deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28187
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4557-1019f-1.html
CVE: CVE-2021-28188
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4558-ad16e-1.html
CVE: CVE-2021-28189
Published: 2021-04-06
Description: The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4559-ad2b5-1.html
CVE: CVE-2021-28190
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4560-2f01f-1.html
CVE: CVE-2021-28191
Published: 2021-04-06
Description: The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4561-062d0-1.html
CVE: CVE-2021-28192
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4562-4b207-1.html
CVE: CVE-2021-28193
Published: 2021-04-06
Description: The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4563-e4092-1.html
CVE: CVE-2021-28194
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4564-7ef3d-1.html
CVE: CVE-2021-28195
Published: 2021-04-06
Description: The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4565-59c97-1.html
CVE: CVE-2021-28196
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4566-9154b-1.html
CVE: CVE-2021-28197
Published: 2021-04-06
Description: The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4567-34350-1.html
CVE: CVE-2021-28198
Published: 2021-04-06
Description: The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4568-627f7-1.html
CVE: CVE-2021-28199
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4569-6b391-1.html
CVE: CVE-2021-28200
Published: 2021-04-06
Description: The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4570-4d216-1.html
CVE: CVE-2021-28201
Published: 2021-04-06
Description: The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4571-d454c-1.html
CVE: CVE-2021-28202
Published: 2021-04-06
Description: The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4571-d454c-1.html
CVE: CVE-2021-28203
Published: 2021-04-06
Description: The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html
CVE: CVE-2021-28204
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html
CVE: CVE-2021-28205
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html
CVE: CVE-2021-28206
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4576-422ac-1.html
CVE: CVE-2021-28207
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4577-60153-1.html
CVE: CVE-2021-28208
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4578-e5d74-1.html
CVE: CVE-2021-28209
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4579-c8827-1.html
CVE: CVE-2021-30144
Published: 2021-04-06
Description: The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/dashboard-plugin; https://plugins.glpi-project.org/#/plugin/dashboard; https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/dashboard-plugin
CVE: CVE-2021-30149
Published: 2021-04-06
Description: Composr 10.0.36 allows upload and execution of PHP files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/162128/Composr-10.0.36-Shell-Upload.html; https://gitlab.com/composr-foundation/composr/commit/a71c44e03; http://packetstormsecurity.com/files/162128/Composr-10.0.36-Shell-Upload.html
CVE: CVE-2021-30150
Published: 2021-04-06
Description: Composr 10.0.36 allows XSS in an XML script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162111/Composr-CMS-10.0.36-Cross-Site-Scripting.html; https://gitlab.com/composr-foundation/composr/commit/833a06466; http://packetstormsecurity.com/files/162111/Composr-CMS-10.0.36-Cross-Site-Scripting.html
CVE: CVE-2021-30151
Published: 2021-04-06
Description: Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mperham/sidekiq/issues/4852; https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
CVE: CVE-2021-30154
Published: 2021-04-06
Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/; https://phabricator.wikimedia.org/T278014
CVE: CVE-2021-30157
Published: 2021-04-06
Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/; https://phabricator.wikimedia.org/T278058
CVE: CVE-2021-30158
Published: 2021-04-06
Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html; https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
CVE: CVE-2019-25026
Published: 2021-04-06
Description: Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE: CVE-2020-36306
Published: 2021-04-06
Description: Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE: CVE-2020-36307
Published: 2021-04-06
Description: Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE: CVE-2020-36308
Published: 2021-04-06
Description: Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE: CVE-2021-30161
Published: 2021-04-06
Description: An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an incoming call has been terminated. The LG ID is LVE-SMP-210002 (April 2021).
CVSS Score: 5.5 (MEDIUM)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2021-30162
Published: 2021-04-06
Description: An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific content providers. The LG ID is LVE-SMP-210003 (April 2021).
CVSS Score: 7.1 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2021-30163
Published: 2021-04-06
Description: Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.
CVSS Score: 7.5 (HIGH)
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE: CVE-2021-30164
Published: 2021-04-06
Description: Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE: CVE-2021-28171
Published: 2021-04-06
Description: The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data in the Cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-565
References: https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66; https://www.twcert.org.tw/tw/cp-132-4618-4dcc2-1.html; https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66
CVE: CVE-2021-28172
Published: 2021-04-06
Description: There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66; https://www.twcert.org.tw/tw/cp-132-4619-fd2b9-1.html; https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66
CVE: CVE-2021-28173
Published: 2021-04-06
Description: The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execute arbitrary files without login.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66; https://www.twcert.org.tw/tw/cp-132-4620-58f9c-1.html; https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66
CVE: CVE-2021-27343
Published: 2021-04-06
Description: SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/LibCrypto/ASN1/DER.h Crypto::der_decode_sequence() function. The attack vector is: Parsing RSA Key ASN.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/SerenityOS/serenity/commit/48fbf6a88d4822a1e5470cf08f29464511bd72c1; https://github.com/SerenityOS/serenity/issues/5317; https://github.com/SerenityOS/serenity/pull/5344
CVE: CVE-2021-27357
Published: 2021-04-06
Description: RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/RIOT-OS/RIOT/issues/16018; https://github.com/RIOT-OS/RIOT/issues/16018
CVE: CVE-2021-27697
Published: 2021-04-06
Description: RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the gnrc_rpl_validation_options() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/RIOT-OS/RIOT/issues/16062; https://github.com/RIOT-OS/RIOT/issues/16062
CVE: CVE-2021-27698
Published: 2021-04-06
Description: RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c through the _parse_options() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/RIOT-OS/RIOT/issues/16085; https://github.com/RIOT-OS/RIOT/issues/16085
CVE: CVE-2021-28075
Published: 2021-04-06
Description: iKuaiOS 3.4.8 Build[PII_REDACTED]59 has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://www.cnvd.org.cn/flaw/show/CNVD-2021-03496; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03496
CVE: CVE-2021-28874
Published: 2021-04-06
Description: SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/SerenityOS/serenity/commit/c9f25bca048443e317f1994ba9b106f2386688c3; https://github.com/SerenityOS/serenity/issues/5769; https://github.com/SerenityOS/serenity/pull/5802
CVE: CVE-2021-30045
Published: 2021-04-06
Description: SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://github.com/SerenityOS/serenity/commit/4317db7498eaa5a37068052bb0310fbc6a5f78e4; https://github.com/SerenityOS/serenity/issues/5975; https://github.com/SerenityOS/serenity/pull/5977
CVE: CVE-2021-30046
Published: 2021-04-06
Description: VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read_image_band() function, in which a crafted file can cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://github.com/ukoethe/vigra/issues/494; https://github.com/ukoethe/vigra/issues/494