deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25951
Published: 2021-06-30
Description: XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25951; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25951
CVE: CVE-2021-27902
Published: 2021-06-30
Description: An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26; https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1; https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce
CVE: CVE-2021-27903
Published: 2021-06-30
Description: An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23; https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security; https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38
CVE: CVE-2021-35956
Published: 2021-06-30
Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP[PII_REDACTED]4 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163343/AKCP-sensorProbe-SPX476-Cross-Site-Scripting.html; http://www.akcp.in.th/downloads/Firmwares/SP[PII_REDACTED]4.zip; https://tbutler.org/2021/06/28/cve-2021-35956
CVE: CVE-2021-28993
Published: 2021-06-30
Description: Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. The impact is: obtain sensitive information (remote).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://plixer.com; https://docs.plixer.com/projects/scrutinizer/en/19.1.0/system/changelog.html; http://plixer.com
CVE: CVE-2021-20107
Published: 2021-06-30
Description: There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-306
References: https://www.tenable.com/security/research/tra-2021-26-0; https://www.tenable.com/security/research/tra-2021-26-0
CVE: CVE-2021-20461
Published: 2021-06-30
Description: IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. An attacker could potentially bypass business logic to modify the appearance and behavior of the application. IBM X-Force ID: 196770.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196770; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6466729
CVE: CVE-2021-22326
Published: 2021-06-30
Description: A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space read/write capability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22370
Published: 2021-06-30
Description: There is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22372
Published: 2021-06-30
Description: There is a Security Features Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22375
Published: 2021-06-30
Description: There is a Key Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality,availability and integrity.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22376
Published: 2021-06-30
Description: A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202107-[PII_REDACTED]
CVE: CVE-2021-22380
Published: 2021-06-30
Description: There is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality and availability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-3630
Published: 2021-06-30
Description: An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may lead to crash and segmentation fault. This flaw affects DjVuLibre versions prior to 3.5.28.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1977427; https://lists.debian.org/debian-lts-announce/2021/07/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MRXCW4BUGAJLGF6IWQWUZ2YBICMZCPK/
CVE: CVE-2021-22323
Published: 2021-06-30
Description: There is an Integer Overflow Vulnerability in Huawei Smartphone. Successful exploitation of these vulnerabilities may escalate the permission to that of the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22369
Published: 2021-06-30
Description: There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Huawei Smartphone. Successful exploitation of these vulnerabilities may escalate the permission to that of the root user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22371
Published: 2021-06-30
Description: There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22373
Published: 2021-06-30
Description: There is a Defects Introduced in the Design Process Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service integrity and availability.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22374
Published: 2021-06-30
Description: There is an Improper Validation of Array Index Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause stability risks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-35970
Published: 2021-06-30
Description: Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://docs.coralproject.net/coral/api/graphql/#User; https://github.com/coralproject/talk/compare/v4.12.0...v4.12.1; https://github.com/coralproject/talk/issues/3600
CVE: CVE-2021-35971
Published: 2021-06-30
Description: Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veeam.com/kb4126; https://www.veeam.com/kb4180; https://www.veeam.com/kb4126
CVE: CVE-2021-35973
Published: 2021-06-30
Description: NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by adding the &currentsetting.htm substring to the HTTP query, a related issue to CVE-2020-27866. This directly allows the attacker to change the web UI password, and eventually to enable debug mode (telnetd) and gain a shell on the device as the admin limited-user account (however, escalation to root is simple because of weak permissions on the /etc/ directory).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697
References: https://gynvael.coldwind.pl/?lang=en&id=736; https://kb.netgear.com/000063785/Security-Advisory-for-Authentication-Bypass-on-WAC104-PSV-2021-0075; https://gynvael.coldwind.pl/?lang=en&id=736
CVE: CVE-2021-21670
Published: 2021-06-30
Description: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278; http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE: CVE-2021-21671
Published: 2021-06-30
Description: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371; http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE: CVE-2021-21672
Published: 2021-06-30
Description: Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; http://www.openwall.com/lists/oss-security/2022/04/14/2; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2329
CVE: CVE-2021-21673
Published: 2021-06-30
Description: Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
CVSS Score: 6.1 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2387; http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE: CVE-2021-21674
Published: 2021-06-30
Description: A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-1995; http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE: CVE-2021-21675
Published: 2021-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2136%20%281%29; http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE: CVE-2021-21676
Published: 2021-06-30
Description: Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to send test emails to an attacker-specified email address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/06/30/1; https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2136%20%282%29; http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE: CVE-2021-22353
Published: 2021-06-30
Description: There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause the kernel to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22354
Published: 2021-06-30
Description: There is an Information Disclosure Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-843
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22367
Published: 2021-06-30
Description: There is a Key Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to authentication bypass.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22368
Published: 2021-06-30
Description: There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-32736
Published: 2021-06-30
Description: think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp; https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp
CVE: CVE-2021-34075
Published: 2021-06-30
Description: In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522
References: https://k4m1ll0.com/cve-2021-34075.html; https://k4m1ll0.com/cve-2021-34075.html
CVE: CVE-2021-22346
Published: 2021-06-30
Description: There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to the disclosure of user habits.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22348
Published: 2021-06-30
Description: There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22349
Published: 2021-06-30
Description: There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of insufficient input verification may cause the system to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22350
Published: 2021-06-30
Description: There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause the device to crash and restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22351
Published: 2021-06-30
Description: There is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may induce users to grant permissions on modifying items in the configuration table,causing system exceptions.
CVSS Score: 8.1 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22352
Published: 2021-06-30
Description: There is a Configuration Defect Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may allow attackers to hijack the device and forge UIs to induce users to execute malicious commands.
CVSS Score: 7.8 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22345
Published: 2021-06-30
Description: There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause out-of-bounds memory write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2020-36194
Published: 2021-07-01
Description: An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-32; https://www.qnap.com/zh-tw/security-advisory/qsa-21-32
CVE: CVE-2020-36196
Published: 2021-07-01
Description: A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-30; https://www.qnap.com/zh-tw/security-advisory/qsa-21-30
CVE: CVE-2021-28802
Published: 2021-07-01
Description: A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-29; https://www.qnap.com/zh-tw/security-advisory/qsa-21-29
CVE: CVE-2021-28803
Published: 2021-07-01
Description: This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-31; https://www.qnap.com/zh-tw/security-advisory/qsa-21-31
CVE: CVE-2021-28804
Published: 2021-07-01
Description: A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-29; https://www.qnap.com/zh-tw/security-advisory/qsa-21-29
CVE: CVE-2017-20006
Published: 2021-07-01
Description: UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrentFile).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4373; https://github.com/aawc/unrar/commit/0ff832d[PII_REDACTED]3b175cfff4e40c1b08ee779; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2017-104.yaml
CVE: CVE-2018-25017
Published: 2021-07-01
Description: RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5256; https://github.com/darktable-org/rawspeed/commit/dbe7591e54bad5e6430d38be6bed051582da76b9; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/librawspeed/OSV-2018-227.yaml
CVE: CVE-2018-25018
Published: 2021-07-01
Description: UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845; https://github.com/aawc/unrar/releases; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
CVE: CVE-2019-25048
Published: 2021-07-01
Description: LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13914; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libressl/OSV-2020-1923.yaml; https://github.com/libressl-portable/portable/commit/17c88164016df821df2dff4b2b1291291ec4f28a
CVE: CVE-2019-25049
Published: 2021-07-01
Description: LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13920; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libressl/OSV-2020-1965.yaml; https://github.com/libressl-portable/portable/commit/17c88164016df821df2dff4b2b1291291ec4f28a
CVE: CVE-2020-36400
Published: 2021-07-01
Description: ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml; https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306
CVE: CVE-2020-36401
Published: 2021-07-01
Description: mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744.yaml; https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015503