deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13166
Published: 2020-03-13
Description: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13167
Published: 2020-03-13
Description: Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13168
Published: 2020-03-13
Description: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the attributes parser of the IPP service. This would allow an unauthenticated attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13169
Published: 2020-03-13
Description: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Header of the web application that would allow an attacker to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13170
Published: 2020-03-13
Description: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13171
Published: 2020-03-13
Description: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementation that would allow an unauthenticated attacker to execute arbitrary code on the device. This was caused by an insecure handling of the register parameters, because the size used within a memcpy() function, which copied the action value into a local variable, was not checked properly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13172
Published: 2020-03-13
Description: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie of the web application that would allow an attacker to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.business.xerox.com/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/; https://security.business.xerox.com/
CVE: CVE-2019-13192
Published: 2020-03-13
Description: Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse attribute names properly. This would allow an attacker to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://global.brother; https://support.brother.com/g/b/faqend.aspx?c=us&lang=en&prod=group2&faqid=faq00100670_000; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-brother-printers/
CVE: CVE-2019-13193
Published: 2020-03-13
Description: Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://global.brother; https://support.brother.com/g/b/faqend.aspx?c=us&lang=en&prod=group2&faqid=faq00100670_000; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-brother-printers/
CVE: CVE-2019-13194
Published: 2020-03-13
Description: Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensitive information to an unauthenticated user who visits a specific URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://global.brother; https://support.brother.com/g/b/faqend.aspx?c=us&lang=en&prod=group2&faqid=faq00100670_000; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-brother-printers/
CVE: CVE-2019-13195
Published: 2020-03-13
Description: The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user to retrieve arbitrary files, or check if files or folders existed within the file system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13196
Published: 2020-03-13
Description: Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the arg4 and arg9 parameters of several functionalities of the web application that would allow an authenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13197
Published: 2020-03-13
Description: Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of the web application that would allow an unauthenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13198
Published: 2020-03-13
Description: The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XSS. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13199
Published: 2020-03-13
Description: Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13200
Published: 2020-03-13
Description: The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected XSS. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13201
Published: 2020-03-13
Description: Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service. This would allow an unauthenticated attacker to cause a Denial of Service (DoS) in the LPD service and potentially execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-13202
Published: 2020-03-13
Description: Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and failhtmlfile parameters of several functionalities of the web application that would allow an unauthenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-kyocera-printers/
CVE: CVE-2019-14299
Published: 2020-03-13
Description: Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/; https://www.ricoh-usa.com/en/support-and-download; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/
CVE: CVE-2019-14303
Published: 2020-03-13
Description: Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). Some Ricoh printers were affected by a wrong LPD service implementation that lead to a denial of service vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/; https://www.ricoh-usa.com/en/support-and-download; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/
CVE: CVE-2019-14309
Published: 2020-03-13
Description: Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attacker to access and read information stored on the shared FTP folders.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/; https://www.ricoh-usa.com/en/support-and-download; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/
CVE: CVE-2019-14310
Published: 2020-03-13
Description: Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash. A memory corruption has been identified in the way of how the embedded device parsed the IPP packets
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/; https://www.ricoh-usa.com/en/support-and-download; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/
CVE: CVE-2019-19611
Published: 2020-03-13
Description: An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1
CVSS Score: 7.5 (HIGH)
References: https://excellium-services.com/cert-xlm-advisory/cve-2019-19611/; https://excellium-services.com/cert-xlm-advisory/cve-2019-19611/
CVE: CVE-2019-18576
Published: 2020-03-13
Description: Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities; https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities
CVE: CVE-2019-18577
Published: 2020-03-13
Description: Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit this vulnerability to gain root access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities; https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities
CVE: CVE-2019-18578
Published: 2020-03-13
Description: Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through their browsers, the malicious code may be executed by the web browser in the context of the vulnerable web application.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities; https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities
CVE: CVE-2019-3769
Published: 2020-03-13
Description: Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious payload in the device heartbeat request. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/article/SLN319512; https://www.dell.com/support/article/SLN319512
CVE: CVE-2019-3770
Published: 2020-03-13
Description: Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/article/SLN319512; https://www.dell.com/support/article/SLN319512
CVE: CVE-2020-10562
Published: 2020-03-13
Description: An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/JeromeDevome/GRR/commit/2c6edacd9e15c75a0c2ef472470481ffb6edc7d8; https://github.com/JeromeDevome/GRR/releases/tag/v3.4.1c; https://github.com/skr0x/CVE/tree/master/CVE-2020-10562
CVE: CVE-2020-10563
Published: 2020-03-13
Description: An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cvecps.mitre.org/cps/workitems/create/?cveId=CVE-2020-10563; https://github.com/JeromeDevome/GRR/commit/2c6edacd9e15c75a0c2ef472470481ffb6edc7d8; https://github.com/JeromeDevome/GRR/releases/tag/v3.4.1c
CVE: CVE-2020-5257
Published: 2020-03-13
Description: In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-943, CWE-89
References: https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3; https://github.com/thoughtbot/administrate/security/advisories/GHSA-2p5p-m353-833w; https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3
CVE: CVE-2020-5240
Published: 2020-03-13
Description: In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74; https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm; https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
CVE: CVE-2020-10564
Published: 2020-03-13
Description: An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/beerpwn/CVE/tree/master/WP-File-Upload_disclosure_report/; https://wordpress.org/plugins/wp-file-upload/#developers; https://wpvulndb.com/vulnerabilities/10132
CVE: CVE-2020-10565
Published: 2020-03-14
Description: grub2-bhyve, as used in FreeBSD bhyve before revision[PII_REDACTED]-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://svnweb.freebsd.org/ports?view=revision&revision=525916; https://svnweb.freebsd.org/ports?view=revision&revision=525916
CVE: CVE-2020-10566
Published: 2020-03-14
Description: grub2-bhyve, as used in FreeBSD bhyve before revision[PII_REDACTED]-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://svnweb.freebsd.org/ports?view=revision&revision=525916; https://svnweb.freebsd.org/ports?view=revision&revision=525916
CVE: CVE-2020-10567
Published: 2020-03-14
Description: An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html; https://github.com/trippo/ResponsiveFilemanager/issues/600; http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html
CVE: CVE-2020-10568
Published: 2020-03-14
Description: The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://medium.com/%40arall/sitepress-multilingual-cms-wplugin-wpml-4-3-7-b-2-9c9486c13577; https://wpvulndb.com/vulnerabilities/10131; https://medium.com/%40arall/sitepress-multilingual-cms-wplugin-wpml-4-3-7-b-2-9c9486c13577
CVE: CVE-2020-10571
Published: 2020-03-14
Description: An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-754
References: https://github.com/psd-tools/psd-tools/pull/198; https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4; https://github.com/psd-tools/psd-tools/pull/198
CVE: CVE-2020-10573
Published: 2020-03-14
Description: An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms in AudioBridge.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: https://github.com/meetecho/janus-gateway/pull/1988; https://github.com/meetecho/janus-gateway/pull/1988
CVE: CVE-2020-10574
Published: 2020-03-14
Description: An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in the JSON validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-706
References: https://github.com/meetecho/janus-gateway/pull/1989; https://github.com/meetecho/janus-gateway/pull/1989
CVE: CVE-2020-10575
Published: 2020-03-14
Description: An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-362
References: https://github.com/meetecho/janus-gateway/pull/1994; https://github.com/meetecho/janus-gateway/pull/1994
CVE: CVE-2020-10576
Published: 2020-03-14
Description: An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://github.com/meetecho/janus-gateway/pull/1993; https://github.com/meetecho/janus-gateway/pull/1993
CVE: CVE-2020-10577
Published: 2020-03-14
Description: An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race condition when claiming sessions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-362
References: https://github.com/meetecho/janus-gateway/pull/1990; https://github.com/meetecho/janus-gateway/pull/1990