rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-25023 
An issue was discovered in Noise-Java through 2020-08-27. AESGCMOnCtrCipherState.encryptWithAd() allows out-of-bounds access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-04T03:35:09.000Z
CVE-2020-25025 
The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:19:02.000Z
CVE-2020-25026 
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:17:34.000Z
CVE-2020-25031 
checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T03:43:45.000Z
CVE-2020-25032 
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T03:57:28.000Z
CVE-2020-25033 
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T04:06:14.000Z
CVE-2020-25034 
eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, search{URL], or search[attachment] parameter to the email search feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-26T18:42:31.000Z
CVE-2020-25035 
UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a related issue to CVE-2017-11322.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-02T05:04:16.000Z
CVE-2020-25036 
UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-02T05:02:19.000Z
CVE-2020-25037 
UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-02T04:57:47.000Z
CVE-2020-25039 
Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T17:42:44.000Z
CVE-2020-25040 
Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T17:47:17.000Z
CVE-2020-25042 
An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated (admin/manager) session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:23:13.000Z
CVE-2020-25043 
The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: Kaspersky VPN Secure Connection
Published: 2020-09-02T19:28:24.000Z
CVE-2020-25044 
Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to eliminate content of any file in the system.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: Kaspersky Virus Removal Tool
Published: 2020-09-02T19:29:54.000Z
CVE-2020-25045 
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system.
Problem types: description: Local Privilege Escalation (LPE)
Affected products: vendor: n/a
product: Kaspersky Security Center & Kaspersky Security Center Web Console
Published: 2020-09-02T19:25:10.000Z
CVE-2020-25046 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks address information via kernel logging. The Samsung IDs are SVE-2020-17602, SVE-2020-17603, SVE-2020-17604 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:26:25.000Z
CVE-2020-25047 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software. The S Secure application does not enforce the intended password requirement for a locked application. The Samsung IDs are SVE-2020-16746, SVE-2020-16764 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:26:12.000Z
CVE-2020-25048 
An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software. In the Lockscreen state, the Quick Share feature allows unauthenticated downloads, aka file injection. The Samsung ID is SVE-2020-17760 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:25:45.000Z
CVE-2020-25049 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService has insufficient DEX access control. The Samsung ID is SVE-2020-17797 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:25:20.000Z
CVE-2020-25050 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The CMC service allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:25:10.000Z
CVE-2020-25051 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via AppInfo. The Samsung ID is SVE-2020-17758 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:25:01.000Z
CVE-2020-25052 
An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. H-Arx allows attackers to execute arbitrary code or cause a denial of service (memory corruption) because indexes are mishandled. The Samsung ID is SVE-2020-17426 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:24:52.000Z
CVE-2020-25053 
An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-17435 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:23:52.000Z
CVE-2020-25054 
An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shannon baseband. The Samsung ID is SVE-2020-17239 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:24:37.000Z
CVE-2020-25055 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged SecureFolder process) to bypass admin restrictions in KnoxContainer. The Samsung ID is SVE-2020-18133 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:24:26.000Z
CVE-2020-25056 
An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software. Because HAL improperly checks versions, bootloading by the S.LSI NFC chipset is mishandled. The Samsung ID is SVE-2020-16169 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:24:14.000Z
CVE-2020-25057 
An issue was discovered on LG mobile devices with Android OS 10 software. MDMService does not properly restrict APK installations. The LG ID is LVE-SMP-200011 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:47:37.000Z
CVE-2020-25058 
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management service does not properly restrict configuration changes. The LG ID is LVE-SMP-200012 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:45:29.000Z
CVE-2020-25059 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A service crash may occur because of incorrect input validation. The LG ID is LVE-SMP-200013 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:47:24.000Z
CVE-2020-25060 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Local users can gain privileges because of LAF and SBL1 flaws. The LG ID is LVE-SMP-200015 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:47:13.000Z
CVE-2020-25061 
An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. lge_property allows property overwrites. The LG ID is LVE-SMP-200016 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:46:59.000Z
CVE-2020-25062 
An issue was discovered on LG mobile devices with Android OS 9 and 10 software. LGTelephonyProvider allows a bypass of intended privilege restrictions. The LG ID is LVE-SMP-200017 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:46:32.000Z
CVE-2020-25063 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. An application crash can occur because of incorrect application-level input validation. The LG ID is LVE-SMP-200018 (July 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:46:20.000Z
CVE-2020-25064 
An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Certain automated testing is mishandled. The LG ID is LVE-SMP-200019 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:45:58.000Z
CVE-2020-25065 
An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Key logging may occur because of an obsolete API. The LG ID is LVE-SMP-170010 (August 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T20:45:47.000Z
CVE-2020-25066 
A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possibly execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2020-12-22T21:04:06.000Z
CVE-2020-25067 
NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2020-09-01T03:22:10.000Z
CVE-2020-25068 
Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal files on the server via an http:IP:PORT/../../path/file_to_disclose Directory Traversal URI. NOTE: The manufacturer indicated that the affected version does not exist. Furthermore, they indicated that they detected this problem in an internal audit more than 3 years ago and fixed it in 2017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:30:27.000Z
CVE-2020-25069 
USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T20:14:39.000Z
CVE-2020-25070 
USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T20:14:29.000Z
CVE-2020-25071 
Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created, but the alert won't be executed as those attributes are now stripped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-15T17:17:02.000Z
CVE-2020-25073 
FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, but only if the Apache mod_status module is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T01:26:28.000Z
CVE-2020-25074 
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T16:48:21.000Z
CVE-2020-25078 
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T15:33:18.000Z
CVE-2020-25079 
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T15:33:07.000Z
CVE-2020-25082 
An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Elliptic Curve Cryptography (ECC) private key via a side-channel attack against ECDSA, because of an Observable Timing Discrepancy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:P/A:N/C:H/I:N/PR:H/S:U/UI:N
version: 3.1
Published: 2021-08-10T15:28:05.000Z
CVE-2020-25084 
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T04:06:51.000Z
CVE-2020-25085 
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T04:09:43.000Z
CVE-2020-25086 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:41:18.000Z
CVE-2020-25087 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:41:10.000Z
CVE-2020-25088 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:41:03.000Z
CVE-2020-25089 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:40:56.000Z
CVE-2020-25090 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:40:49.000Z
CVE-2020-25091 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:40:39.000Z
CVE-2020-25092 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:40:32.000Z
CVE-2020-25093 
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T01:40:24.000Z
CVE-2020-25094 
LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-17T02:04:12.000Z
CVE-2020-25095 
LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-17T02:04:03.000Z
CVE-2020-25096 
LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application server, which will forward requests to any configured back-end server, regardless of whether the user's access rights should permit this. As a result, even the most low-privileged user can interact with any back-end component that has a LogRhythm agent installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-17T02:03:48.000Z
CVE-2020-25097 
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T04:08:54.000Z
CVE-2020-25102 
silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview) when an SVG document is provided in the Description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T16:35:21.000Z
CVE-2020-25104 
eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:20:12.000Z
CVE-2020-25105 
eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:19:27.000Z
CVE-2020-25106 
Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-22T17:54:55.000Z
CVE-2020-25107 
An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. There is no check on whether a domain name has '\0' termination. This may lead to successful Denial-of-Service, and possibly Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:57:15.000Z
CVE-2020-25108 
An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The DNS response data length is not checked (it can be set to an arbitrary value from a packet). This may lead to successful Denial-of-Service, and possibly Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:58:01.000Z
CVE-2020-25109 
An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The number of DNS queries/responses (set in a DNS header) is not checked against the data present. This may lead to successful Denial-of-Service, and possibly Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:58:53.000Z