deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22734
Published: 2021-05-26
Description: Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause remote code execution when an attacker loads unauthorized code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22735
Published: 2021-05-26
Description: Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could allow remote code execution when unauthorized code is copied to the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22736
Published: 2021-05-26
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a denial of service when an unauthorized file is uploaded.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22737
Published: 2021-05-26
Description: Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access of when credentials are discovered after a brute force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22738
Published: 2021-05-26
Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access when credentials are discovered after a brute force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22739
Published: 2021-05-26
Description: Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is first configured.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22740
Published: 2021-05-26
Description: Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be exposed when an unauthorized file is uploaded.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22741
Published: 2021-05-26
Description: Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-916
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-07
CVE: CVE-2021-22742
Published: 2021-05-26
Description: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position.
CVSS Score: 3.9 (LOW)
CWE: CWE-754, CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03
CVE: CVE-2021-22743
Published: 2021-05-26
Description: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TCM 4351B installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position.
CVSS Score: 3.9 (LOW)
CWE: CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03
CVE: CVE-2021-22744
Published: 2021-05-26
Description: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position. This CVE ID is unique from CVE-2021-22742, CVE-2021-22745, CVE-2021-22746, and CVE-2021-22747.
CVSS Score: 3.9 (LOW)
CWE: CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03
CVE: CVE-2021-22745
Published: 2021-05-26
Description: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position. This CVE ID is unique from CVE-2021-22742, CVE-2021-22744, CVE-2021-22746, and CVE-2021-22747.
CVSS Score: 3.9 (LOW)
CWE: CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03
CVE: CVE-2021-22746
Published: 2021-05-26
Description: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position. This CVE ID is unique from CVE-2021-22742, CVE-2021-22744, CVE-2021-22745, and CVE-2021-22747.
CVSS Score: 3.9 (LOW)
CWE: CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03
CVE: CVE-2021-22747
Published: 2021-05-26
Description: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position. This CVE ID is unique from CVE-2021-22742, CVE-2021-22744, CVE-2021-22745, and CVE-2021-22746.
CVSS Score: 3.9 (LOW)
CWE: CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-03
CVE: CVE-2020-22024
Published: 2021-05-26
Description: Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c, which could let a remote malicious user cause Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://trac.ffmpeg.org/ticket/8310; https://trac.ffmpeg.org/ticket/8310
CVE: CVE-2020-22026
Published: 2021-05-26
Description: Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8317; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22028
Published: 2021-05-26
Description: Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8274; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-25634
Published: 2021-05-26
Description: A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-306
References: https://bugzilla.redhat.com/show_bug.cgi?id=1880201; https://bugzilla.redhat.com/show_bug.cgi?id=1880201
CVE: CVE-2020-25724
Published: 2021-05-26
Description: A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-567
References: https://bugzilla.redhat.com/show_bug.cgi?id=1899354; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1899354
CVE: CVE-2021-20177
Published: 2021-05-26
Description: A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1914719; https://bugzilla.redhat.com/show_bug.cgi?id=1914719
CVE: CVE-2021-20191
Published: 2021-05-26
Description: A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1916813; https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html; https://bugzilla.redhat.com/show_bug.cgi?id=1916813
CVE: CVE-2021-20297
Published: 2021-05-26
Description: A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943282; https://bugzilla.redhat.com/show_bug.cgi?id=1943282
CVE: CVE-2021-25643
Published: 2021-05-26
Description: An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-319
References: https://www.couchbase.com/resources/security#SecurityAlerts; https://www.couchbase.com/resources/security#SecurityAlerts
CVE: CVE-2021-3548
Published: 2021-05-26
Description: A flaw was found in dmg2img through 20170502. dmg2img did not validate the size of the read buffer during memcpy() inside the main() function. This possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1959585; https://bugzilla.redhat.com/show_bug.cgi?id=1959585
CVE: CVE-2021-3549
Published: 2021-05-26
Description: An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1960717; https://security.gentoo.org/glsa/202208-30; https://bugzilla.redhat.com/show_bug.cgi?id=1960717
CVE: CVE-2008-3523
Published: 2021-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA
CVE: CVE-2008-5084
Published: 2021-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA
CVE: CVE-2008-5085
Published: 2021-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA
CVE: CVE-2008-5509
Published: 2021-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs:CVE-2008-5508. Reason: This candidate is a duplicate of CVE-2008-5508. Notes: All CVE users should reference CVE-2008-5508 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-3721
Published: 2021-05-26
Description: Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.ocert.org/advisories/ocert-2009-013.html; https://bugzilla.redhat.com/show_bug.cgi?id=521662; http://www.ocert.org/advisories/ocert-2009-013.html
CVE: CVE-2020-10695
Published: 2021-05-26
Description: An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://bugzilla.redhat.com/show_bug.cgi?id=1817530; https://bugzilla.redhat.com/show_bug.cgi?id=1817530
CVE: CVE-2020-27839
Published: 2021-05-26
Description: A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1901330; https://bugzilla.redhat.com/show_bug.cgi?id=1901330
CVE: CVE-2021-20196
Published: 2021-05-26
Description: A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugs.launchpad.net/qemu/+bug/1912780; https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2021-25217
Published: 2021-05-26
Description: In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.
CVSS Score: 7.4 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2021/05/26/6; https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
CVE: CVE-2021-28170
Published: 2021-05-26
Description: In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-917
References: https://github.com/eclipse-ee4j/el-ri/issues/155; https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2021-30469
Published: 2021-05-26
Description: A flaw was found in PoDoFo 0.9.7. An use-after-free in PoDoFo::PdfVecObjects::Clear() function can cause a denial of service via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947433; https://bugzilla.redhat.com/show_bug.cgi?id=1947433
CVE: CVE-2021-30470
Published: 2021-05-26
Description: A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType() functions can lead to a stack overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947436; https://bugzilla.redhat.com/show_bug.cgi?id=1947436
CVE: CVE-2021-30471
Published: 2021-05-26
Description: A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a stack overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947441; https://bugzilla.redhat.com/show_bug.cgi?id=1947441
CVE: CVE-2021-30472
Published: 2021-05-26
Description: A flaw was found in PoDoFo 0.9.7. A stack-based buffer overflow in PdfEncryptMD5Base::ComputeOwnerKey function in PdfEncrypt.cpp is possible because of a improper check of the keyLength value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947458; https://bugzilla.redhat.com/show_bug.cgi?id=1947458
CVE: CVE-2021-30498
Published: 2021-05-26
Description: A flaw was found in libcaca. A heap buffer overflow in export.c in function export_tga might lead to memory corruption and other potential consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1948675; https://github.com/cacalabs/libcaca/issues/53; https://lists.debian.org/debian-lts-announce/2024/04/msg00004.html
CVE: CVE-2021-32614
Published: 2021-05-26
Description: A flaw was found in dmg2img through 20170502. fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The length of the buffer is controlled by an attacker. By providing a length smaller than 0xCC, memcpy reaches out of the malloc'ed bound. This possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1959911; https://bugzilla.redhat.com/show_bug.cgi?id=1959911
CVE: CVE-2021-3486
Published: 2021-05-26
Description: GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947653; https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS; https://n3k00n3.github.io/blog/09042021/glpi_xss.html
CVE: CVE-2021-3527
Published: 2021-05-26
Description: A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=1955695; https://gitlab.com/qemu-project/qemu/-/commit/05a40b172e4d[PII_REDACTED]28078be47e7fff524c; https://gitlab.com/qemu-project/qemu/-/commit/7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986
CVE: CVE-2021-3561
Published: 2021-05-26
Description: An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in read_objects() could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1955675; https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C44WSY5KAQXC3Y2NMSVXXZS3M5U5U2E6/
CVE: CVE-2020-27831
Published: 2021-05-27
Description: A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1905758; https://bugzilla.redhat.com/show_bug.cgi?id=1905758
CVE: CVE-2021-30499
Published: 2021-05-27
Description: A flaw was found in libcaca. A buffer overflow of export.c in function export_troff might lead to memory corruption and other potential consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1948679; https://github.com/cacalabs/libcaca/issues/54; https://lists.debian.org/debian-lts-announce/2024/04/msg00004.html
CVE: CVE-2021-30500
Published: 2021-05-27
Description: Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1948692; https://github.com/upx/upx/commit/90279abdfcd235172eab[PII_REDACTED]1188938dcc; https://github.com/upx/upx/issues/485