deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34320
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13406)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-856/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34321
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The VisDraw.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13414)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-858/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34322
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The JPEG2K_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13416)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-20, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-859/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34323
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13419)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-861/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34324
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13420)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-20, CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-862/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34325
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13421)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-863/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34326
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-864/
CVE: CVE-2021-34327
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13423)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-865/
CVE: CVE-2021-34328
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13424)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-866/
CVE: CVE-2021-34329
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13427)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-867/
CVE: CVE-2021-34330
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13430)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-868/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34331
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13442)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-869/; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34332
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in an infinite loop condition that leads to denial of service condition. An attacker could leverage this vulnerability to consume excessive resources. (CNVD-C-2021-79300)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2021-34333
Published: 2021-07-13
Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in double free of an allocated buffer that leads to a crash. An attacker could leverage this vulnerability to cause denial of service condition. (CNVD-C-2021-79295)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE: CVE-2020-20250
Published: 2021-07-13
Description: Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). NOTE: this is different from CVE-2020-20253 and CVE-2020-20254. All four vulnerabilities in the /nova/bin/lcdstat process are discussed in the CVE-2020-20250 github.com/cq674350529 reference.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-787
References: https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20250/README.md; https://mikrotik.com/; https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20250/README.md
CVE: CVE-2021-22399
Published: 2021-07-13
Description: The Bluetooth function of some Huawei smartphones has a DoS vulnerability. Attackers can install third-party apps to send specific broadcasts, causing the Bluetooth module to crash. This vulnerability is successfully exploited to cause the Bluetooth function to become abnormal. Affected product versions include: HUAWEI P30 10.0.0.195(C432E22R2P5), 10.0.0.200(C00E85R2P11), 10.0.0.200(C461E6R3P1), 10.0.0.201(C10E7R5P1), 10.0.0.201(C185E4R7P1), 10.0.0.206(C605E19R1P3), 10.0.0.209(C636E6R3P4), 10.0.0.210(C635E3R2P4), and versions earlier than 10.1.0.165(C01E165R2P11).
CVSS Score: 5.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210707-03-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210707-03-dos-en
CVE: CVE-2021-22440
Published: 2021-07-13
Description: There is a path traversal vulnerability in some Huawei products. The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly validate the pathname. Successful exploit could allow the attacker to access a location that is outside of the restricted directory by a crafted filename. Affected product versions include:HUAWEI Mate 20 9.0.0.195(C01E195R2P1), 9.1.0.139(C00E133R3P1);HUAWEI Mate 20 Pro 9.0.0.187(C432E10R1P16), 9.0.0.188(C185E10R2P1), 9.0.0.245(C10E10R2P1), 9.0.0.266(C432E10R1P16), 9.0.0.267(C636E10R2P1), 9.0.0.268(C635E12R1P16), 9.0.0.278(C185E10R2P1); Hima-L29C 9.0.0.105(C10E9R1P16), 9.0.0.105(C185E9R1P16), 9.0.0.105(C636E9R1P16); Laya-AL00EP 9.1.0.139(C786E133R3P1); OxfordS-AN00A 10.1.0.223(C00E210R5P1); Tony-AL00B 9.1.0.257(C00E222R2P1).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210630-01-pathtraversal-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210630-01-pathtraversal-en
CVE: CVE-2021-31225
Published: 2021-07-13
Description: SES Evolution before 2.1.0 allows deleting some resources not currently in use by any security policy by leveraging access to a computer having the administration console installed.
CVSS Score: 7.3 (HIGH)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-027/; https://advisories.stormshield.eu
CVE: CVE-2021-31810
Published: 2021-07-13
Description: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Score: 5.8 (MEDIUM)
References: https://hackerone.com/reports/1145454; https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html; https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
CVE: CVE-2021-36376
Published: 2021-07-13
Description: dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/dandavison/delta/commit/f01846bd443aaf92fdd5ac20f461beac3f6ee3fd; https://github.com/dandavison/delta/releases/tag/0.8.3; https://vuln.ryotak.me/advisories/54
CVE: CVE-2021-20593
Published: 2021-07-13
Description: Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver. 3.35, GB-50A Ver.2.50 to Ver. 3.35, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior) and Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) allows a remote authenticated attacker to impersonate administrators to disclose configuration information of the air conditioning system and tamper information (e.g. operation information and configuration of air conditioning system) by exploiting this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: https://jvn.jp/vu/JVNVU96046575/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-004_en.pdf; https://jvn.jp/vu/JVNVU96046575/index.html
CVE: CVE-2021-31220
Published: 2021-07-13
Description: SES Evolution before 2.1.0 allows modifying security policies by leveraging access of a user having read-only access to security policies.
CVSS Score: 5.2 (MEDIUM)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-022/; https://advisories.stormshield.eu
CVE: CVE-2021-31221
Published: 2021-07-13
Description: SES Evolution before 2.1.0 allows deleting some parts of a security policy by leveraging access to a computer having the administration console installed.
CVSS Score: 5.7 (MEDIUM)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-023/; https://advisories.stormshield.eu
CVE: CVE-2021-31222
Published: 2021-07-13
Description: SES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration console installed.
CVSS Score: 5.7 (MEDIUM)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-024/; https://advisories.stormshield.eu
CVE: CVE-2021-31223
Published: 2021-07-13
Description: SES Evolution before 2.1.0 allows reading some parts of a security policy by leveraging access to a computer having the administration console installed.
CVSS Score: 5.7 (MEDIUM)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-025/; https://advisories.stormshield.eu
CVE: CVE-2021-31224
Published: 2021-07-13
Description: SES Evolution before 2.1.0 allows duplicating an existing security policy by leveraging access of a user having read-only access to security policies.
CVSS Score: 3.5 (LOW)
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-026/; https://advisories.stormshield.eu
CVE: CVE-2021-33578
Published: 2021-07-13
Description: Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE: CVE-2021-35957
Published: 2021-07-13
Description: Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs (in %WINDIR%\system32) with malicious ones.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-045/; https://advisories.stormshield.eu
CVE: CVE-2021-36121
Published: 2021-07-13
Description: An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files to be written to arbitrary filesystem locations via ../ Directory Traversal on the Z: drive (a hard-coded drive letter where ShareCare application files reside) and remote code execution as the ShareCare service user (NT AUTHORITY\SYSTEM).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE: CVE-2021-36122
Published: 2021-07-13
Description: An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject arbitrary arguments to 7z.exe.
CVSS Score: 8.8 (HIGH)
CWE: CWE-88
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE: CVE-2021-36123
Published: 2021-07-13
Description: An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on the server filesystems as well any files accessible via Universal Naming Convention (UNC) paths.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE: CVE-2021-36124
Published: 2021-07-13
Description: An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-862
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE: CVE-2020-22873
Published: 2021-07-13
Description: Buffer overflow vulnerability in function NumberToPrecisionCmd in jsish before 3.0.7, allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/pcmacdon/jsish/commit/430ea27accd4d4ffddc946c9402e7c9064835a18; https://github.com/pcmacdon/jsish/commit/430ea27accd4d4ffddc946c9402e7c9064835a18
CVE: CVE-2020-22874
Published: 2021-07-13
Description: Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328; https://github.com/pcmacdon/jsish/issues/5; https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328
CVE: CVE-2020-22875
Published: 2021-07-13
Description: Integer overflow vulnerability in function Jsi_ObjSetLength in jsish before 3.0.6, allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/pcmacdon/jsish/commit/5408a6d93f45bf1f7acd9ae5d44e0ebd77379e98; https://github.com/pcmacdon/jsish/issues/10; https://github.com/pcmacdon/jsish/commit/5408a6d93f45bf1f7acd9ae5d44e0ebd77379e98
CVE: CVE-2020-22876
Published: 2021-07-13
Description: Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/ldarren/QuickJS/issues/11; https://github.com/ldarren/QuickJS/issues/11
CVE: CVE-2020-22882
Published: 2021-07-13
Description: Issue was discovered in the fxParserTree function in moddable, allows attackers to cause denial of service via a crafted payload. Fixed in commit 723816ab9b52f807180c99fc69c7d08cf6c6bd61.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://github.com/Moddable-OpenSource/moddable/issues/351; https://github.com/Moddable-OpenSource/moddable/issues/351
CVE: CVE-2020-22884
Published: 2021-07-13
Description: Buffer overflow vulnerability in function jsvGetStringChars in Espruino before RELEASE_2V09, allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/espruino/Espruino/issues/1799; https://github.com/espruino/Espruino/issues/1799
CVE: CVE-2020-22885
Published: 2021-07-13
Description: Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/ccxvii/mujs/issues/133; https://github.com/ccxvii/mujs/issues/133
CVE: CVE-2020-22886
Published: 2021-07-13
Description: Buffer overflow vulnerability in function jsG_markobject in jsgc.c in mujs before 1.0.8, allows remote attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/ccxvii/mujs/issues/134; https://github.com/ccxvii/mujs/issues/134