deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-17363
Published: 2020-12-31
Description: USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may overlap CVE-2020-25069.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://sysdream.com/news/lab/2020-08-12-cve-2020-17363-usvn-remote-code-execution/; https://sysdream.com/news/lab/2020-08-12-cve-2020-17363-usvn-remote-code-execution/
CVE: CVE-2020-19664
Published: 2020-12-31
Description: DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/minghangshen/bug_poc; https://nosec.org/home/detail/4631.html; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-%28cve-2020-19664%29/
CVE: CVE-2016-9021
Published: 2020-12-31
Description: Exponent CMS before 2.6.0 has improper input validation in storeController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://github.com/exponentcms/exponent-cms/commit/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31
CVE: CVE-2016-9022
Published: 2020-12-31
Description: Exponent CMS before 2.6.0 has improper input validation in usersController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://github.com/exponentcms/exponent-cms/commit/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31
CVE: CVE-2016-9023
Published: 2020-12-31
Description: Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://github.com/exponentcms/exponent-cms/commit/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31
CVE: CVE-2016-9025
Published: 2020-12-31
Description: Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://github.com/exponentcms/exponent-cms/commit/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31
CVE: CVE-2016-9026
Published: 2020-12-31
Description: Exponent CMS before 2.6.0 has improper input validation in fileController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://github.com/exponentcms/exponent-cms/commit/a8efd9ca71fc9b8b843ad0910d435d237482ee31; https://exponentcms.lighthouseapp.com/projects/61783/changesets/a8efd9ca71fc9b8b843ad0910d435d237482ee31
CVE: CVE-2018-14067
Published: 2020-12-31
Description: Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS port, because lighttpd listens on all network interfaces (including the external Internet) by default. NOTE: this may overlap CVE-2017-9980.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.shellcode.it/article/greenpacket-wimax/; https://www.shellcode.it/article/greenpacket-wimax/
CVE: CVE-2018-16795
Published: 2020-12-31
Description: OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://community.open-emr.org/t/openemr-security/10597; https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf; https://community.open-emr.org/t/openemr-security/10597
CVE: CVE-2019-7725
Published: 2020-12-31
Description: includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt; https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txt; https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04
CVE: CVE-2019-7726
Published: 2020-12-31
Description: modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt; https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txt; https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04
CVE: CVE-2020-25842
Published: 2020-12-31
Description: The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html; https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html
CVE: CVE-2020-25843
Published: 2020-12-31
Description: NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html; https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html
CVE: CVE-2020-25844
Published: 2020-12-31
Description: The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html; https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html
CVE: CVE-2020-25845
Published: 2020-12-31
Description: Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
CVSS Score: 7.5 (HIGH)
CWE: CWE-601
References: https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html; https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html
CVE: CVE-2020-25846
Published: 2020-12-31
Description: The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
CVSS Score: 7.5 (HIGH)
CWE: CWE-601
References: https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html; https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html
CVE: CVE-2020-25848
Published: 2020-12-31
Description: HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html; https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html
CVE: CVE-2020-25850
Published: 2020-12-31
Description: The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.
CVSS Score: 8.1 (HIGH)
References: https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html; https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html
CVE: CVE-2020-35740
Published: 2020-12-31
Description: HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.
CVSS Score: 7.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html; https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html
CVE: CVE-2020-35741
Published: 2020-12-31
Description: HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
CVSS Score: 7.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html; https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html
CVE: CVE-2020-35742
Published: 2020-12-31
Description: HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter.
CVSS Score: 7.0 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html; https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html
CVE: CVE-2020-35743
Published: 2020-12-31
Description: HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages.
CVSS Score: 7.0 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html; https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html
CVE: CVE-2020-35851
Published: 2020-12-31
Description: HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html; https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html
CVE: CVE-2020-35898
Published: 2020-12-31
Description: An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0045.html; https://rustsec.org/advisories/RUSTSEC-2020-0045.html
CVE: CVE-2020-35899
Published: 2020-12-31
Description: An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0046.html; https://rustsec.org/advisories/RUSTSEC-2020-0046.html
CVE: CVE-2020-35900
Published: 2020-12-31
Description: An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0047.html; https://rustsec.org/advisories/RUSTSEC-2020-0047.html
CVE: CVE-2020-35901
Published: 2020-12-31
Description: An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0048.html; https://rustsec.org/advisories/RUSTSEC-2020-0048.html
CVE: CVE-2020-35902
Published: 2020-12-31
Description: An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0049.html; https://rustsec.org/advisories/RUSTSEC-2020-0049.html
CVE: CVE-2020-35903
Published: 2020-12-31
Description: An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0050.html; https://rustsec.org/advisories/RUSTSEC-2020-0050.html
CVE: CVE-2020-35904
Published: 2020-12-31
Description: An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0052.html; https://rustsec.org/advisories/RUSTSEC-2020-0052.html
CVE: CVE-2020-35905
Published: 2020-12-31
Description: An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0059.html; https://rustsec.org/advisories/RUSTSEC-2020-0059.html
CVE: CVE-2020-35906
Published: 2020-12-31
Description: An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0060.html; https://rustsec.org/advisories/RUSTSEC-2020-0060.html
CVE: CVE-2020-35907
Published: 2020-12-31
Description: An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://rustsec.org/advisories/RUSTSEC-2020-0061.html; https://rustsec.org/advisories/RUSTSEC-2020-0061.html
CVE: CVE-2020-35908
Published: 2020-12-31
Description: An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0062.html; https://rustsec.org/advisories/RUSTSEC-2020-0062.html
CVE: CVE-2020-35909
Published: 2020-12-31
Description: An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2020-0068.html; https://rustsec.org/advisories/RUSTSEC-2020-0068.html
CVE: CVE-2020-35910
Published: 2020-12-31
Description: An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0070.html; https://rustsec.org/advisories/RUSTSEC-2020-0070.html
CVE: CVE-2020-35911
Published: 2020-12-31
Description: An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0070.html; https://rustsec.org/advisories/RUSTSEC-2020-0070.html
CVE: CVE-2020-35912
Published: 2020-12-31
Description: An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0070.html; https://rustsec.org/advisories/RUSTSEC-2020-0070.html
CVE: CVE-2020-35913
Published: 2020-12-31
Description: An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0070.html; https://rustsec.org/advisories/RUSTSEC-2020-0070.html
CVE: CVE-2020-35914
Published: 2020-12-31
Description: An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0070.html; https://rustsec.org/advisories/RUSTSEC-2020-0070.html
CVE: CVE-2020-35915
Published: 2020-12-31
Description: An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0072.html; https://rustsec.org/advisories/RUSTSEC-2020-0072.html
CVE: CVE-2020-35916
Published: 2020-12-31
Description: An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://rustsec.org/advisories/RUSTSEC-2020-0073.html; https://rustsec.org/advisories/RUSTSEC-2020-0073.html
CVE: CVE-2020-35917
Published: 2020-12-31
Description: An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0074.html; https://rustsec.org/advisories/RUSTSEC-2020-0074.html
CVE: CVE-2020-35918
Published: 2020-12-31
Description: An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/return/branca/issues/24; https://github.com/tuupola/branca-spec/issues/22; https://rustsec.org/advisories/RUSTSEC-2020-0075.html
CVE: CVE-2020-35919
Published: 2020-12-31
Description: An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0078.html; https://rustsec.org/advisories/RUSTSEC-2020-0078.html
CVE: CVE-2020-35920
Published: 2020-12-31
Description: An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0079.html; https://rustsec.org/advisories/RUSTSEC-2020-0079.html
CVE: CVE-2020-35921
Published: 2020-12-31
Description: An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0080.html; https://rustsec.org/advisories/RUSTSEC-2020-0080.html
CVE: CVE-2020-35922
Published: 2020-12-31
Description: An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0081.html; https://rustsec.org/advisories/RUSTSEC-2020-0081.html
CVE: CVE-2020-35923
Published: 2020-12-31
Description: An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2020-0082.html; https://rustsec.org/advisories/RUSTSEC-2020-0082.html
CVE: CVE-2020-35924
Published: 2020-12-31
Description: An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2020-0087.html; https://rustsec.org/advisories/RUSTSEC-2020-0087.html
CVE: CVE-2020-35925
Published: 2020-12-31
Description: An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0088.html; https://rustsec.org/advisories/RUSTSEC-2020-0088.html
CVE: CVE-2020-35926
Published: 2020-12-31
Description: An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330, CWE-681
References: https://rustsec.org/advisories/RUSTSEC-2020-0089.html; https://rustsec.org/advisories/RUSTSEC-2020-0089.html
CVE: CVE-2020-35927
Published: 2020-12-31
Description: An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
CVSS Score: 5.5 (MEDIUM)
References: https://rustsec.org/advisories/RUSTSEC-2020-0090.html; https://rustsec.org/advisories/RUSTSEC-2020-0090.html
CVE: CVE-2020-35928
Published: 2020-12-31
Description: An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://rustsec.org/advisories/RUSTSEC-2020-0092.html; https://rustsec.org/advisories/RUSTSEC-2020-0092.html
CVE: CVE-2018-25001
Published: 2020-12-31
Description: An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2018-0020.html; https://rustsec.org/advisories/RUSTSEC-2018-0020.html
CVE: CVE-2019-25001
Published: 2020-12-31
Description: An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2019-0025.html; https://rustsec.org/advisories/RUSTSEC-2019-0025.html
CVE: CVE-2019-25002
Published: 2020-12-31
Description: An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
CVSS Score: 9.8 (CRITICAL)
References: https://rustsec.org/advisories/RUSTSEC-2019-0026.html; https://rustsec.org/advisories/RUSTSEC-2019-0026.html
CVE: CVE-2019-25003
Published: 2020-12-31
Description: An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2019-0027.html; https://rustsec.org/advisories/RUSTSEC-2019-0027.html
CVE: CVE-2019-25004
Published: 2020-12-31
Description: An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
CVSS Score: 9.8 (CRITICAL)
References: https://rustsec.org/advisories/RUSTSEC-2019-0028.html; https://rustsec.org/advisories/RUSTSEC-2019-0028.html
CVE: CVE-2019-25005
Published: 2020-12-31
Description: An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://rustsec.org/advisories/RUSTSEC-2019-0029.html; https://rustsec.org/advisories/RUSTSEC-2019-0029.html
CVE: CVE-2019-25006
Published: 2020-12-31
Description: An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://rustsec.org/advisories/RUSTSEC-2019-0030.html; https://rustsec.org/advisories/RUSTSEC-2019-0030.html
CVE: CVE-2019-25007
Published: 2020-12-31
Description: An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
CVSS Score: 7.5 (HIGH)
References: https://rustsec.org/advisories/RUSTSEC-2019-0030.html; https://rustsec.org/advisories/RUSTSEC-2019-0030.html
CVE: CVE-2019-25008
Published: 2020-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-25574. Reason: This candidate is a duplicate of CVE-2020-25574. Notes: All CVE users should reference CVE-2020-25574 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage