GNU Gnats vulnerabilities

3 CVEs affecting GNU Gnats, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-2808, published 2007-05-22.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2004-0623, published 2004-12-06. High severity, CVSS 10.0. EPSS: 4.5% chance of exploitation in the next 30 days. Format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog.
• CVE-2007-2808, published 2007-05-22. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99 allows remote attackers to inject arbitrary web script or HTML via the database parameter.
• CVE-2005-2180, published 2005-07-11. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access, which allows local…