deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12680
Published: 2020-05-08
Description: Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and thus a request such as fetchChromePasswords or fetchCredentials will succeed. NOTE: some third parties have stated that this is "not a vulnerability.
CVSS Score: 5.5 (MEDIUM)
References: https://medium.com/%40knikolenko/avira-free-antivirus-password-collector-83452fa7f943; https://twitter.com/taviso/status/[PII_REDACTED]12491026; https://medium.com/%40knikolenko/avira-free-antivirus-password-collector-83452fa7f943
CVE: CVE-2020-5741
Published: 2020-05-08
Description: Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html; https://www.tenable.com/security/research/tra-2020-32; http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html
CVE: CVE-2020-7267
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Linux prior to 2.0.3 Hotfix 2635000 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10316; https://kc.mcafee.com/corporate/index?page=content&id=SB10316
CVE: CVE-2020-7285
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.5.0.94 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2020-7286
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2020-7287
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Linux prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2020-7288
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2020-7289
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Active Response (MAR) for Windows prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2020-7290
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Active Response (MAR) for Linux prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2020-7291
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Active Response (MAR) for Mac prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10317; https://kc.mcafee.com/corporate/index?page=content&id=SB10317
CVE: CVE-2019-10169
Published: 2020-05-08
Description: A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-267
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10169; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10169
CVE: CVE-2019-10170
Published: 2020-05-08
Description: A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-267
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10170; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10170
CVE: CVE-2019-14898
Published: 2020-05-08
Description: The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-667, CWE-362, CWE-667
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1790; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14898; https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114
CVE: CVE-2020-11541
Published: 2020-05-08
Description: In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the local Administrator account.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://support.techsmith.com/hc/en-us/articles/[PII_REDACTED]7-Snagit-Windows-Version-History; https://support.techsmith.com/hc/en-us/articles/[PII_REDACTED]7-Snagit-Windows-Version-History
CVE: CVE-2017-13651
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-13655
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-13656
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-13657
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-15514
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-5480
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-5491
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-5499
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-10690
Published: 2020-05-08
Description: There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10690; https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
CVE: CVE-2017-13653
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-13654
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-5484
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17277
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17278
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17279
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17280
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17281
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17282
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17283
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17284
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17285
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17286
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17287
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17288
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17289
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17290
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17291
Published: 2020-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-12737
Published: 2020-05-08
Description: An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/escaped-com/83d89a05067c62e95992d42bbfa58933; https://www.maxum.com/Rumpus/Overview.html; https://gist.github.com/escaped-com/83d89a05067c62e95992d42bbfa58933
CVE: CVE-2018-20225
Published: 2020-05-08
Description: An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1835736; https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html; https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E
CVE: CVE-2020-12740
Published: 2020-05-08
Description: tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/appneta/tcpreplay/issues/576; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4YAT4AGTHQKB74ETOQPJMV67TSDIAPOC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UOSEIQ3D2OONCJEVMGC2TYBC2QX4E5EJ/
CVE: CVE-2020-11006
Published: 2020-05-08
Description: In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed when information is fetched from backend. This has been patched in version 2.11.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-79
References: https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e[PII_REDACTED]787ad2a; https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-8pc4-gvfw-634p; https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e[PII_REDACTED]787ad2a
CVE: CVE-2020-11530
Published: 2020-05-08
Description: A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/157607/WordPress-ChopSlider-3-SQL-Injection.html; http://packetstormsecurity.com/files/157655/WordPress-ChopSlider3-3.4-SQL-Injection.html; http://seclists.org/fulldisclosure/2020/May/26
CVE: CVE-2020-6616
Published: 2020-05-08
Description: Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situations where a Hardware Random Number Generator (HRNG) should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset. The Samsung ID is SVE-2020-16882 (May 2020).
CVSS Score: 6.5 (MEDIUM)
References: http://bluetooth.lol; http://seclists.org/fulldisclosure/2020/May/49; https://github.com/seemoo-lab/internalblue/blob/master/doc/rng.md
CVE: CVE-2020-11531
Published: 2020-05-08
Description: The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/157604/ManageEngine-DataSecurity-Plus-Path-Traversal-Code-Execution.html; http://seclists.org/fulldisclosure/2020/May/27; https://pitstop.manageengine.com/portal/community/topic/upgrade-datasecurity-plus-to-the-build-6013-to-fix-security-issues
CVE: CVE-2020-11532
Published: 2020-05-08
Description: Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: http://packetstormsecurity.com/files/157609/ManageEngine-DataSecurity-Plus-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/May/28; https://pitstop.manageengine.com/portal/community/topic/upgrade-datasecurity-plus-to-the-build-6013-to-fix-security-issues
CVE: CVE-2020-12755
Published: 2020-05-09
Description: fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option. This may lead to unintended KWallet storage of a password.
CVSS Score: 3.3 (LOW)
References: https://commits.kde.org/kio-extras/d813cef3cecdec9af1532a40d677a203ff979145; https://commits.kde.org/kio-extras/d813cef3cecdec9af1532a40d677a203ff979145
CVE: CVE-2020-12637
Published: 2020-05-09
Description: Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://blog.zulip.org/2020/05/06/zulip-desktop-5-2-0-security-release/; https://blog.zulip.org/2020/05/06/zulip-desktop-5-2-0-security-release/
CVE: CVE-2019-20794
Published: 2020-05-09
Description: An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-772
References: http://www.openwall.com/lists/oss-security/2020/08/24/1; https://github.com/sargun/fuse-example; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-12761
Published: 2020-05-09
Description: modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many colors in its color map.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-190
References: https://git.enlightenment.org/legacy/imlib2.git/commit/?id=c95f938ff1effaf91729c050a0f1c8684da4dd63; https://git.enlightenment.org/legacy/imlib2.git/commit/?id=c95f938ff1effaf91729c050a0f1c8684da4dd63
CVE: CVE-2020-12762
Published: 2020-05-09
Description: json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://github.com/json-c/json-c/pull/592; https://github.com/rsyslog/libfastjson/issues/161
CVE: CVE-2020-12764
Published: 2020-05-09
Description: Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/BrunoBulle/GNUTeca3.8/blob/master/README.md; https://github.com/BrunoBulle/GNUTeca3.8/blob/master/README.md
CVE: CVE-2020-12765
Published: 2020-05-09
Description: Solis Miolo 2.0 allows index.php?module=install&action=view&item= Directory Traversal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/BrunoBulle/Miolo_2.0/blob/master/README.md; https://github.com/BrunoBulle/Miolo_2.0/blob/master/README.md
CVE: CVE-2020-12766
Published: 2020-05-09
Description: Gnuteca 3.8 allows action=main:search:simpleSearch SQL Injection via the exemplaryStatusId parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BrunoBulle/GNUTeca_3.8-SQL_Inj/blob/master/README.md; https://github.com/BrunoBulle/GNUTeca_3.8-SQL_Inj/blob/master/README.md
CVE: CVE-2019-20795
Published: 2020-05-09
Description: iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.suse.com/show_bug.cgi?id=1171452; https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10; https://security.gentoo.org/glsa/202008-06
CVE: CVE-2020-12767
Published: 2020-05-09
Description: exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html; https://github.com/libexif/libexif/issues/31; https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html
CVE: CVE-2020-12768
Published: 2020-05-09
Description: An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://bugzilla.suse.com/show_bug.cgi?id=1171736#c3; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d80b64ff297e40c2b6f7d7abc1b3eba70d22a068
CVE: CVE-2020-12769
Published: 2020-05-09
Description: An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-662
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.17
CVE: CVE-2020-12770
Published: 2020-05-09
Description: An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.
CVSS Score: 6.7 (MEDIUM)
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83c6f2390040f188cc25b270b4befeb5628c1aee; https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html; https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html