deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11247
Published: 2021-04-07
Description: Out of bound memory read while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11251
Published: 2021-04-07
Description: Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11252
Published: 2021-04-07
Description: Trustzone initialization code will disable xPU`s when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11255
Published: 2021-04-07
Description: Denial of service while processing RTCP packets containing multiple SDES reports due to memory for last SDES packet is freed and rest of the memory is leaked in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2021-1892
Published: 2021-04-07
Description: Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2021-20684
Published: 2021-04-07
Description: Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97370614/index.html; https://jvn.jp/en/jp/JVN97370614/index.html
CVE: CVE-2021-20685
Published: 2021-04-07
Description: Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN12559271/index.html; https://jvn.jp/en/jp/JVN12559271/index.html
CVE: CVE-2021-20686
Published: 2021-04-07
Description: Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN42220311/index.html; https://jvn.jp/en/jp/JVN42220311/index.html
CVE: CVE-2021-20687
Published: 2021-04-07
Description: Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN11438679/index.html; https://jvn.jp/en/jp/JVN11438679/index.html
CVE: CVE-2021-20688
Published: 2021-04-07
Description: Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN93207949/index.html; https://jvn.jp/en/jp/JVN93207949/index.html
CVE: CVE-2021-20689
Published: 2021-04-07
Description: Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN37179202/index.html; https://jvn.jp/en/jp/JVN37179202/index.html
CVE: CVE-2021-20690
Published: 2021-04-07
Description: Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN83042295/index.html; https://jvn.jp/en/jp/JVN83042295/index.html
CVE: CVE-2021-20691
Published: 2021-04-07
Description: Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN94705238/index.html; https://jvn.jp/en/jp/JVN94705238/index.html
CVE: CVE-2021-20692
Published: 2021-04-07
Description: Directory traversal vulnerability in Archive collectively operation utility Ver.2.10.1.0 and earlier allows an attacker to create or overwrite files by leading a user to expand a malicious ZIP archives.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://www.eikisoft.com/release01.html; https://jvn.jp/en/jp/JVN73236007/index.html; http://www.eikisoft.com/release01.html
CVE: CVE-2021-26709
Published: 2021-04-07
Description: D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162133/D-Link-DSL-320B-D1-Pre-Authentication-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2021/Apr/15; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10216
CVE: CVE-2021-30177
Published: 2021-04-07
Description: There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47; https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47
CVE: CVE-2020-36314
Published: 2021-04-07
Description: fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.
CVSS Score: 3.9 (LOW)
CWE: CWE-59
References: https://gitlab.gnome.org/GNOME/file-roller/-/commit/e970f4966bf388f6e7c277357c8b186c645683ae; https://gitlab.gnome.org/GNOME/file-roller/-/issues/108; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KJBZVCHQ4SSX2JAJZVJ5J4P3GEMXJ75/
CVE: CVE-2021-30184
Published: 2021-04-07
Description: GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in frontend/cmd.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QC74RWMDLSQGV6Z3ZABNTPABB33S4YNF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOGPLC77ZL2FACSOE5MWDS3YH3RBNQAQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXOTMUSBVUZNA3JMPG6BU37DQW2YOJWS/
CVE: CVE-2021-21639
Published: 2021-04-07
Description: Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/04/07/2; https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-1721; http://www.openwall.com/lists/oss-security/2021/04/07/2
CVE: CVE-2021-21640
Published: 2021-04-07
Description: Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/04/07/2; https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-1871; http://www.openwall.com/lists/oss-security/2021/04/07/2
CVE: CVE-2021-21641
Published: 2021-04-07
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/04/07/2; https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-2293; http://www.openwall.com/lists/oss-security/2021/04/07/2
CVE: CVE-2021-30185
Published: 2021-04-07
Description: CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
CVSS Score: 7.5 (HIGH)
References: https://github.com/indico/indico/releases/tag/v2.3.4; https://www.shorebreaksecurity.com/blog/; https://github.com/indico/indico/releases/tag/v2.3.4
CVE: CVE-2020-24136
Published: 2021-04-07
Description: Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://github.com/secwx/research/blob/main/cve/CVE-2020-24136.md; https://github.com/vedees/wcms/issues/12; https://github.com/secwx/research/blob/main/cve/CVE-2020-24136.md
CVE: CVE-2020-24138
Published: 2021-04-07
Description: Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/secwx/research/blob/main/cve/CVE-2020-24138.md; https://github.com/vedees/wcms/issues/10; https://github.com/secwx/research/blob/main/cve/CVE-2020-24138.md
CVE: CVE-2020-25584
Published: 2021-04-07
Description: In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:10.jail_mount.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:10.jail_mount.asc
CVE: CVE-2021-28927
Published: 2021-04-07
Description: The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://libretro.com; http://retroarch.com; https://github.com/libretro/RetroArch/blob/d3dc3ee989ec6a4903c689907ffc47027f71f776/frontend/drivers/platform_win32.c
CVE: CVE-2021-29626
Published: 2021-04-07
Description: In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, copy-on-write logic failed to invalidate shared memory page mappings between multiple processes allowing an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:08.vm.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:08.vm.asc
CVE: CVE-2021-29627
Published: 2021-04-07
Description: In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free or use after free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-416
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:09.accept_filter.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:09.accept_filter.asc
CVE: CVE-2020-24135
Published: 2021-04-07
Description: A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/secwx/research/blob/main/cve/CVE-2020-24135.md; https://github.com/vedees/wcms/issues/9; https://github.com/secwx/research/blob/main/cve/CVE-2020-24135.md
CVE: CVE-2020-24137
Published: 2021-04-07
Description: Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the path parameter to wex/cssjs.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/secwx/research/blob/main/cve/CVE-2020-24137.md; https://github.com/vedees/wcms/issues/7; https://github.com/secwx/research/blob/main/cve/CVE-2020-24137.md
CVE: CVE-2020-24139
Published: 2021-04-07
Description: Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services.
CVSS Score: 8.3 (HIGH)
CWE: CWE-918
References: https://github.com/secwx/research/blob/main/cve/CVE-2020-24139.md; https://github.com/vedees/wcms/issues/8; https://github.com/secwx/research/blob/main/cve/CVE-2020-24139.md
CVE: CVE-2020-24140
Published: 2021-04-07
Description: Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services.
CVSS Score: 8.3 (HIGH)
CWE: CWE-918
References: https://github.com/secwx/research/blob/main/cve/CVE-2020-24140.md; https://github.com/vedees/wcms/issues/11; https://github.com/secwx/research/blob/main/cve/CVE-2020-24140.md
CVE: CVE-2021-21425
Published: 2021-04-07
Description: Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html; http://packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.html; https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj
CVE: CVE-2021-28166
Published: 2021-04-07
Description: In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=572608; https://bugs.eclipse.org/bugs/show_bug.cgi?id=572608
CVE: CVE-2013-1054
Published: 2021-04-07
Description: The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://launchpad.net/bugs/1175661; https://ubuntu.com/USN-2743-3; https://launchpad.net/bugs/1175661
CVE: CVE-2013-1055
Published: 2021-04-07
Description: The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://launchpad.net/bugs/1175691; https://ubuntu.com/USN-2743-3; https://launchpad.net/bugs/1175691
CVE: CVE-2021-30123
Published: 2021-04-07
Description: FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=d6f293353c94c7ce200f6e0975ae3de49787f91f; https://security.gentoo.org/glsa/202105-24; https://trac.ffmpeg.org/ticket/8845
CVE: CVE-2020-36315
Published: 2021-04-07
Description: In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. NOTE: this requires that a low public exponent (such as 3) is being used. The product, by default, does not generate RSA keys with such a low number.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://github.com/relic-toolkit/relic/; https://github.com/relic-toolkit/relic/commit/76c9a1fdf19d9e92e566a77376673e522aae9f80; https://github.com/relic-toolkit/relic/issues/154
CVE: CVE-2020-36316
Published: 2021-04-07
Description: In RELIC before 2021-04-03, there is a buffer overflow in PKCS#1 v1.5 signature verification because garbage bytes can be present.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/relic-toolkit/relic/; https://github.com/relic-toolkit/relic/commit/76c9a1fdf19d9e92e566a77376673e522aae9f80; https://github.com/relic-toolkit/relic/issues/155
CVE: CVE-2021-26758
Published: 2021-04-07
Description: Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://docs.unsafe-inline.com/0day/openlitespeed-web-server-1.7.8-command-injection-to-privilege-escalation-cve-2021-26758; https://github.com/litespeedtech/openlitespeed/issues/217; https://www.exploit-db.com/exploits/49556
CVE: CVE-2021-30246
Published: 2021-04-07
Description: In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347
References: https://github.com/kjur/jsrsasign/issues/478; https://github.com/kjur/jsrsasign/releases/tag/10.1.13; https://kjur.github.io/jsrsasign/
CVE: CVE-2021-29641
Published: 2021-04-07
Description: Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-File-Upload-Rule-Bypass.html; http://seclists.org/fulldisclosure/2021/Apr/14; https://hub.docker.com/layers/directus/directus/v8.8.2-apache/images/sha256-d9898b6442b0150c3c377b50e706757f35d2d563bd82ddaf97f3ae4ba450a6e6?context=explore
CVE: CVE-2021-30454
Published: 2021-04-07
Description: An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://rustsec.org/advisories/RUSTSEC-2021-0051.html; https://rustsec.org/advisories/RUSTSEC-2021-0051.html
CVE: CVE-2021-30455
Published: 2021-04-07
Description: An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in IdMap::clone_from upon a .clone panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0052.html; https://rustsec.org/advisories/RUSTSEC-2021-0052.html
CVE: CVE-2021-30456
Published: 2021-04-07
Description: An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in get_or_insert upon a panic of a user-provided f function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0052.html; https://rustsec.org/advisories/RUSTSEC-2021-0052.html
CVE: CVE-2021-30457
Published: 2021-04-07
Description: An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in remove_set upon a panic in a Drop impl.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0052.html; https://rustsec.org/advisories/RUSTSEC-2021-0052.html
CVE: CVE-2021-1137
Published: 2021-04-08
Description: Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy