deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29281
Published: 2022-04-15
Description: Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program (or theft of NTLM credentials via an SMB relay attack, because the application resolves UNC paths).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/hmnthabit/Advisories/blob/master/CVE-2022-29281.md; https://github.com/notable/notable-insiders/releases/tag/v1.9.0-beta.8; https://github.com/hmnthabit/Advisories/blob/master/CVE-2022-29281.md
CVE: CVE-2022-1365
Published: 2022-04-15
Description: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-359, CWE-863
References: https://github.com/lquixada/cross-fetch/commit/a3b3a9481091ddd06b8f83784ba9c4e034dc912a; https://huntr.dev/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac; https://github.com/lquixada/cross-fetch/commit/a3b3a9481091ddd06b8f83784ba9c4e034dc912a
CVE: CVE-2022-29020
Published: 2022-04-16
Description: ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/saysky/ForestBlog/issues/76; https://github.com/saysky/ForestBlog/issues/76
CVE: CVE-2022-29287
Published: 2022-04-16
Description: Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-639
References: https://devnet.kentico.com/download/hotfixes; https://www.offensity.com/en/blog/authenticated-insecure-direct-object-reference-in-kentico-cms-cve-outstanding/; https://devnet.kentico.com/download/hotfixes
CVE: CVE-2022-1380
Published: 2022-04-16
Description: Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9; https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12; https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9
CVE: CVE-2022-26653
Published: 2022-04-16
Description: Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://raxis.com/blog/cve-2022-26653-and-cve-2022-26777; https://www.manageengine.com/remote-desktop-management/advisory/cve-2022-26653.html; https://raxis.com/blog/cve-2022-26653-and-cve-2022-26777
CVE: CVE-2022-26777
Published: 2022-04-16
Description: Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://raxis.com/blog/cve-2022-26653-and-cve-2022-26777; https://www.manageengine.com/remote-desktop-management/advisory/cve-2022-26777.html; https://raxis.com/blog/cve-2022-26653-and-cve-2022-26777
CVE: CVE-2022-28966
Published: 2022-04-16
Description: Wasm3 0.5.0 has a heap-based buffer overflow in NewCodePage in m3_code.c (called indirectly from Compile_BranchTable in m3_compile.c).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/wasm3/wasm3/issues/320; https://github.com/wasm3/wasm3/issues/320
CVE: CVE-2022-1381
Published: 2022-04-18
Description: global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/f50808ed135ab973296bca515ae4029b321afe47
CVE: CVE-2022-1382
Published: 2022-04-18
Description: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/radareorg/radare2/commit/48f0ea79f99174fb0a62cb2354e13496ce5b7c44; https://huntr.dev/bounties/d8b6d239-6d7b-4783-b26b-5be848c01aa1; https://github.com/radareorg/radare2/commit/48f0ea79f99174fb0a62cb2354e13496ce5b7c44
CVE: CVE-2022-1383
Published: 2022-04-18
Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/1dd65336f0f0c351d6ea853efcf73cf9c0030862; https://huntr.dev/bounties/02b4b563-b946-4343-9092-38d1c5cd60c9; https://github.com/radareorg/radare2/commit/1dd65336f0f0c351d6ea853efcf73cf9c0030862
CVE: CVE-2022-27908
Published: 2022-04-18
Description: Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/network-monitoring/security-updates/cve-2022-27908.html; https://www.manageengine.com/network-monitoring/security-updates/cve-2022-27908.html
CVE: CVE-2022-28810
Published: 2022-04-18
Description: Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-798, CWE-798
References: http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html; https://github.com/rapid7/metasploit-framework/pull/16475; https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html
CVE: CVE-2022-26631
Published: 2022-04-18
Description: Automatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability via the id GET parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Cyb3rR3ap3r/CVE-2022-26631; https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html; https://github.com/Cyb3rR3ap3r/CVE-2022-26631
CVE: CVE-2022-26665
Published: 2022-04-18
Description: An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to access sensitive case records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://news.ycombinator.com/item?id=30502117; https://www.calbar.ca.gov/About-Us/News/Data-Breach-Updates; https://www.judyrecords.com/info
CVE: CVE-2021-46122
Published: 2022-04-18
Description: Tp-Link TL-WR840N (EU) v6.20 Firmware (0.9.1 4.17 v0001.0 Build 201124 Rel.64328n) is vulnerable to Buffer Overflow via the Password reset feature.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: https://k4m1ll0.com/cve-tplink-tlwr840n-euV620-password-reset.html; https://k4m1ll0.com/cve-tplink-tlwr840n-euV620-password-reset.html
CVE: CVE-2011-1762
Published: 2022-04-18
Description: A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-276
References: https://wordpress.org/support/wordpress-version/version-3-1-2/; https://wordpress.org/support/wordpress-version/version-3-1-2/
CVE: CVE-2011-4917
Published: 2022-04-18
Description: In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://lkml.org/lkml/2011/11/7/340; https://www.openwall.com/lists/oss-security/2011/12/28/4; https://lkml.org/lkml/2011/11/7/340
CVE: CVE-2020-13495
Published: 2022-04-18
Description: An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary USD files. A specially crafted malformed file can trigger an arbitrary out-of-bounds memory access that could lead to the disclosure of sensitive information. This vulnerability could be used to bypass mitigations and aid additional exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1104; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1104
CVE: CVE-2020-13567
Published: 2022-04-18
Description: Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179
CVE: CVE-2020-13590
Published: 2022-04-18
Description: Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can be done either with administrator credentials or through cross-site request forgery.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1199; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1199
CVE: CVE-2020-25163
Published: 2022-04-18
Description: A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02
CVE: CVE-2020-25167
Published: 2022-04-18
Description: OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02
CVE: CVE-2020-28602
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_vertex() Halfedge_of[].
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28603
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_prev().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28604
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_next().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28605
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_vertex().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28606
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_face().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28607
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() set_halfedge().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28608
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_fc().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28609
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_iv().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225; https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html
CVE: CVE-2020-28610
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_face().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28611
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_first_out_edge().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28612
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->svertices_begin().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28613
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->svertices_last().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28614
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfedges_begin().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28615
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfedges_last().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28616
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_begin().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28617
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_last().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
CVE: CVE-2020-28618
Published: 2022-04-18
Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfloop().
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-125, CWE-129
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html; https://security.gentoo.org/glsa/202305-34; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225