rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-27746 
Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-27T17:03:03.000Z
CVE-2020-27747 
An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator (4 digits), a remote attacker has the opportunity to conduct a brute force attack on this PIN code. As result, remote attacker retrieves all passwords from another systems, available for affected account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-29T17:26:05.000Z
CVE-2020-27748 
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: n/a
product: xdg-utils
Published: 2021-06-01T13:15:11.000Z
CVE-2020-27749 
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: grub2
Published: 2021-03-03T16:40:30.000Z
CVE-2020-27750 
A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T00:00:00.000Z
CVE-2020-27751 
A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T00:00:00.000Z
CVE-2020-27752 
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-122
description: CWE-122->CWE-787
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T21:57:16.000Z
CVE-2020-27753 
There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in `AcquireMagickMemory()` because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to `AcquireMagickMemory()`. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T21:57:20.000Z
CVE-2020-27754 
In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T00:00:00.000Z
CVE-2020-27755 
in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T21:57:25.000Z
CVE-2020-27756 
In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function `PerceptibleReciprocal()` in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-369
description: CWE-369->CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T00:00:00.000Z
CVE-2020-27757 
A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long. The flaw could be triggered by a crafted input file under certain conditions when it is processed by ImageMagick. Red Hat Product Security marked this as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T00:00:00.000Z
CVE-2020-27758 
A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-08T00:00:00.000Z
CVE-2020-27759 
In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type `int` to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-03T00:00:00.000Z
CVE-2020-27760 
In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. The patch uses the `PerceptibleReciprocal()` to prevent the divide-by-zero from occurring. This flaw affects ImageMagick versions prior to ImageMagick 7.0.8-68.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-03T00:00:00.000Z
CVE-2020-27761 
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-03T00:00:00.000Z
CVE-2020-27762 
A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to ImageMagick 7.0.8-68.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-03T00:00:00.000Z
CVE-2020-27763 
A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-03T00:00:00.000Z
CVE-2020-27764 
In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range values under some circumstances when a crafted input file is processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 6.9.10-69.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-03T00:00:00.000Z
CVE-2020-27765 
A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27766 
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-69.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27767 
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of types `float` and `unsigned char`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27768 
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2021-02-23T00:00:00.000Z
CVE-2020-27769 
In ImageMagick versions before 7.0.9-0, there are outside the range of representable values of type 'float' at MagickCore/quantize.c.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2021-05-14T00:00:00.000Z
CVE-2020-27770 
Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27771 
In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex() to ssize_t type to avoid this bug. This undefined behavior could be triggered when ImageMagick processes a crafted pdf file. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was demonstrated in this case. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27772 
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27773 
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-369
description: (CWE-369|CWE-190)
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27774 
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27775 
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27776 
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: ImageMagick
Published: 2020-12-04T00:00:00.000Z
CVE-2020-27777 
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: n/a
product: kernel
Published: 2020-12-15T16:57:45.000Z
CVE-2020-27778 
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
Problem types: cwe_id: CWE-824
description: CWE-824
Affected products: vendor: n/a
product: poppler
Published: 2020-12-03T16:46:47.000Z
CVE-2020-27779 
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: grub2
Published: 2021-03-03T16:40:24.000Z
CVE-2020-27780 
A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: pam
Published: 2020-12-17T23:55:45.000Z
CVE-2020-27781 
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: Ceph
Published: 2020-12-18T00:00:00.000Z
CVE-2020-27782 
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Undertow
Published: 2021-02-23T18:35:52.000Z
CVE-2020-27783 
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: python-lxml
Published: 2020-12-03T16:39:41.000Z
CVE-2020-27784 
A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free().
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: n/a
product: kernel
Published: 2022-09-01T17:56:31.000Z
CVE-2020-27786 
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2020-12-11T04:05:29.000Z
CVE-2020-27787 
A Segmentaation fault was found in UPX in invert_pt_dynamic() function in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Problem types: cwe_id: CWE-119
description: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: n/a
product: upx
Published: 2022-08-18T18:34:49.000Z
CVE-2020-27788 
An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service.
Problem types: cwe_id: CWE-125
description: CWE-125 - Out-of-bounds Read
Affected products: vendor: n/a
product: upx
Published: 2022-08-18T19:05:00.000Z
CVE-2020-27790 
A floating point exception issue was discovered in UPX in PackLinuxElf64::invert_pt_dynamic() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service. The highest impact is to Availability.
Problem types: cwe_id: CWE-369
description: CWE-369 - Divide By Zero
Affected products: vendor: n/a
product: upx
Published: 2022-08-18T18:57:21.000Z