deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21313
Published: 2021-03-03
Description: GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which parameter you act) to exploit the vulnerability:/ajax/common.tabs.php?_target=javascript:alert(document.cookie)&_itemtype=DisplayPreference&_glpi_tab=DisplayPreference$2&id=258&displaytype=Ticket (Payload triggered if you click on the button). /ajax/common.tabs.php?_target=/front/ticket.form.php&_itemtype=Ticket&_glpi_tab=Ticket$1&id=(){};(function%20(){alert(document.cookie);})();function%20a&#.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/glpi-project/glpi/releases/tag/9.5.4; https://github.com/glpi-project/glpi/security/advisories/GHSA-h4hj-mrpg-xfgx; https://github.com/glpi-project/glpi/releases/tag/9.5.4
CVE: CVE-2021-21314
Published: 2021-03-03
Description: GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/releases/tag/9.5.4; https://github.com/glpi-project/glpi/security/advisories/GHSA-2w7j-xgj7-3xgg; https://github.com/glpi-project/glpi/releases/tag/9.5.4
CVE: CVE-2021-27931
Published: 2021-03-03
Description: LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt; https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt
CVE: CVE-2021-27935
Published: 2021-03-03
Description: An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of the password is stored in the cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/AdguardTeam/AdGuardHome/issues/2470; https://github.com/AdguardTeam/AdGuardHome/issues/2470
CVE: CVE-2021-27940
Published: 2021-03-03
Description: resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/openark/orchestrator/pull/1313; https://github.com/openark/orchestrator/releases/tag/v3.2.4; https://www.youtube.com/watch?v=DOYm0DIS3Us
CVE: CVE-2021-21331
Published: 2021-03-03
Description: The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system. Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. This issue has been patched in version 1.0.0-beta.9. As a workaround one may specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.
CVSS Score: 3.0 (LOW)
CWE: CWE-378, CWE-379
References: https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9; https://github.com/DataDog/datadog-api-client-java/security/advisories/GHSA-2cxf-6567-7pp6; https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9
CVE: CVE-2019-18628
Published: 2021-03-04
Description: Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a user with administrative privileges to turn off data encryption on the device, thus leaving it open to potential cryptographic information disclosure.
CVSS Score: 4.9 (MEDIUM)
References: https://security.business.xerox.com; https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx_v1.1.pdf; https://security.business.xerox.com
CVE: CVE-2019-18629
Published: 2021-03-04
Description: Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a compromised private key.
CVSS Score: 8.1 (HIGH)
References: https://security.business.xerox.com; https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX19AI_for_ALB80xx-C80xx_v1.1.pdf; https://security.business.xerox.com
CVE: CVE-2020-24036
Published: 2021-03-04
Description: PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://forkcms.com; http://seclists.org/fulldisclosure/2021/Mar/31; https://tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036
CVE: CVE-2020-24912
Published: 2021-03-04
Description: A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://qcubed.com; http://seclists.org/fulldisclosure/2021/Mar/30; https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912
CVE: CVE-2020-24913
Published: 2021-03-04
Description: A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://qcubed.com; http://seclists.org/fulldisclosure/2021/Mar/29; http://seclists.org/fulldisclosure/2021/Mar/30
CVE: CVE-2020-24914
Published: 2021-03-04
Description: A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://qcubed.com; http://seclists.org/fulldisclosure/2021/Mar/28; https://tech.feedyourhead.at/content/QCubed-PHP-Object-Injection-CVE-2020-24914
CVE: CVE-2021-22183
Published: 2021-03-04
Description: An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22183.json; https://gitlab.com/gitlab-org/gitlab/-/issues/294176; https://hackerone.com/reports/1055814
CVE: CVE-2021-22189
Published: 2021-03-04
Description: Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22189.json; https://gitlab.com/gitlab-org/gitlab/-/issues/296557; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22189.json
CVE: CVE-2020-35327
Published: 2021-03-04
Description: SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POST) parameter to admin_class.php
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49243; https://www.exploit-db.com/exploits/49243
CVE: CVE-2020-35328
Published: 2021-03-04
Description: Courier Management System 1.0 - 'First Name' Stored XSS
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49241; https://www.exploit-db.com/exploits/49241
CVE: CVE-2020-35329
Published: 2021-03-04
Description: Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49242; https://www.exploit-db.com/exploits/49242
CVE: CVE-2021-23344
Published: 2021-03-04
Description: The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/totaljs/framework/commit/c812bbcab8981797d3a1b9993fc42dad3d246f04; https://snyk.io/vuln/SNYK-JS-TOTALJS-1077069; https://github.com/totaljs/framework/commit/c812bbcab8981797d3a1b9993fc42dad3d246f04
CVE: CVE-2021-23346
Published: 2021-03-04
Description: This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
CVSS Score: 4.8 (MEDIUM)
References: https://github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2; https://github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12; https://github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2
CVE: CVE-2020-15938
Published: 2021-03-04
Description: When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header.
CVSS Score: 4.0 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-20-172; https://fortiguard.com/advisory/FG-IR-20-172
CVE: CVE-2021-22128
Published: 2021-03-04
Description: An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.
CVSS Score: 7.1 (HIGH)
References: https://fortiguard.com/advisory/FG-IR-20-235; https://fortiguard.com/advisory/FG-IR-20-235
CVE: CVE-2021-23126
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-338
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-insecure-randomness-within-2fa-secret-generation.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-insecure-randomness-within-2fa-secret-generation.html
CVE: CVE-2021-23127
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.
CVSS Score: 9.1 (CRITICAL)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-insecure-randomness-within-2fa-secret-generation.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-insecure-randomness-within-2fa-secret-generation.html
CVE: CVE-2021-23128
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.
CVSS Score: 9.1 (CRITICAL)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-potential-insecure-fofencryptrandval.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-potential-insecure-fofencryptrandval.html
CVE: CVE-2021-23129
Published: 2021-03-04
Description: An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-within-alert-messages-showed-to-users.html; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-within-alert-messages-showed-to-users.html
CVE: CVE-2021-23130
Published: 2021-03-04
Description: An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-xss-within-the-feed-parser-library.html; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-xss-within-the-feed-parser-library.html
CVE: CVE-2021-23131
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-input-validation-within-the-template-manager.html; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-input-validation-within-the-template-manager.html
CVE: CVE-2021-23132
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads
CVSS Score: 7.5 (HIGH)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-com-media-allowed-paths-that-are-not-intended-for-image-uploads.html; https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-com-media-allowed-paths-that-are-not-intended-for-image-uploads.html
CVE: CVE-2021-26027
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://developer.joomla.org/security-centre/[PII_REDACTED]7-core-acl-violation-within-com-content-frontend-editing.html; https://developer.joomla.org/security-centre/[PII_REDACTED]7-core-acl-violation-within-com-content-frontend-editing.html
CVE: CVE-2021-26028
Published: 2021-03-04
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://developer.joomla.org/security-centre/[PII_REDACTED]8-core-path-traversal-within-joomla-archive-zip-class.html; https://developer.joomla.org/security-centre/[PII_REDACTED]8-core-path-traversal-within-joomla-archive-zip-class.html
CVE: CVE-2021-26029
Published: 2021-03-04
Description: An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.
CVSS Score: 5.3 (MEDIUM)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]9-core-inadequate-filtering-of-form-contents-could-allow-to-overwrite-the-author-field.html; https://developer.joomla.org/security-centre/[PII_REDACTED]9-core-inadequate-filtering-of-form-contents-could-allow-to-overwrite-the-author-field.html
CVE: CVE-2021-27217
Published: 2021-03-04
Description: An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aes_remove_padding() can crash the running process, depending on the memory layout. This could be used by an attacker to cause a client-side denial of service. The yubihsm-shell project is included in the YubiHSM 2 SDK product.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://blog.inhq.net/posts/yubico-libyubihsm-vuln2; https://github.com/Yubico/yubihsm-shell/releases; https://www.yubico.com/support/security-advisories/ysa-2021-01/
CVE: CVE-2020-4856
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190459.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190459; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/190459
CVE: CVE-2020-4857
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190460.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190460; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/190460
CVE: CVE-2020-4863
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190566; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/190566
CVE: CVE-2020-4866
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190742.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190742; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/190742
CVE: CVE-2020-4975
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192435; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/192435
CVE: CVE-2021-20340
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194451.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/194451; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/194451
CVE: CVE-2021-20350
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194707.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/194707; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/194707
CVE: CVE-2021-20351
Published: 2021-03-04
Description: IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194708.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/194708; https://www.ibm.com/support/pages/node/6417585; https://exchange.xforce.ibmcloud.com/vulnerabilities/194708
CVE: CVE-2020-28601
Published: 2021-03-04
Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-125
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
CVE: CVE-2020-28636
Published: 2021-03-04
Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-125
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
CVE: CVE-2020-35628
Published: 2021-03-04
Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-125
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
CVE: CVE-2020-35636
Published: 2021-03-04
Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-125, CWE-843
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225