deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21723
Published: 2022-01-27
Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/166227/Asterisk-Project-Security-Advisory-AST-2022-006.html; http://seclists.org/fulldisclosure/2022/Mar/2; https://github.com/pjsip/pjproject/commit/077b465c33f0aec05a49cd2ca456f9a1b112e896
CVE: CVE-2022-0370
Published: 2022-01-27
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/9f5bc33c943349bd765b991db0b7f6b6ef05cfdb; https://huntr.dev/bounties/fbe4b376-57ce-42cd-a9a9-049c4099b3ca; https://github.com/livehelperchat/livehelperchat/commit/9f5bc33c943349bd765b991db0b7f6b6ef05cfdb
CVE: CVE-2022-0387
Published: 2022-01-27
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/ff70c7dd641b68b9afb170b89ec1ef003a4e3444; https://huntr.dev/bounties/2e09035b-8f98-4930-b7e8-7abe5f722b98; https://github.com/livehelperchat/livehelperchat/commit/ff70c7dd641b68b9afb170b89ec1ef003a4e3444
CVE: CVE-2022-22828
Published: 2022-01-27
Description: An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/videnlabs/CVE-2022-22828/; https://web.synametrics.com/SynamanVersionHistory.htm; https://github.com/videnlabs/CVE-2022-22828/
CVE: CVE-2022-0372
Published: 2022-01-27
Description: Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d; https://huntr.dev/bounties/563232b9-5a93-4f4d-8389-ed805b262ef1; https://github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d
CVE: CVE-2021-44121
Published: 2022-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-44792
Published: 2022-01-27
Description: Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerability to access the logging interface. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-22-0093; https://www.usom.gov.tr/bildirim/tr-22-0093
CVE: CVE-2021-44793
Published: 2022-01-27
Description: Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerability to access the device configuration page and export the data to an external file. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information including the database credentials. Since the database runs with high privileges it is possible to execute commands with the attained credentials.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-22-0093; https://www.usom.gov.tr/bildirim/tr-22-0093
CVE: CVE-2021-44794
Published: 2022-01-27
Description: Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-22-0093; https://www.usom.gov.tr/bildirim/tr-22-0093
CVE: CVE-2021-44795
Published: 2022-01-27
Description: Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit this vulnerability to modify users permissions. The exploitation of this vulnerability might allow a remote attacker to delete permissions from other users without authenticating.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-22-0093; https://www.usom.gov.tr/bildirim/tr-22-0093
CVE: CVE-2022-23181
Published: 2022-01-27
Description: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9; https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-28096
Published: 2022-01-27
Description: An issue was discovered in Stormshield SNS before 4.2.3 (when the proxy is used). An attacker can saturate the proxy connection table. This would result in the proxy denying any new connections.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://advisories.stormshield.eu/2021-005/; https://advisories.stormshield.eu/2021-005/
CVE: CVE-2022-0348
Published: 2022-01-27
Description: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/832c34aeb9f21f213295a0c28377132df996352a; https://huntr.dev/bounties/250e79be-7e5d-4ba3-9c34-655e39ade2f4; https://github.com/pimcore/pimcore/commit/832c34aeb9f21f213295a0c28377132df996352a
CVE: CVE-2021-46065
Published: 2022-01-27
Description: A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/corrupted-brain/Findings/blob/main/ManageEngine%20XSS.md; https://www.manageengine.com/products/service-desk/on-premises/readme.html; https://github.com/corrupted-brain/Findings/blob/main/ManageEngine%20XSS.md
CVE: CVE-2021-46088
Published: 2022-01-27
Description: Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.
CVSS Score: 7.2 (HIGH)
References: https://github.com/paalbra/zabbix-zbxsec-7; https://github.com/paalbra/zabbix-zbxsec-7
CVE: CVE-2021-46097
Published: 2022-01-27
Description: Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://gist.github.com/w4nd3r-hya/784a86dda91bdcb3071892e56aacdee2; https://gist.github.com/w4nd3r-hya/784a86dda91bdcb3071892e56aacdee2
CVE: CVE-2021-46102
Published: 2022-01-27
Description: From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://blocksecteam.medium.com/new-integer-overflow-bug-discovered-in-solana-rbpf[PII_REDACTED]ee; https://github.com/solana-labs/rbpf/blob/c14764850f0b83b58aa013248eaf6d65836c1218/src/elf.rs#L609-L630; https://github.com/solana-labs/rbpf/pull/200
CVE: CVE-2021-46377
Published: 2022-01-27
Description: There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cskaza/cszcms/issues/33; https://github.com/cskaza/cszcms/issues/33
CVE: CVE-2021-46427
Published: 2022-01-27
Description: An SQL Injection vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 via the message parameter in Master.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple%20ChatBot; https://www.exploit-db.com/exploits/50673
CVE: CVE-2021-46428
Published: 2022-01-27
Description: A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in SystemSettings.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/50672; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2021-46484
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_IncrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/73; https://github.com/pcmacdon/jsish/issues/73
CVE: CVE-2021-46485
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_ValueIsNumber at src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/70; https://github.com/pcmacdon/jsish/issues/70
CVE: CVE-2021-46486
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArraySpliceCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/65; https://github.com/pcmacdon/jsish/issues/65
CVE: CVE-2021-46487
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e506. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/72; https://github.com/pcmacdon/jsish/issues/72
CVE: CVE-2021-46488
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArrayConcatCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/68; https://github.com/pcmacdon/jsish/issues/68
CVE: CVE-2021-46489
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_DecrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/74; https://github.com/pcmacdon/jsish/issues/74
CVE: CVE-2021-46490
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via NumberConstructor at src/jsiNumber.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/67; https://github.com/pcmacdon/jsish/issues/67
CVE: CVE-2021-46491
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_CommandPkgOpts at src/jsiCmds.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/69; https://github.com/pcmacdon/jsish/issues/69
CVE: CVE-2021-46492
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_FunctionInvoke at src/jsiFunc.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pcmacdon/jsish/issues/71; https://github.com/pcmacdon/jsish/issues/71
CVE: CVE-2021-46494
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueLookupBase in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/78; https://github.com/pcmacdon/jsish/issues/78
CVE: CVE-2021-46495
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via DeleteTreeValue in src/jsiObj.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/82; https://github.com/pcmacdon/jsish/issues/82
CVE: CVE-2021-46496
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_ObjFree in src/jsiObj.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/83; https://github.com/pcmacdon/jsish/issues/83
CVE: CVE-2021-46497
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_UserObjDelete in src/jsiUserObj.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/84; https://github.com/pcmacdon/jsish/issues/84
CVE: CVE-2021-46498
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_wswebsocketObjFree in src/jsiWebSocket.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/81; https://github.com/pcmacdon/jsish/issues/81
CVE: CVE-2021-46499
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueCopyMove in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/76; https://github.com/pcmacdon/jsish/issues/76
CVE: CVE-2021-46500
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ArgTypeCheck in src/jsiFunc.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/85; https://github.com/pcmacdon/jsish/issues/85
CVE: CVE-2021-46501
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via SortSubCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/86; https://github.com/pcmacdon/jsish/issues/86
CVE: CVE-2021-46502
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/87; https://github.com/pcmacdon/jsish/issues/87
CVE: CVE-2021-46503
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/pcmacdon/jsish/issues/88; https://github.com/pcmacdon/jsish/issues/88
CVE: CVE-2021-46504
Published: 2022-01-27
Description: There is an Assertion 'vp != resPtr' failed at jsiEval.c in Jsish v3.5.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/pcmacdon/jsish/issues/51; https://github.com/pcmacdon/jsish/issues/51
CVE: CVE-2021-46505
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/pcmacdon/jsish/issues/53; https://github.com/pcmacdon/jsish/issues/53
CVE: CVE-2021-46506
Published: 2022-01-27
Description: There is an Assertion 'v->d.lval != v' failed at src/jsiValue.c in Jsish v3.5.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/pcmacdon/jsish/issues/52; https://github.com/pcmacdon/jsish/issues/52
CVE: CVE-2021-46507
Published: 2022-01-27
Description: Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/pcmacdon/jsish/issues/54; https://github.com/pcmacdon/jsish/issues/54
CVE: CVE-2021-46508
Published: 2022-01-27
Description: There is an Assertion `i < parts_cnt' failed at src/mjs_bcode.c in Cesanta MJS v2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cesanta/mjs/issues/188; https://github.com/cesanta/mjs/issues/188
CVE: CVE-2021-46509
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a stack overflow via snquote at mjs/src/mjs_json.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-674
References: https://github.com/cesanta/mjs/issues/200; https://github.com/cesanta/mjs/issues/200
CVE: CVE-2021-46510
Published: 2022-01-27
Description: There is an Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed at src/mjs_gc.c in Cesanta MJS v2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cesanta/mjs/issues/185; https://github.com/cesanta/mjs/issues/185
CVE: CVE-2021-46511
Published: 2022-01-27
Description: There is an Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cesanta/mjs/issues/183; https://github.com/cesanta/mjs/issues/183
CVE: CVE-2021-46512
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_apply at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/202; https://github.com/cesanta/mjs/issues/202
CVE: CVE-2021-46513
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via mjs_mk_string at mjs/src/mjs_string.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/cesanta/mjs/issues/189; https://github.com/cesanta/mjs/issues/189
CVE: CVE-2021-46514
Published: 2022-01-27
Description: There is an Assertion 'ppos != NULL && mjs_is_number(*ppos)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cesanta/mjs/issues/187; https://github.com/cesanta/mjs/issues/187
CVE: CVE-2021-46515
Published: 2022-01-27
Description: There is an Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cesanta/mjs/issues/186; https://github.com/cesanta/mjs/issues/186
CVE: CVE-2021-46516
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_stack_size at mjs/src/mjs_core.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/201; https://github.com/cesanta/mjs/issues/201
CVE: CVE-2021-46517
Published: 2022-01-27
Description: There is an Assertion `mjs_stack_size(&mjs->scopes) > 0' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cesanta/mjs/issues/184; https://github.com/cesanta/mjs/issues/184
CVE: CVE-2021-46518
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_disown at src/mjs_core.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/195; https://github.com/cesanta/mjs/issues/195
CVE: CVE-2021-46519
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_array_length at src/mjs_array.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/194; https://github.com/cesanta/mjs/issues/194
CVE: CVE-2021-46520
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_jprintf at src/mjs_util.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/193; https://github.com/cesanta/mjs/issues/193
CVE: CVE-2021-46521
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via c_vsnprintf at mjs/src/common/str_util.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/cesanta/mjs/issues/190; https://github.com/cesanta/mjs/issues/190
CVE: CVE-2021-46522
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/196; https://github.com/cesanta/mjs/issues/196
CVE: CVE-2021-46523
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via to_json_or_debug at mjs/src/mjs_json.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/198; https://github.com/cesanta/mjs/issues/198
CVE: CVE-2021-46524
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via snquote at mjs/src/mjs_json.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/192; https://github.com/cesanta/mjs/issues/192
CVE: CVE-2021-46525
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/cesanta/mjs/issues/199; https://github.com/cesanta/mjs/issues/199
CVE: CVE-2021-46526
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/cesanta/mjs/issues/191; https://github.com/cesanta/mjs/issues/191
CVE: CVE-2021-46527
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_get_cstring at src/mjs_string.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/cesanta/mjs/issues/197; https://github.com/cesanta/mjs/issues/197
CVE: CVE-2021-46528
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x5361e. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/208; https://github.com/cesanta/mjs/issues/208
CVE: CVE-2021-46529
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x8814e. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/210; https://github.com/cesanta/mjs/issues/210
CVE: CVE-2021-46530
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_execute at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/206; https://github.com/cesanta/mjs/issues/206