rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-24697 
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries with a GSS-TSIG signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:23:11.000Z
CVE-2020-24698 
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:23:44.000Z
CVE-2020-24699 
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T15:29:07.000Z
CVE-2020-24700 
OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T07:42:56.000Z
CVE-2020-24701 
OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T07:58:16.000Z
CVE-2020-24703 
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2020-08-27T00:00:00.000Z
CVE-2020-24704 
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2020-08-27T00:00:00.000Z
CVE-2020-24705 
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2020-08-27T00:00:00.000Z
CVE-2020-24706 
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2020-08-27T00:00:00.000Z
CVE-2020-24707 
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:35:21.000Z
CVE-2020-24708 
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:32:46.000Z
CVE-2020-24709 
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:33:01.000Z
CVE-2020-24710 
Gophish before 0.11.0 allows SSRF attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:33:16.000Z
CVE-2020-24711 
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:33:23.000Z
CVE-2020-24712 
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:33:10.000Z
CVE-2020-24713 
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T19:33:31.000Z
CVE-2020-24714 
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T21:52:29.000Z
CVE-2020-24715 
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T21:52:44.000Z
CVE-2020-24716 
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T18:03:32.000Z
CVE-2020-24717 
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T18:03:21.000Z
CVE-2020-24718 
bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:49:02.000Z
CVE-2020-24719 
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T20:31:47.000Z
CVE-2020-24721 
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T17:43:01.000Z
CVE-2020-24722 
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-07T14:07:36.000Z
CVE-2020-24723 
Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T12:25:17.000Z
CVE-2020-24736 
Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2020-24739 
A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all administrators except the initial administrator will be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-10T13:17:30.000Z
CVE-2020-24740 
An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T15:28:56.000Z
CVE-2020-24742 
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T21:18:27.000Z
CVE-2020-24743 
An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T16:07:41.000Z
CVE-2020-24750 
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T18:39:40.000Z
CVE-2020-24753 
A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T18:00:28.000Z
CVE-2020-24755 
In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modification of the library to execute code on the system. This was tested in (Windows 7 x64/Windows 10 x64).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-17T21:06:37.000Z
CVE-2020-24765 
InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-20T19:11:24.000Z
CVE-2020-24769 
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T01:39:33.000Z
CVE-2020-24770 
SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T01:39:17.000Z
CVE-2020-24771 
Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T01:39:14.000Z
CVE-2020-24772 
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-21T14:48:27.000Z
CVE-2020-24786 
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:02:05.000Z
CVE-2020-24791 
FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T13:37:28.000Z
CVE-2020-24794 
Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T14:52:21.000Z
CVE-2020-24804 
Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-24807 
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T17:10:17.000Z
CVE-2020-24815 
A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-24T16:48:58.000Z
CVE-2020-24821 
A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:24.000Z
CVE-2020-24822 
A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:25.000Z
CVE-2020-24823 
A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:26.000Z
CVE-2020-24824 
A global buffer overflow issue in the dwarf::line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:28.000Z
CVE-2020-24825 
A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:29.000Z
CVE-2020-24826 
A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:30.000Z
CVE-2020-24827 
A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T14:52:31.000Z
CVE-2020-24829 
An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T20:02:38.000Z
CVE-2020-24837 
An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T15:40:21.000Z
CVE-2020-24838 
An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T15:40:34.000Z
CVE-2020-24841 
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T12:25:39.000Z
CVE-2020-24842 
PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-10T21:59:27.000Z
CVE-2020-24847 
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T18:17:12.000Z
CVE-2020-24848 
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T18:22:49.000Z
CVE-2020-24849 
A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T14:19:40.000Z
CVE-2020-24855 
Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2020-24857 
Cross Site Scripting vulnerabilty found in IXPManager v.5.6.0 allows attackers to excute arbitrary code via the looking glass component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-23T00:00:00.000Z
CVE-2020-24860 
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-01T13:55:24.000Z
CVE-2020-24861 
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-01T13:50:19.000Z
CVE-2020-24862 
The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T16:50:08.000Z
CVE-2020-24863 
A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:34:32.000Z
CVE-2020-24870 
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T15:32:11.000Z