deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28206
Published: 2020-12-02
Description: An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows brute-force attacks on the passwords of users not in the administrator group.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://justrealstag.medium.com/user-enumeration-improper-restriction-of-excessive-authentication-attempts-in-bitrix-98933a97e0e6; https://justrealstag.medium.com/user-enumeration-improper-restriction-of-excessive-authentication-attempts-in-bitrix-98933a97e0e6
CVE: CVE-2020-26244
Published: 2020-12-02
Description: Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-325, CWE-347, CWE-347
References: https://github.com/OpenIDC/pyoidc/commit/62f8d753fa17c8b1f29f8be639cf0b33afb02498; https://github.com/OpenIDC/pyoidc/releases/tag/1.2.1; https://github.com/OpenIDC/pyoidc/security/advisories/GHSA-4fjv-pmhg-3rfg
CVE: CVE-2020-29279
Published: 2020-12-02
Description: PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: http://www.74cms.com/news/show-2497.html; https://github.com/BigTiger2020/74CMS/blob/main/README.md; http://www.74cms.com/news/show-2497.html
CVE: CVE-2020-29280
Published: 2020-12-02
Description: The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Victor-CMS-/blob/main/README.md; https://github.com/VictorAlagwu/CMSsite/issues/13; https://www.exploit-db.com/exploits/48734
CVE: CVE-2020-29282
Published: 2020-12-02
Description: SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/BloodX-CMS/blob/main/README.md; https://github.com/diveshlunker/BloodX; https://www.exploit-db.com/exploits/48786
CVE: CVE-2020-29283
Published: 2020-12-02
Description: An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Online-Doctor-Appointment-Booking-System-PHP/blob/main/README.md; https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql; https://github.com/BigTiger2020/Online-Doctor-Appointment-Booking-System-PHP/blob/main/README.md
CVE: CVE-2020-29284
Published: 2020-12-02
Description: The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the table_id parameter which allows unauthenticated SQL Injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/-Multi-Restaurant-Table-Reservation-System/blob/main/README.md; https://www.exploit-db.com/exploits/48984; https://www.sourcecodester.com/php/14568/multi-restaurant-table-reservation-system-php-full-source-code.html
CVE: CVE-2020-29285
Published: 2020-12-02
Description: SQL injection vulnerability was discovered in Point of Sales in PHP/PDO 1.0, which can be exploited via the id parameter to edit_category.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Point-of-Sales/blob/main/README.md; https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql; https://www.sourcecodester.com/php/14540/point-sales-phppdo-full-source-code-2020.html
CVE: CVE-2020-29287
Published: 2020-12-02
Description: An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be exploited via the id parameter in view_car.php or the car_id parameter in booking.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Car-Rental-Management-System/blob/main/README.md; https://www.exploit-db.com/exploits/49056; https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
CVE: CVE-2020-29288
Published: 2020-12-02
Description: An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Gym-Management-System/blob/main/README.md; https://www.exploit-db.com/exploits/48936; https://www.sourcecodester.com/php/14541/gym-management-system-using-phpmysqli-source-code.html
CVE: CVE-2020-26246
Published: 2020-12-03
Description: Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-281
References: https://github.com/pimcore/pimcore/pull/7618; https://github.com/pimcore/pimcore/security/advisories/GHSA-7p8p-4253-3mg6; https://github.com/pimcore/pimcore/pull/7618
CVE: CVE-2020-5638
Published: 2020-12-03
Description: Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN42199826/index.html; https://www.desknets.com/neo/support/mainte/9700/; https://jvn.jp/en/jp/JVN42199826/index.html
CVE: CVE-2020-5676
Published: 2020-12-03
Description: GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/weseek/growi; https://hub.docker.com/r/weseek/growi/; https://jvn.jp/en/jp/JVN56450373/index.html
CVE: CVE-2020-5677
Published: 2020-12-03
Description: Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/weseek/growi; https://hub.docker.com/r/weseek/growi/; https://jvn.jp/en/jp/JVN56450373/index.html
CVE: CVE-2020-5678
Published: 2020-12-03
Description: Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/weseek/growi; https://hub.docker.com/r/weseek/growi/; https://jvn.jp/en/jp/JVN56450373/index.html
CVE: CVE-2020-5679
Published: 2020-12-03
Description: Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://jvn.jp/en/jp/JVN24457594/index.html; https://www.ec-cube.net/info/weakness/; https://jvn.jp/en/jp/JVN24457594/index.html
CVE: CVE-2020-5680
Published: 2020-12-03
Description: Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN24457594/index.html; https://www.ec-cube.net/info/weakness/; https://jvn.jp/en/jp/JVN24457594/index.html
CVE: CVE-2020-6111
Published: 2020-12-03
Description: An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B FRN 16.000, Series B FRN 15.002, Series B FRN 15.000, Series B FRN 14.000, Series B FRN 13.000, Series B FRN 12.000, Series B FRN 11.000 and Series B FRN 10.000. A specially crafted packet can cause a major error, resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1057; https://us-cert.cisa.gov/ics/advisories/icsa-21-047-02; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1057
CVE: CVE-2020-6017
Published: 2020-12-03
Description: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured to support plain-text messages, leading to a Heap-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://github.com/ValveSoftware/GameNetworkingSockets/commit/e0c86dcb9139771db3db0cfdb1fb8bef0af19c43; https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/; https://github.com/ValveSoftware/GameNetworkingSockets/commit/e0c86dcb9139771db3db0cfdb1fb8bef0af19c43
CVE: CVE-2020-6021
Published: 2020-12-03
Description: Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DLL in the repair folder which will run with the Endpoint client’s privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://supportcontent.checkpoint.com/solutions?id=sk170512; https://supportcontent.checkpoint.com/solutions?id=sk170512
CVE: CVE-2020-14318
Published: 2020-12-03
Description: A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=1892631; https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html; https://security.gentoo.org/glsa/202012-24
CVE: CVE-2020-28937
Published: 2020-12-03
Description: OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information (PHI) stored in the application, via a direct request for the /tests/ URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-425
References: https://labs.bishopfox.com/advisories/openclinic-version-0.8.2; https://labs.bishopfox.com/advisories/openclinic-version-0.8.2
CVE: CVE-2020-28938
Published: 2020-12-03
Description: OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://labs.bishopfox.com/advisories/openclinic-version-0.8.2; https://labs.bishopfox.com/advisories/openclinic-version-0.8.2
CVE: CVE-2020-28939
Published: 2020-12-03
Description: OpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability. This vulnerability allows authenticated users (with substantial privileges) to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://labs.bishopfox.com/advisories/openclinic-version-0.8.2; https://labs.bishopfox.com/advisories/openclinic-version-0.8.2
CVE: CVE-2020-2320
Published: 2020-12-03
Description: Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: http://www.openwall.com/lists/oss-security/2020/12/03/2; https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-1856; http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE: CVE-2020-2321
Published: 2020-12-03
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/12/03/2; https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2108; http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE: CVE-2020-2322
Published: 2020-12-03
Description: Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2020/12/03/2; https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%281%29; http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE: CVE-2020-2323
Published: 2020-12-03
Description: Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2020/12/03/2; https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%282%29; http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE: CVE-2020-2324
Published: 2020-12-03
Description: Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/12/03/2; https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2146; http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE: CVE-2020-13531
Published: 2020-12-03
Description: A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A specially crafted file can trigger the reuse of a freed memory which can result in further memory corruption and arbitrary code execution. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1145; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1145
CVE: CVE-2020-13542
Published: 2020-12-03
Description: A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker can either replace the service binary or replace DLL files loaded by the service, both which get executed by a service thus executing arbitrary commands with System privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1154; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1154
CVE: CVE-2020-13543
Published: 2020-12-03
Description: A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://security.gentoo.org/glsa/202012-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1155; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2020-13584
Published: 2020-12-03
Description: An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY2OBQZFMEFZOSWXPXHPEHOJXXILEEX2/; https://security.gentoo.org/glsa/202012-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1195
CVE: CVE-2020-14339
Published: 2020-12-03
Description: A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772, CWE-772
References: https://bugzilla.redhat.com/show_bug.cgi?id=1860069; https://security.gentoo.org/glsa/202101-22; https://security.gentoo.org/glsa/202210-06
CVE: CVE-2020-14351
Published: 2020-12-03
Description: A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1862849; https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
CVE: CVE-2020-14381
Published: 2020-12-03
Description: A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1874311; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8019ad13ef7f64be44d4f892af9c[PII_REDACTED]54; https://bugzilla.redhat.com/show_bug.cgi?id=1874311
CVE: CVE-2020-23735
Published: 2020-12-03
Description: In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constructed program to increase user privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://www.saibo.com; https://github.com/y5s5k5/CVE-2020-23735; http://www.saibo.com
CVE: CVE-2020-25649
Published: 2020-12-03
Description: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://bugzilla.redhat.com/show_bug.cgi?id=1887664; https://github.com/FasterXML/jackson-databind/issues/2589; https://lists.apache.org/thread.html/r011d1430e8f40dff9550c3bc5d0f48b14c01ba8aecabd91d5e495386%40%3Ccommits.turbine.apache.org%3E
CVE: CVE-2020-25693
Published: 2020-12-03
Description: A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190, CWE-190, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1893377; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERBZALTF7LXN2LZLPGAUSVMV53GHHTUC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5Q7NNUPXATTBUKHFKIYYAV5GJDYCZL/
CVE: CVE-2020-25711
Published: 2020-12-03
Description: A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1897618; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1897618
CVE: CVE-2020-27759
Published: 2020-12-03
Description: In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type `int` to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.
CVSS Score: 3.3 (LOW)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894238; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27760
Published: 2020-12-03
Description: In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. The patch uses the `PerceptibleReciprocal()` to prevent the divide-by-zero from occurring. This flaw affects ImageMagick versions prior to ImageMagick 7.0.8-68.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894239; https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27761
Published: 2020-12-03
Description: WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
CVSS Score: 3.3 (LOW)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894679; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-27762
Published: 2020-12-03
Description: A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to ImageMagick 7.0.8-68.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894680; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html