CVE-2020-15101

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-674

Affected software

Vendor	Product	Versions
schokokeksorg	freewvs	< 0.1.1

References

https://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143Patch, Third Party Advisory
https://github.com/schokokeksorg/freewvs/security/advisories/GHSA-7pmh-vrww-25xxThird Party Advisory
https://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143Patch, Third Party Advisory
https://github.com/schokokeksorg/freewvs/security/advisories/GHSA-7pmh-vrww-25xxThird Party Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151026.5In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configurat CVE-2020-151033.5In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients a CVE-2020-151045.4In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS S CVE-2020-151055.4Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is CVE-2020-151066.5In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length f CVE-2020-151075.3In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating CVE-2020-151087.1In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.CVE-2020-151095.3In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This CVE-2020-15117.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations. An CVE-2020-151108.1In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the d CVE-2020-151115.4In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and th CVE-2020-151126.5In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in