rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-25682 
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: dnsmasq
Published: 2021-01-20T16:28:38.000Z
CVE-2020-25683 
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: dnsmasq
Published: 2021-01-20T15:25:04.000Z
CVE-2020-25684 
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: n/a
product: dnsmasq
Published: 2021-01-20T15:22:21.000Z
CVE-2020-25685 
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
Problem types: cwe_id: CWE-326
description: CWE-326
Affected products: vendor: n/a
product: dnsmasq
Published: 2021-01-20T00:00:00.000Z
CVE-2020-25686 
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: n/a
product: dnsmasq
Published: 2021-01-20T16:47:17.000Z
CVE-2020-25687 
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: dnsmasq
Published: 2021-01-20T16:31:41.000Z
CVE-2020-25688 
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks were made possible.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: n/a
product: rhacm
Published: 2020-11-23T21:07:06.000Z
CVE-2020-25689 
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: Red Hat
product: wildfly-core
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2020-10-30T00:00:00.000Z
CVE-2020-25690 
An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: fontforge
Published: 2021-02-23T03:40:04.000Z
CVE-2020-25691 
A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-755
description: CWE-755
Affected products: vendor: n/a
product: darkhttpd
Published: 2022-04-01T00:00:00.000Z
CVE-2020-25692 
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: openldap
Published: 2020-12-08T00:06:29.000Z
CVE-2020-25693 
A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity.
Problem types: cwe_id: CWE-190
description: CWE-190->CWE-122->CWE-787
Affected products: vendor: n/a
product: CImg
Published: 2020-12-03T16:48:26.000Z
CVE-2020-25694 
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-327
description: CWE-327
Affected products: vendor: n/a
product: postgresql
Published: 2020-11-16T00:38:53.000Z
CVE-2020-25695 
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: postgresql
Published: 2020-11-16T00:40:36.000Z
CVE-2020-25696 
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-183
description: CWE-183->CWE-270
Affected products: vendor: n/a
product: PostgreSQL
Published: 2020-11-23T21:15:47.000Z
CVE-2020-25697 
A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2021-05-26T12:08:12.000Z
CVE-2020-25698 
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: n/a
product: moodle
Published: 2020-11-19T16:05:37.000Z
CVE-2020-25699 
In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: moodle
Published: 2020-11-19T00:00:00.000Z
CVE-2020-25700 
In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: moodle
Published: 2020-11-19T16:25:09.000Z
CVE-2020-25701 
If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: n/a
product: moodle
Published: 2020-11-19T16:10:53.000Z
CVE-2020-25702 
In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: moodle
Published: 2020-11-19T16:17:03.000Z
CVE-2020-25703 
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: n/a
product: moodle
Published: 2020-11-19T16:13:35.000Z
CVE-2020-25704 
A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: kernel
Published: 2020-12-02T00:00:00.000Z
CVE-2020-25705 
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version
Problem types: cwe_id: CWE-330
description: USE OF INSUFFICIENTLY RANDOM VALUES CWE-330
Affected products: vendor: n/a
product: Siemens Lunux Based Products
Published: 2020-11-17T01:16:17.000Z
CVE-2020-25706 
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: The Cacti Group, Inc.
product: cacti
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2020-11-12T00:00:00.000Z
CVE-2020-25708 
A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: libvncserver
Published: 2020-11-27T17:41:41.000Z
CVE-2020-25709 
A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.
Problem types: description: Reachable Assertion
Affected products: vendor: n/a
product: OpenLDAP
Published: 2021-05-18T11:51:42.000Z
CVE-2020-25710 
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-617
description: CWE-617
Affected products: vendor: n/a
product: openldap
Published: 2021-05-28T10:20:20.000Z
CVE-2020-25711 
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: n/a
product: infinispan
Published: 2020-12-03T00:00:00.000Z
CVE-2020-25712 
A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2020-12-15T16:52:38.000Z
CVE-2020-25713 
A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.
Problem types: cwe_id: CWE-20
description: CWE-20->CWE-122->CWE-125
Affected products: vendor: n/a
product: raptor2
Published: 2021-05-13T14:27:52.000Z
CVE-2020-25715 
A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: pki-core
Published: 2021-05-28T10:20:26.000Z
CVE-2020-25716 
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before cfme 5.11.10.1 are affected
Problem types: cwe_id: CWE-285
description: CWE-285->CWE-284
Affected products: vendor: n/a
product: Cloudforms
Published: 2021-06-07T20:27:15.000Z
CVE-2020-25717 
A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: samba
Published: 2022-02-18T00:00:00.000Z
CVE-2020-25718 
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: n/a
product: samba
Published: 2022-02-18T00:00:00.000Z
CVE-2020-25719 
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: samba
Published: 2022-02-18T00:00:00.000Z
CVE-2020-25720 Samba: check attribute access rights for ldap adds of computers
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
Problem types: cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Storage 3
cpes: cpe:/a:redhat:storage:3
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-11-17T10:17:07.511Z
CVE-2020-25721 
Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.
Problem types: cwe_id: CWE-20
description: CWE-20 (Improper Input validation)
Affected products: vendor: n/a
product: samba
Published: 2022-03-16T00:00:00.000Z
CVE-2020-25722 
Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: samba
Published: 2022-02-18T00:00:00.000Z
CVE-2020-25723 
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Problem types: cwe_id: CWE-617
description: CWE-617
Affected products: vendor: n/a
product: QEMU
Published: 2020-12-02T00:52:10.000Z
CVE-2020-25724 
A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Problem types: cwe_id: CWE-567
description: CWE-567
Affected products: vendor: n/a
product: resteasy
Published: 2021-05-26T20:52:06.000Z