL)
References: https://community.opmantek.com/pages/viewpage.action?pageId=65504438; https://github.com/Opmantek/open-audit/commit/c7595cbb092e410a487f03c0eb536cf19e538860; https://community.opmantek.com/pages/viewpage.action?pageId=65504438
CVE: CVE-2021-36750
Published: 2021-12-22
Description: ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: https://encsecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]265-Update-for-ENC-Software; https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/; https://www.encsecurity.com/solutions.php
CVE: CVE-2021-45418
Published: 2021-12-22
Description: Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://starcharge.com; https://github.com/shortmore/trsh/blob/main/starcharge/CVE-2021-45418.md; https://vincss.net
CVE: CVE-2021-39013
Published: 2021-12-22
Description: IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213651; https://www.ibm.com/support/pages/node/6529200; https://exchange.xforce.ibmcloud.com/vulnerabilities/213651
CVE: CVE-2021-44733
Published: 2021-12-22
Description: A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfd0743f1d9ea76931510ed150334d571fbab49d; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/tee/tee_shm.c; https://github.com/pjlantz/optee-qemu/blob/main/README.md
CVE: CVE-2021-45256
Published: 2021-12-22
Description: A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392789; https://bugzilla.nasm.us/show_bug.cgi?id=3392789
CVE: CVE-2021-45257
Published: 2021-12-22
Description: An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392790; https://bugzilla.nasm.us/show_bug.cgi?id=3392790
CVE: CVE-2021-45258
Published: 2021-12-22
Description: A stack overflow vulnerability exists in gpac 1.1.0 via the gf_bifs_dec_proto_list function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1970; https://github.com/gpac/gpac/issues/1970
CVE: CVE-2021-45259
Published: 2021-12-22
Description: An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1986; https://github.com/gpac/gpac/issues/1986