rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-16231 All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort
The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CPC210 hardware controllers. Security Level 0 is set at default from the manufacturer, which could allow an unauthenticated remote attacker to gain access to the password hashes. Security Level 4 is susceptible if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password to conduct further attacks.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MX207
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MX213
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MX220
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MC206
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MC212
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MC220
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MH230
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MC205
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MC210
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MH212
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller ME203
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller CS200
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MP213
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MP226
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MPC240
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MPC265
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MPC270
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MPC293
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller MPE270
vendor: Bachmann Electronic, GmbH
product: M1 Hardware Controller CPC210
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-19T17:21:37.000Z
CVE-2020-16232 Yokogawa WideField3 Buffer Copy Without Checking Size of Input
In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Yokogawa
product: WideField3
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Parity Dynamics reported this vulnerability to CISA.
Published: 2022-03-18T18:00:29.000Z
CVE-2020-16233 
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap.
Problem types: cwe_id: CWE-404
description: IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404
Affected products: vendor: n/a
product: CodeMeter
Published: 2020-09-16T19:51:20.000Z
CVE-2020-16234 FATEK Automation PLC WinProladder
In PLC WinProladder Version 3.28 and prior, a stack-based buffer overflow vulnerability can be exploited when a valid user opens a specially crafted file, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: FATEK Automation
product: PLC WinProladder
Published: 2020-09-30T20:44:31.000Z
CVE-2020-16235 Emerson OpenEnterprise - Inadequate Encryption Strength
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: Emerson
product: Open Enterprise
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Roman Lozko of Kaspersky reported this vulnerability to Emerson.
Published: 2022-05-19T17:23:12.000Z
CVE-2020-16236 anasonic FPWIN Pro
FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: Panasonic
product: FPWIN Pro
Published: 2021-01-25T18:46:40.532Z
CVE-2020-16237 Philips SureSigns VS4 Improper Input Validation
Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Philips
product: SureSigns VS4
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 2.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Cleveland Clinic reported these vulnerabilities to Philips.
Published: 2020-08-21T12:11:41.000Z
CVE-2020-16238 B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: B. Braun Melsungen AG
product: SpaceCom
vendor: B. Braun Melsungen AG
product: Battery pack with Wi-Fi
vendor: B. Braun Melsungen AG
product: Data module compactplus
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Julian Suleder, Nils Emmerich, and Birk Kauer of ERNW Research GmbH; Dr. Oliver Matula of ERNW Enno Rey Netzwerke GmbH, reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices).
Published: 2022-04-14T20:05:53.000Z
CVE-2020-16239 Philips SureSigns VS4 Improper Authentication
When an actor claims to have a given identity, 

Philips SureSigns VS4, A.07.107 and prior 
does not prove or insufficiently proves the claim is correct.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Philips
product: SureSigns VS4
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Cleveland Clinic reported these vulnerabilities to Philips.
Published: 2020-08-21T12:18:29.000Z
CVE-2020-16240 
GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be downloaded in JavaScript object notation (JSON) format by users who should not have access to such functionality. An attacker can download sensitive data related to user accounts without having the proper privileges.
Problem types: cwe_id: CWE-639
description: AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639
Affected products: vendor: n/a
product: GE Digital APM Classic
Published: 2020-09-23T13:06:07.000Z
CVE-2020-16241 Philips SureSigns VS4 Improper Access Control
Philips SureSigns VS4, A.07.107 and prior 
does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Philips
product: SureSigns VS4
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Cleveland Clinic reported these vulnerabilities to Philips.
Published: 2020-08-21T12:15:31.000Z
CVE-2020-16242 GE Reason S20 Ethernet Switch
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: General Electric
product: Reason S20 Ethernet Switch
Published: 2020-09-25T17:37:26.885Z
CVE-2020-16243 
Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under the privileges of the application.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: LeviStudioU
Published: 2021-02-23T16:18:20.000Z
CVE-2020-16244 
GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data and then retrieve the actual passwords.
Problem types: cwe_id: CWE-759
description: USE OF A ONE-WAY HASH WITHOUT A SALT CWE-759
Affected products: vendor: n/a
product: GE Digital APM Classic
Published: 2020-09-23T13:03:05.000Z
CVE-2020-16245 
Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: Advantech iView
Published: 2020-08-25T18:03:49.000Z
CVE-2020-16246 GE Reason S20 Ethernet Switch
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site and executed by the victim client.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: General Electric
product: Reason S20 Ethernet Switch
Published: 2020-10-20T15:00:40.583Z
CVE-2020-16247 Philips Clinical Collaboration Platform Configuration
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, 


exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Problem types: cwe_id: CWE-16
description: CWE-16
Affected products: vendor: Philips
product: Clinical Collaboration Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Northridge Hospital Medical Center reported these vulnerabilities to Philips.
Published: 2020-09-18T17:55:24.000Z
CVE-2020-16248 
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-09T16:16:27.000Z
CVE-2020-16250 
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T14:17:44.000Z
CVE-2020-16251 
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T14:19:55.000Z
CVE-2020-16252 
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-05T13:40:16.000Z
CVE-2020-16253 
The PgHero gem through 2.6.0 for Ruby allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-05T13:42:19.000Z
CVE-2020-16254 
The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-05T19:52:30.000Z
CVE-2020-16255 
ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-15T17:04:47.000Z
CVE-2020-16256 
The API on Winston 1.5.4 devices is vulnerable to CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:07:40.000Z
CVE-2020-16257 
Winston 1.5.4 devices are vulnerable to command injection via the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:02:13.000Z
CVE-2020-16258 
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:18:03.000Z
CVE-2020-16259 
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:20:04.000Z
CVE-2020-16260 
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:15:56.000Z
CVE-2020-16261 
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:10:32.000Z
CVE-2020-16262 
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:12:13.000Z
CVE-2020-16263 
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T17:13:58.000Z
CVE-2020-16266 
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-12T12:59:54.000Z
CVE-2020-16267 
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T19:02:42.000Z
CVE-2020-16268 
The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM (MST) with the option to disable the installation of the Nomad module. An attacker may craft a .reg file in a specific location that will be able to write to any registry key as an elevated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T20:07:00.000Z
CVE-2020-16269 
radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-03T15:56:23.000Z
CVE-2020-16270 
OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T13:08:06.000Z
CVE-2020-16271 
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-03T16:19:23.000Z
CVE-2020-16272 
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-03T16:19:11.000Z
CVE-2020-16273 
In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the stack is not initialized. This vulnerability affects only the software that is based on Armv8-M processors with the Security Extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T18:53:45.000Z
CVE-2020-16275 
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-10T22:55:22.000Z
CVE-2020-16276 
An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-10T22:55:26.000Z
CVE-2020-16277 
An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-10T22:55:30.000Z
CVE-2020-16278 
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-10T22:55:33.000Z
CVE-2020-16279 
The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed to the command line without sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T15:22:54.000Z
CVE-2020-16280 
Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services, domain joined users, and local administrators. To exploit the vulnerability a local attacker must have access to the underlying operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T15:22:58.000Z
CVE-2020-16281 
The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T15:23:01.000Z
CVE-2020-16282 
In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. This may allow a local attacker to break out of the restricted environment or inject malicious code into the application and fully compromise the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T15:23:07.000Z
CVE-2020-16287 
A buffer overflow vulnerability in lprn_is_black() in contrib/lips4/gdevlprn.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T02:07:31.000Z
CVE-2020-16288 
A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T02:07:45.000Z
CVE-2020-16289 
A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T02:07:50.000Z