deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-18230
Published: 2021-05-27
Description: Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php".
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/PearlyNautilus/Security-Code-Review/issues/4; https://github.com/PearlyNautilus/Security-Code-Review/issues/4
CVE: CVE-2021-27488
Published: 2021-05-27
Description: Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied data when parsing CATPart files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01; https://www.zerodayinitiative.com/advisories/ZDI-21-563/
CVE: CVE-2021-27492
Published: 2021-05-27
Description: When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01; https://www.zerodayinitiative.com/advisories/ZDI-21-567/
CVE: CVE-2021-27494
Published: 2021-05-27
Description: Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied data when parsing STP files. This could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01; https://www.zerodayinitiative.com/advisories/ZDI-21-564/
CVE: CVE-2021-27496
Published: 2021-05-27
Description: Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied data when parsing PRT files. This could lead to pointer dereferences of a value obtained from an untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01; https://www.zerodayinitiative.com/advisories/ZDI-21-565/
CVE: CVE-2021-27490
Published: 2021-05-27
Description: Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01; https://www.zerodayinitiative.com/advisories/ZDI-21-566/
CVE: CVE-2021-32645
Published: 2021-05-27
Description: Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164; https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6; https://packagist.org/packages/hyn/multi-tenant
CVE: CVE-2020-22029
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=a7fd[PII_REDACTED]ebb548ef7baa2f[PII_REDACTED]ae; https://trac.ffmpeg.org/ticket/8250; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22030
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://trac.ffmpeg.org/ticket/8276; https://www.debian.org/security/2021/dsa-4990; https://trac.ffmpeg.org/ticket/8276
CVE: CVE-2020-22031
Published: 2021-05-27
Description: A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/attachment/ticket/8243/gdb-vf_w3fdif_191; https://trac.ffmpeg.org/ticket/8243
CVE: CVE-2021-32643
Published: 2021-05-27
Description: Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The [patch](https://github.com/http4s/http4s/commit/52e[PII_REDACTED]b4385e37b96bc49c5e3c708e4e9) is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/http4s/http4s/commit/52e[PII_REDACTED]b4385e37b96bc49c5e3c708e4e9; https://github.com/http4s/http4s/security/advisories/GHSA-6h7w-fc84-x7p6; https://mvnrepository.com/artifact/org.http4s/http4s-core
CVE: CVE-2020-10688
Published: 2021-05-27
Description: A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1814974; https://github.com/quarkusio/quarkus/issues/7248; https://issues.redhat.com/browse/RESTEASY-2519
CVE: CVE-2020-10697
Published: 2021-05-27
Description: A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not completely stop the service, but in the worst-case scenario, it can reduce the Tower performance, for which memcached is designed. Theoretically, more sophisticated attacks can be performed by manipulating and crafting the cache, as Tower relies on memcached as a place to pull out setting values. Confidential and sensitive data stored in memcached should not be pulled, as this information is encrypted. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1818445; https://bugzilla.redhat.com/show_bug.cgi?id=1818445
CVE: CVE-2020-10698
Published: 2021-05-27
Description: A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1818924; https://bugzilla.redhat.com/show_bug.cgi?id=1818924
CVE: CVE-2020-10701
Published: 2021-05-27
Description: A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1819163; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1819163
CVE: CVE-2020-10709
Published: 2021-05-27
Description: A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287, CWE-287, CWE-613
References: https://bugzilla.redhat.com/show_bug.cgi?id=1824033; https://bugzilla.redhat.com/show_bug.cgi?id=1824033
CVE: CVE-2020-10716
Published: 2021-05-27
Description: A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://bugzilla.redhat.com/show_bug.cgi?id=1814998; https://bugzilla.redhat.com/show_bug.cgi?id=1827300; https://bugzilla.redhat.com/show_bug.cgi?id=1814998
CVE: CVE-2020-10729
Published: 2021-05-27
Description: A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://bugzilla.redhat.com/show_bug.cgi?id=1831089; https://github.com/ansible/ansible/issues/34144; https://www.debian.org/security/2021/dsa-4950
CVE: CVE-2020-10774
Published: 2021-05-27
Description: A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-805
References: https://bugzilla.redhat.com/show_bug.cgi?id=1846964; https://bugzilla.redhat.com/show_bug.cgi?id=1846964
CVE: CVE-2020-12403
Published: 2021-05-27
Description: A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1868931; https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes; https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
CVE: CVE-2020-22016
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8183; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22017
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://trac.ffmpeg.org/ticket/8309; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22022
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8264; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22023
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8244; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22025
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8260
CVE: CVE-2020-22027
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://trac.ffmpeg.org/attachment/ticket/8242/gdb-vf_neighbor_191; https://trac.ffmpeg.org/ticket/8242; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22032
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8275
CVE: CVE-2020-22033
Published: 2021-05-27
Description: A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote malicious user cause a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://trac.ffmpeg.org/ticket/8246; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22034
Published: 2021-05-27
Description: A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://trac.ffmpeg.org/ticket/8236; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2021-20026
Published: 2021-05-27
Description: A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP request. This vulnerability affects NSM On-Prem 2.2.0-R10 and earlier versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0014; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0014
CVE: CVE-2021-33394
Published: 2021-05-27
Description: Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://github.com/cubecart/v6/commit/aac7b3a13a43e302d91f94a120417b2fda737d0f; https://github.com/xoffense/POC/blob/main/Session%20Fixation%20in%20Cubecart%206.4.2.md; https://github.com/cubecart/v6/commit/aac7b3a13a43e302d91f94a120417b2fda737d0f
CVE: CVE-2020-14301
Published: 2021-05-27
Description: An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-212
References: https://bugzilla.redhat.com/show_bug.cgi?id=1848640; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1848640
CVE: CVE-2020-14327
Published: 2021-05-27
Description: A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://bugzilla.redhat.com/show_bug.cgi?id=1856785; https://bugzilla.redhat.com/show_bug.cgi?id=1856785
CVE: CVE-2020-14328
Published: 2021-05-27
Description: A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 3.3 (LOW)
CWE: CWE-918
References: https://bugzilla.redhat.com/show_bug.cgi?id=1856786; https://bugzilla.redhat.com/show_bug.cgi?id=1856786
CVE: CVE-2020-14329
Published: 2021-05-27
Description: A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1856787; https://bugzilla.redhat.com/show_bug.cgi?id=1856787
CVE: CVE-2020-14387
Published: 2021-05-27
Description: A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.
CVSS Score: 7.4 (HIGH)
CWE: CWE-297
References: https://bugzilla.redhat.com/show_bug.cgi?id=1875549; https://bugzilla.redhat.com/show_bug.cgi?id=1875549
CVE: CVE-2020-15180
Published: 2021-05-27
Description: A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-20, CWE-77
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894919; https://lists.debian.org/debian-lts-announce/2020/10/msg00021.html; https://security.gentoo.org/glsa/202011-14
CVE: CVE-2020-1701
Published: 2021-05-27
Description: A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1792092; https://bugzilla.redhat.com/show_bug.cgi?id=1792092
CVE: CVE-2020-1702
Published: 2021-05-27
Description: A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
CVSS Score: 3.3 (LOW)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1792796; https://bugzilla.redhat.com/show_bug.cgi?id=1792796
CVE: CVE-2020-1761
Published: 2021-05-27
Description: A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser. This flaw affects openshift/console versions before openshift/console-4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-358
References: https://bugzilla.redhat.com/show_bug.cgi?id=1813788; https://bugzilla.redhat.com/show_bug.cgi?id=1813788