rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10023 Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim
The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr kernel. See NCC-NCC-019 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:13.032Z
CVE-2020-10024 ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers
The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Problem types: cwe_id: CWE-697
description: CWE-697 Incorrect Comparison
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:13.572Z
CVE-2020-10027 ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers
An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Problem types: cwe_id: CWE-697
description: CWE-697 Incorrect Comparison
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:14.923Z
CVE-2020-10028 Multiple Syscalls In GPIO Subsystem Performs No Argument Validation
Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:15.474Z
CVE-2020-10029 
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T00:00:00.000Z
CVE-2020-10030 
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname() does not have '\0' termination of the returned string if the hostname is larger than the supplied buffer. (Linux systems are not affected because the buffer is always large enough. OpenBSD systems are not affected because the returned hostname always has '\0' termination.) Under some conditions, this issue can lead to the writing of one '\0' byte out-of-bounds on the stack, causing a denial of service or possibly arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-19T15:52:20.000Z
CVE-2020-10037 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). By performing a flooding attack against the web server, an attacker might be able to gain read access to the device's memory, possibly revealing confidential information.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:04.000Z
CVE-2020-10038 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to the device's web server might be able to execute administrative commands without authentication.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:04.000Z
CVE-2020-10039 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker in a privileged network position between a legitimate user and the web server might be able to conduct a Man-in-the-middle attack and gain read and write access to the transmitted data.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:04.000Z
CVE-2020-10040 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with local access to the device might be able to retrieve some passwords in clear text.
Problem types: cwe_id: CWE-916
description: CWE-916: Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:04.000Z
CVE-2020-10041 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). A stored Cross-Site-Scripting (XSS) vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:05.000Z
CVE-2020-10042 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:05.000Z
CVE-2020-10043 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:05.000Z
CVE-2020-10044 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to the network could be able to install specially crafted firmware to the device.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:05.000Z
CVE-2020-10045 
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An error in the challenge-response procedure could allow an attacker to replay authentication traffic and gain access to protected areas of the web application.
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: Siemens AG
product: SICAM MMU
vendor: Siemens AG
product: SICAM SGU
vendor: Siemens AG
product: SICAM T
Published: 2020-07-14T13:18:05.000Z
CVE-2020-10048 
A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing authentication.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Siemens
product: SIMATIC PCS 7
vendor: Siemens
product: SIMATIC WinCC
Published: 2021-02-09T15:38:17.000Z
CVE-2020-10049 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system administrators.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Siemens AG
product: SIMATIC RTLS Locating Manager
Published: 2020-09-09T18:06:28.000Z
CVE-2020-10050 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Siemens AG
product: SIMATIC RTLS Locating Manager
Published: 2020-09-09T18:08:43.000Z
CVE-2020-10051 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.
Problem types: cwe_id: CWE-428
description: CWE-428: Unquoted Search Path or Element
Affected products: vendor: Siemens AG
product: SIMATIC RTLS Locating Manager
Published: 2020-09-09T18:09:58.000Z
CVE-2020-10052 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as usernames and passwords in log files. A local attacker with access to the log files could use this information to launch further attacks.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Siemens
product: SIMATIC RTLS Locating Manager
Published: 2021-11-09T11:31:36.000Z
CVE-2020-10053 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as database credentials in configuration files. A local attacker with access to the configuration files could use this information to launch further attacks.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: Siemens
product: SIMATIC RTLS Locating Manager
Published: 2021-11-09T11:31:37.000Z
CVE-2020-10054 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application does not properly handle the import of large configuration files. A local attacker could import a specially crafted file which could lead to a denial-of-service condition of the application service.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: SIMATIC RTLS Locating Manager
Published: 2021-11-09T11:31:38.000Z
CVE-2020-10055 
A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Siemens AG
product: Desigo CC
vendor: Siemens AG
product: Desigo CC
vendor: Siemens AG
product: Desigo CC Compact
vendor: Siemens AG
product: Desigo CC Compact
Published: 2020-08-14T15:24:06.000Z
CVE-2020-10056 
A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated attacker to execute arbitrary commands on the server with local SYSTEM privileges.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: Siemens AG
product: License Management Utility (LMU)
Published: 2020-09-09T18:10:49.000Z
CVE-2020-10057 
GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T18:03:36.000Z
CVE-2020-10058 Multiple Syscalls In kscan Subsystem Performs No Argument Validation
Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges. See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:15.962Z
CVE-2020-10059 UpdateHub Module Explicitly Disables TLS Verification
The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:16.442Z
CVE-2020-10060 UpdateHub Might Dereference An Uninitialized Pointer
In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:16.934Z
CVE-2020-10061 Error handling invalid packet sequence
Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: PhD - Garbelini Matheus Eduardo
Published: 2020-06-05T17:37:37.217Z
CVE-2020-10062 Packet length decoding error in MQTT
An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
Problem types: cwe_id: CWE-193
description: CWE-193 Off-by-one Error
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-06-05T17:37:37.262Z
CVE-2020-10063 Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow
A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-06-05T17:37:37.314Z
CVE-2020-10064 Improper Input Frame Validation in ieee802154 Processing
Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gvq-h42f-v3c7
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow (CWE-121)
cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-05-24T21:40:23.371Z
CVE-2020-10065 Missing Size Checks in Bluetooth HCI over SPI
Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c
Problem types: cwe_id: CWE-130
description: Improper Handling of Length Parameter Inconsistency (CWE-130)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-05-24T21:40:24.079Z
CVE-2020-10066 Incorrect Error Handling in Bluetooth HCI core
Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference (CWE-476)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2021-05-24T21:40:24.776Z