deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24335
Published: 2021-06-01
Description: The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-02-12%5D-%5BWordPress%5D-%5BCWE-79%5D-Car-Repair-Services-WordPress-Theme-v3.9.txt; https://themeforest.net/item/car-repair-services-auto-mechanic-wordpress-theme/19823557; https://wpscan.com/vulnerability/39258aba-2449-4214-a490-b8e46945117d
CVE: CVE-2021-25640
Published: 2021-06-01
Description: In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-918, CWE-601, CWE-918
References: https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-25641
Published: 2021-06-01
Description: Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-29088
Published: 2021-06-01
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_21_03; https://www.synology.com/security/advisory/Synology_SA_21_03
CVE: CVE-2021-29092
Published: 2021-06-01
Description: Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.synology.com/security/advisory/Synology_SA_20_20; https://www.synology.com/security/advisory/Synology_SA_20_20
CVE: CVE-2021-29665
Published: 2021-06-01
Description: IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199399; https://www.ibm.com/support/pages/node/6457315; https://exchange.xforce.ibmcloud.com/vulnerabilities/199399
CVE: CVE-2021-29740
Published: 2021-06-01
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker could execute arbitrary code in the context of process memory, potentially escalating their system privileges and taking control over the entire system with root access. IBM X-Force ID: 201474.
CVSS Score: 7.8 (HIGH)
CWE: CWE-134
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201474; https://www.ibm.com/support/pages/node/6457629; https://exchange.xforce.ibmcloud.com/vulnerabilities/201474
CVE: CVE-2021-30179
Published: 2021-06-01
Description: Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-30180
Published: 2021-06-01
Description: Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-30181
Published: 2021-06-01
Description: Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.apache.org/thread.html/re22410dc704a09bc7032ddf15140cf5e7df3e8ece390fc9032ff5587%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/re22410dc704a09bc7032ddf15140cf5e7df3e8ece390fc9032ff5587%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-32027
Published: 2021-06-01
Description: A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1956876; https://security.gentoo.org/glsa/202211-04; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-32647
Published: 2021-06-01
Description: Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `<constructor>(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-470
References: https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36; https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-ph73-7v9r-wg32; https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36
CVE: CVE-2021-33180
Published: 2021-06-01
Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://www.synology.com/security/advisory/Synology_SA_20_24; https://www.synology.com/security/advisory/Synology_SA_20_24
CVE: CVE-2021-33181
Published: 2021-06-01
Description: Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-918
References: https://www.synology.com/security/advisory/Synology_SA_21_04; https://www.synology.com/security/advisory/Synology_SA_21_04
CVE: CVE-2021-33182
Published: 2021-06-01
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_21_03; https://www.synology.com/security/advisory/Synology_SA_21_03
CVE: CVE-2021-33183
Published: 2021-06-01
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors.
CVSS Score: 7.9 (HIGH)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_21_08; https://www.synology.com/security/advisory/Synology_SA_21_08
CVE: CVE-2021-33184
Published: 2021-06-01
Description: Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: https://www.synology.com/security/advisory/Synology_SA_20_23; https://www.synology.com/security/advisory/Synology_SA_20_23
CVE: CVE-2021-3412
Published: 2021-06-01
Description: It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-307, CWE-307
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928301; https://bugzilla.redhat.com/show_bug.cgi?id=1928301
CVE: CVE-2021-3495
Published: 2021-06-01
Description: An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947361; https://kiali.io/news/security-bulletins/kiali-security-003/; https://bugzilla.redhat.com/show_bug.cgi?id=1947361
CVE: CVE-2021-3515
Published: 2021-06-01
Description: A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954112; https://bugzilla.redhat.com/show_bug.cgi?id=1954112
CVE: CVE-2021-3516
Published: 2021-06-01
Description: There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954225; https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539; https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
CVE: CVE-2021-3543
Published: 2021-06-01
Description: A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1953022; https://lore.kernel.org/lkml/[PII_REDACTED]5941.27020-2-andraprs%40amazon.com/; https://bugzilla.redhat.com/show_bug.cgi?id=1953022
CVE: CVE-2020-17541
Published: 2021-06-01
Description: Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/121.html; https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392; https://cwe.mitre.org/data/definitions/121.html
CVE: CVE-2020-26668
Published: 2021-06-01
Description: A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/48831; https://www.exploit-db.com/exploits/48831
CVE: CVE-2020-26669
Published: 2021-06-01
Description: A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/48831; https://www.exploit-db.com/exploits/48831
CVE: CVE-2020-26670
Published: 2021-06-01
Description: A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/48831; https://www.exploit-db.com/exploits/48831
CVE: CVE-2020-26693
Published: 2021-06-01
Description: A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pfsense/pfsense/commit/a220a22a8c05c10a7b875ac6b565f2c4fe7b251c; https://github.com/pfsense/pfsense/commit/a220a22a8c05c10a7b875ac6b565f2c4fe7b251c
CVE: CVE-2020-27377
Published: 2021-06-01
Description: A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12317; http://dev.cmsmadesimple.org/bug/view/12317
CVE: CVE-2021-31641
Published: 2021-06-01
Description: An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.html; https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPY
CVE: CVE-2021-31642
Published: 2021-06-01
Description: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://packetstormsecurity.com/files/162934/CHIYU-IoT-Denial-Of-Service.html; https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/
CVE: CVE-2021-31643
Published: 2021-06-01
Description: An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.html; https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31643; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/
CVE: CVE-2021-32651
Published: 2021-06-01
Description: OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.
CVSS Score: 3.1 (LOW)
CWE: CWE-90
References: https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c; https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjf; https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c
CVE: CVE-2021-32924
Published: 2021-06-01
Description: Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::runProcessFunction method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://karmainsecurity.com/KIS-2021-04; http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.html; http://seclists.org/fulldisclosure/2021/May/80
CVE: CVE-2020-22035
Published: 2021-06-01
Description: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://trac.ffmpeg.org/ticket/8262; https://www.debian.org/security/2021/dsa-4990; https://trac.ffmpeg.org/ticket/8262
CVE: CVE-2020-22036
Published: 2021-06-01
Description: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8261; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2021-32652
Published: 2021-06-01
Description: Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the patches are known to exist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-862
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mxx2-6rg9-v2vc; https://hackerone.com/reports/1094063; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mxx2-6rg9-v2vc
CVE: CVE-2021-3424
Published: 2021-06-01
Description: A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=1933320; https://bugzilla.redhat.com/show_bug.cgi?id=1933320
CVE: CVE-2020-22037
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html; https://trac.ffmpeg.org/ticket/8281; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-22038
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://trac.ffmpeg.org/ticket/8285; https://trac.ffmpeg.org/ticket/8285
CVE: CVE-2020-22039
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://trac.ffmpeg.org/ticket/8302; https://trac.ffmpeg.org/ticket/8302
CVE: CVE-2020-22040
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://trac.ffmpeg.org/ticket/8283; https://trac.ffmpeg.org/ticket/8283
CVE: CVE-2020-22041
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html; https://trac.ffmpeg.org/ticket/8296; https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html
CVE: CVE-2020-22042
Published: 2021-06-01
Description: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graphparser.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://trac.ffmpeg.org/ticket/8267; https://www.debian.org/security/2021/dsa-4998; https://trac.ffmpeg.org/ticket/8267