deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28302
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28303
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28304
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28305
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28306
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28307
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28308
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28309
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28310
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28311
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28312
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28313
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28314
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28315
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28316
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28317
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28318
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28319
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28320
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28321
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28322
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28323
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28324
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28325
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28326
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-28874
Published: 2021-01-26
Description: reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-404
References: http://projectsend.com; https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e; https://github.com/projectsend/projectsend/commits/master
CVE: CVE-2020-28998
Published: 2021-01-26
Description: An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the Telnet service that allows a remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://gist.github.com/tj-oconnor/e21adcf9c0539a12ad[PII_REDACTED]cbd5; https://support.mygeeni.com/hc/en-us; https://gist.github.com/tj-oconnor/e21adcf9c0539a12ad[PII_REDACTED]cbd5
CVE: CVE-2020-28999
Published: 2021-01-26
Description: An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices. A remote attacker can take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into a shared library (libhipcam.so) used to provide the streaming camera service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://gist.github.com/tj-oconnor/74f9ebbad668f3a7ce31a968452190d7; https://support.mygeeni.com/hc/en-us; https://gist.github.com/tj-oconnor/74f9ebbad668f3a7ce31a968452190d7
CVE: CVE-2020-29000
Published: 2021-01-26
Description: An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. Any attacker that has the ability to control DNS can exploit this vulnerability to remotely login to the device and gain access to the camera system.
CVSS Score: 7.2 (HIGH)
References: https://gist.github.com/tj-oconnor/d081f5f116a4865f888be81e2466d831; https://support.mygeeni.com/hc/en-us; https://gist.github.com/tj-oconnor/d081f5f116a4865f888be81e2466d831
CVE: CVE-2020-29001
Published: 2021-01-26
Description: An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 devices. A vulnerability exists in the RESTful Services API that allows a remote attacker to take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into the ppsapp RESTful application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-312
References: https://gist.github.com/tj-oconnor/371d34342c0cc2be015cc89d6dc2bc66; https://support.mygeeni.com/hc/en-us; https://gist.github.com/tj-oconnor/371d34342c0cc2be015cc89d6dc2bc66
CVE: CVE-2020-29241
Published: 2021-01-26
Description: Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML via the "Title" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40parshwa.fabaf/cross-site-scripting-vulnerability-in-admin-panel-c95bd4ecb6aa; https://medium.com/%40parshwa.fabaf/cross-site-scripting-vulnerability-in-admin-panel-c95bd4ecb6aa
CVE: CVE-2020-29443
Published: 2021-01-26
Description: ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
CVSS Score: 3.9 (LOW)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2021/01/18/2; https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-35239
Published: 2021-01-26
Description: A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html; https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html
CVE: CVE-2020-35263
Published: 2021-01-26
Description: EgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin panel, which may allow arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49058; https://www.exploit-db.com/exploits/49058
CVE: CVE-2020-35270
Published: 2021-01-26
Description: Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of Admin Panel and manage every account of Result.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://projectnotes.org/it-projects/student-result-management-system-in-php-with-source-code/; https://www.exploit-db.com/exploits/49152; https://projectnotes.org/it-projects/student-result-management-system-in-php-with-source-code/
CVE: CVE-2020-35309
Published: 2021-01-26
Description: Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML in admin dashboard - "Categories".
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49161; https://www.exploit-db.com/exploits/49161
CVE: CVE-2020-35310
Published: 2021-01-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none NOTE: This is disputed by the vendor; "We have no records of contact with the original reporter, and have not been able to reproduce any issue.
CVE: CVE-2020-35513
Published: 2021-01-26
Description: A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-271
References: https://bugzilla.redhat.com/show_bug.cgi?id=1911309; https://patchwork.kernel.org/project/linux-nfs/patch/[PII_REDACTED]3916.GH20297%40fieldses.org/; https://bugzilla.redhat.com/show_bug.cgi?id=1911309
CVE: CVE-2020-35576
Published: 2021-01-26
Description: A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU92444096/; https://www.tp-link.com/jp/support/download/tl-wr841n/v13/#Firmware; https://www.tp-link.com/us/security
CVE: CVE-2020-35753
Published: 2021-01-26
Description: The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20), when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Persis-Online-Bewerberportal; https://slashcrypto.org/2021/02/20/CVE-2020-35753/; https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Persis-Online-Bewerberportal
CVE: CVE-2020-35843
Published: 2021-01-26
Description: FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x956e.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/DmitryMeD/pentesting/blob/main/FastStone%20Image%20Viewer%207.5.md; https://twitter.com/DmitriyMelikov; https://github.com/DmitryMeD/pentesting/blob/main/FastStone%20Image%20Viewer%207.5.md
CVE: CVE-2020-35844
Published: 2021-01-26
Description: FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0xbe9c4.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/DmitryMeD/pentesting/blob/main/FastStone%20Image%20Viewer%207.5.md; https://twitter.com/DmitriyMelikov; https://github.com/DmitryMeD/pentesting/blob/main/FastStone%20Image%20Viewer%207.5.md
CVE: CVE-2020-35845
Published: 2021-01-26
Description: FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x96cf.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/DmitryMeD/pentesting/blob/main/FastStone%20Image%20Viewer%207.5.md; https://twitter.com/DmitriyMelikov; https://github.com/DmitryMeD/pentesting/blob/main/FastStone%20Image%20Viewer%207.5.md
CVE: CVE-2020-35853
Published: 2021-01-26
Description: 4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. This vulnerability can result in an attacker to inject the XSS payload into the IMAGE URL. Each time a user visits that URL, the XSS triggers and the attacker can be able to steal the cookie according to the crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49339; https://www.exploit-db.com/exploits/49339
CVE: CVE-2020-35854
Published: 2021-01-26
Description: Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://textpattern.com; https://riteshgohil-25.medium.com/textpattern-4-8-4-is-affected-by-cross-site-scripting-xss-in-the-body-parameter-b9a3d7da2a88; https://www.textpattern.co/demo
CVE: CVE-2020-36011
Published: 2021-01-26
Description: A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://qdocs.com; https://www.exploit-db.com/exploits/49290; http://qdocs.com
CVE: CVE-2020-36199
Published: 2021-01-26
Description: TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-78
References: https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-j2vj-mhr6-795m; https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-j2vj-mhr6-795m
CVE: CVE-2020-36200
Published: 2021-01-26
Description: TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-gqpw-3669-6w5h; https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-gqpw-3669-6w5h
CVE: CVE-2020-36201
Published: 2021-01-26
Description: An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://securitydocs.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20L_for_ConnectKey-1.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20L_for_ConnectKey-1.pdf
CVE: CVE-2020-36202
Published: 2021-01-26
Description: An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://rustsec.org/advisories/RUSTSEC-2020-0093.html; https://rustsec.org/advisories/RUSTSEC-2020-0093.html
CVE: CVE-2020-36203
Published: 2021-01-26
Description: An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0094.html; https://rustsec.org/advisories/RUSTSEC-2020-0094.html
CVE: CVE-2020-36204
Published: 2021-01-26
Description: An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
CVSS Score: 4.7 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0096.html; https://rustsec.org/advisories/RUSTSEC-2020-0096.html
CVE: CVE-2020-36205
Published: 2021-01-26
Description: An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415, CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0097.html; https://rustsec.org/advisories/RUSTSEC-2020-0097.html
CVE: CVE-2020-36206
Published: 2021-01-26
Description: An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.
CVSS Score: 7.0 (HIGH)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0098.html; https://rustsec.org/advisories/RUSTSEC-2020-0098.html
CVE: CVE-2020-36207
Published: 2021-01-26
Description: An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
CVSS Score: 7.0 (HIGH)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0099.html; https://rustsec.org/advisories/RUSTSEC-2020-0099.html
CVE: CVE-2020-36208
Published: 2021-01-26
Description: An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0101.html; https://rustsec.org/advisories/RUSTSEC-2020-0101.html
CVE: CVE-2020-36209
Published: 2021-01-26
Description: An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur.
CVSS Score: 7.0 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0102.html; https://rustsec.org/advisories/RUSTSEC-2020-0102.html
CVE: CVE-2020-36210
Published: 2021-01-26
Description: An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2020-0103.html; https://rustsec.org/advisories/RUSTSEC-2020-0103.html
CVE: CVE-2020-36211
Published: 2021-01-26
Description: An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
CVSS Score: 7.0 (HIGH)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0104.html; https://rustsec.org/advisories/RUSTSEC-2020-0104.html
CVE: CVE-2020-36212
Published: 2021-01-26
Description: An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0105.html; https://rustsec.org/advisories/RUSTSEC-2020-0105.html
CVE: CVE-2020-36213
Published: 2021-01-26
Description: An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0105.html; https://rustsec.org/advisories/RUSTSEC-2020-0105.html
CVE: CVE-2020-36214
Published: 2021-01-26
Description: An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur.
CVSS Score: 5.9 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0106.html; https://rustsec.org/advisories/RUSTSEC-2020-0106.html
CVE: CVE-2020-36215
Published: 2021-01-26
Description: An issue was discovered in the hashconsing crate before 1.1.0 for Rust. Because HConsed does not have bounds on its Send trait or Sync trait, memory corruption can occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0107.html; https://rustsec.org/advisories/RUSTSEC-2020-0107.html
CVE: CVE-2020-36216
Published: 2021-01-26
Description: An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memory corruption can occur.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0108.html; https://rustsec.org/advisories/RUSTSEC-2020-0108.html
CVE: CVE-2020-36217
Published: 2021-01-26
Description: An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-662, CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0111.html; https://rustsec.org/advisories/RUSTSEC-2020-0111.html