deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-22043
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://trac.ffmpeg.org/ticket/8284; https://trac.ffmpeg.org/ticket/8284
CVE: CVE-2021-22123
Published: 2021-06-01
Description: An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.
CVSS Score: 7.6 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-20-120; https://fortiguard.com/advisory/FG-IR-20-120
CVE: CVE-2021-26111
Published: 2021-06-01
Description: A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and below may allow an attacker on an adjacent network to exhaust available memory by sending specifically crafted LLDP/CDP/EDP packets to the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://fortiguard.com/advisory/FG-IR-21-026; https://fortiguard.com/advisory/FG-IR-21-026
CVE: CVE-2021-31684
Published: 2021-06-01
Description: A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/netplex/json-smart-v1/issues/10; https://github.com/netplex/json-smart-v1/pull/11; https://github.com/netplex/json-smart-v2/issues/67
CVE: CVE-2021-32653
Published: 2021-06-01
Description: Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.
CVSS Score: 2.7 (LOW)
CWE: CWE-201
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45; https://hackerone.com/reports/1173436; https://security.gentoo.org/glsa/202208-17
CVE: CVE-2021-3425
Published: 2021-06-01
Description: A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1936629; https://bugzilla.redhat.com/show_bug.cgi?id=1936629
CVE: CVE-2020-22044
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html; https://trac.ffmpeg.org/ticket/8295; https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html
CVE: CVE-2021-32654
Published: 2021-06-01
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5; https://hackerone.com/reports/1170024; https://security.gentoo.org/glsa/202208-17
CVE: CVE-2021-32655
Published: 2021-06-01
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. No workarounds are known to exist.
CVSS Score: 3.5 (LOW)
CWE: CWE-241
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-grph-cm44-p3jv; https://hackerone.com/reports/1167929; https://security.gentoo.org/glsa/202208-17
CVE: CVE-2021-32656
Published: 2021-06-01
Description: Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other Nextcloud servers, which can be done automatically when selecting the "Add server automatically once a federated share was created successfully" setting. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2 As a workaround, disable "Add server automatically once a federated share was created successfully" in the Nextcloud settings.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6; https://hackerone.com/reports/1167853; https://security.gentoo.org/glsa/202208-17
CVE: CVE-2021-32657
Published: 2021-06-01
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665; https://hackerone.com/reports/1147611; https://security.gentoo.org/glsa/202208-17
CVE: CVE-2021-29090
Published: 2021-06-02
Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.synology.com/security/advisory/Synology_SA_20_20; https://www.synology.com/security/advisory/Synology_SA_20_20
CVE: CVE-2021-29091
Published: 2021-06-02
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_20_20; https://www.synology.com/security/advisory/Synology_SA_20_20
CVE: CVE-2021-29089
Published: 2021-06-02
Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.synology.com/security/advisory/Synology_SA_20_20; https://www.synology.com/security/advisory/Synology_SA_20_20
CVE: CVE-2020-10742
Published: 2021-06-02
Description: A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1835127; https://bugzilla.redhat.com/show_bug.cgi?id=1835127
CVE: CVE-2020-10743
Published: 2021-06-02
Description: It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as clickjacking.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358, CWE-1021
References: https://bugzilla.redhat.com/show_bug.cgi?id=1834550; https://bugzilla.redhat.com/show_bug.cgi?id=1834550
CVE: CVE-2020-6641
Published: 2021-06-02
Description: Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://fortiguard.com/advisory/FG-IR-19-258; https://fortiguard.com/advisory/FG-IR-19-258
CVE: CVE-2020-10771
Published: 2021-06-02
Description: A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1846293; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1846293
CVE: CVE-2020-14317
Published: 2021-06-02
Description: It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing regression. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-364
References: https://bugzilla.redhat.com/show_bug.cgi?id=1854251; https://bugzilla.redhat.com/show_bug.cgi?id=1854251
CVE: CVE-2020-14326
Published: 2021-06-02
Description: A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1855826; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1855826
CVE: CVE-2020-14335
Published: 2021-06-02
Description: A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1858302; https://bugzilla.redhat.com/show_bug.cgi?id=1858302
CVE: CVE-2020-14336
Published: 2021-06-02
Description: A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=1858981; https://bugzilla.redhat.com/show_bug.cgi?id=1858981
CVE: CVE-2020-14340
Published: 2021-06-02
Description: A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1860218; https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpujan2022.html
CVE: CVE-2020-14371
Published: 2021-06-02
Description: A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1873131; https://bugzilla.redhat.com/show_bug.cgi?id=1873131
CVE: CVE-2020-14380
Published: 2021-06-02
Description: An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=1873926; https://bugzilla.redhat.com/show_bug.cgi?id=1873926
CVE: CVE-2020-14388
Published: 2021-06-02
Description: A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1875553; https://bugzilla.redhat.com/show_bug.cgi?id=1875553
CVE: CVE-2021-23894
Published: 2021-06-02
Description: Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10359; https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE: CVE-2021-23895
Published: 2021-06-02
Description: Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10359; https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE: CVE-2021-24012
Published: 2021-06-02
Description: An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://fortiguard.com/advisory/FG-IR-21-018; https://fortiguard.com/advisory/FG-IR-21-018
CVE: CVE-2021-26940
Published: 2021-06-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-33500. Reason: This candidate is a reservation duplicate of CVE-2021-33500. Notes: All CVE users should reference CVE-2021-33500 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-3520
Published: 2021-06-02
Description: There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954559; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2017-8761
Published: 2021-06-02
Description: In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://launchpad.net/bugs/1685798; https://launchpad.net/bugs/1685798
CVE: CVE-2018-10195
Published: 2021-06-02
Description: lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.
CVSS Score: 7.1 (HIGH)
CWE: CWE-190
References: http://www.ohse.de/uwe/software/lrzsz.html; https://bugzilla.redhat.com/show_bug.cgi?id=1572058; https://lists.debian.org/debian-lts-announce/2022/01/msg00027.html
CVE: CVE-2020-35503
Published: 2021-06-02
Description: A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1910346; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1910346
CVE: CVE-2020-35510
Published: 2021-06-02
Description: A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1905796; https://bugzilla.redhat.com/show_bug.cgi?id=1905796
CVE: CVE-2020-35514
Published: 2021-06-02
Description: An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0[PII_REDACTED]58.p0.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266
References: https://bugzilla.redhat.com/show_bug.cgi?id=1914714; https://bugzilla.redhat.com/show_bug.cgi?id=1914714
CVE: CVE-2021-23896
Published: 2021-06-02
Description: Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to only have access to DBSec data in the Insights Server.
CVSS Score: 3.2 (LOW)
CWE: CWE-319, CWE-319
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10359; https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE: CVE-2021-3538
Published: 2021-06-02
Description: A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338, CWE-338
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954376; https://github.com/satori/go.uuid/issues/73; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
CVE: CVE-2021-3544
Published: 2021-06-02
Description: Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2021/05/31/1; https://bugzilla.redhat.com/show_bug.cgi?id=1958935; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2021-3545
Published: 2021-06-02
Description: An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: http://www.openwall.com/lists/oss-security/2021/05/31/1; https://bugzilla.redhat.com/show_bug.cgi?id=1958955; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2021-3546
Published: 2021-06-02
Description: An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code execution with the privileges of the QEMU process.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2021/05/31/1; https://bugzilla.redhat.com/show_bug.cgi?id=1958978; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2019-12067
Published: 2021-06-02
Description: The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.suse.com/show_bug.cgi?id=1145642; https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.html; https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01487.html
CVE: CVE-2021-26707
Published: 2021-06-02
Description: The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/
CVE: CVE-2021-28675
Published: 2021-06-02
Description: An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/; https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin; https://security.gentoo.org/glsa/202107-33
CVE: CVE-2021-3522
Published: 2021-06-02
Description: GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954761; https://security.gentoo.org/glsa/202208-31; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/