Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-14163 State: PUBLISHED Published: 2020-06-15T20:14:05 Last Updated: 2024-08-04T12:39:35.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider the case where garbage collection is triggered after the key operation but before the value operation, as demonstrated by improper read access to memory in ecma_gc_set_object_visited in ecma/base/ecma-gc.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3804 - https://github.com/jerryscript-project/jerryscript/commi
ttps://github.com/jerryscript-project/jerryscript/issues/3804 - https://github.com/jerryscript-project/jerryscript/commit/c2b662170245a16f46ce02eae68815c325d99821
CVE ID: CVE-2020-14164 State: PUBLISHED Published: 2020-07-01T01:35:25.329086Z Last Updated: 2024-09-16T16:59:07.646Z Vendors: Atlassian Products: Jira Server and Data Center Problem Types: Cross Site Scripting (XSS) Description: The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71184
CVE ID: CVE-2020-14165 State: PUBLISHED Published: 2020-07-01T01:35:25.806770Z Last Updated: 2024-09-16T22:26:41.672Z Vendors: Atlassian Products: Jira Server and Data Center Problem Types: Improper authorization Description: The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71185
CVE ID: CVE-2020-14166 State: PUBLISHED Published: 2020-07-01T01:35:26.241113Z Last Updated: 2024-09-16T16:33:13.111Z Vendors: Atlassian Products: Jira Service Desk Server and Data Center Problem Types: Cross Site Scripting (XSS) Description: The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JSDSERVER-6895 - http://packetstormsecurity.com/files/162107/Atlassi
er: References: - https://jira.atlassian.com/browse/JSDSERVER-6895 - http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-14167 State: PUBLISHED Published: 2020-07-01T01:35:26.668525Z Last Updated: 2024-09-17T00:57:08.846Z Vendors: Atlassian Products: Jira Server and Data Center Problem Types: Denial of Service (DoS) Description: The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71197
CVE ID: CVE-2020-14168 State: PUBLISHED Published: 2020-07-01T01:35:27.144694Z Last Updated: 2024-09-16T18:02:52.905Z Vendors: Atlassian Products: Jira Server and Data Center Problem Types: Man-in-the-Middle (MitM) Description: The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71198
CVE ID: CVE-2020-14169 State: PUBLISHED Published: 2020-07-01T01:35:27.569795Z Last Updated: 2024-09-16T20:28:10.550Z Vendors: Atlassian Products: Jira Server and Data Center Problem Types: Cross-Site Scripting (XSS) Description: The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71205
CVE ID: CVE-2020-14170 State: PUBLISHED Published: 2020-07-09T17:20:48.079852Z Last Updated: 2024-09-17T04:09:37.826Z Vendors: Atlassian Products: Bitbucket Server Problem Types: Server Side Request Forgery (SSRF) Description: Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BSERV-12433
CVE ID: CVE-2020-14171 State: PUBLISHED Published: 2020-07-09T17:17:29.210940Z Last Updated: 2024-09-17T02:01:36.709Z Vendors: Atlassian Products: Bitbucket Server Problem Types: Man-in-the-Middle (MITM) Description: Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BSERV-12434
CVE ID: CVE-2020-14172 State: PUBLISHED Published: 2020-07-03T01:40:11.484562Z Last Updated: 2024-09-17T03:53:46.936Z Vendors: Atlassian Products: Jira Server Problem Types: Template Injection Description: This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote code execution via insecure deserialization, if they were able to exploit a server side template injection vulnerability. The affected versions are before version 7.13.0, from version 8.0.0 before
server side template injection vulnerability. The affected versions are before version 7.13.0, from version 8.0.0 before 8.5.0, and from version 8.6.0 before version 8.8.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70940
CVE ID: CVE-2020-14173 State: PUBLISHED Published: 2020-07-03T01:50:11.284713Z Last Updated: 2024-09-16T21:56:45.464Z Vendors: Atlassian Products: Jira Server Problem Types: Stored Cross-Site Scripting Description: The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-70814
CVE ID: CVE-2020-14174 State: PUBLISHED Published: 2020-07-13T04:45:13.167764Z Last Updated: 2024-09-16T20:31:56.101Z Vendors: Atlassian Products: Jira Server Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/brows
8.10.0 before 8.10.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71275
CVE ID: CVE-2020-14175 State: PUBLISHED Published: 2020-07-24T07:05:16.144536Z Last Updated: 2024-09-16T20:58:53.451Z Vendors: Atlassian Products: Confluence Server Problem Types: Stored Cross-Site Scripting (SXSS) Description: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-60102
CVE ID: CVE-2020-14177 State: PUBLISHED Published: 2020-09-21T01:10:14.986020Z Last Updated: 2024-09-17T01:00:48.724Z Vendors: Atlassian Products: Jira Server Problem Types: Denial of Service Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71388
CVE ID: CVE-2020-14178 State: PUBLISHED Published: 2020-09-01T04:25:13.421216Z Last Updated: 2024-09-16T22:45:49.594Z Vendors: Atlassian Products: Jira Server Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71498
CVE ID: CVE-2020-14179 State: PUBLISHED Published: 2020-09-21T00:50:12.069829Z Last Updated: 2024-09-16T16:17:53.447Z Vendors: Atlassian Products: Jira Server Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71536
CVE ID: CVE-2020-14180 State: PUBLISHED Published: 2020-09-21T00:55:12.877243Z Last Updated: 2024-09-17T01:26:00.604Z Vendors: Atlassian Products: Jira Service Desk Server Problem Types: Broken Access Control Description: Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions are before version 4.12.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JSDSERVER-6917
CVE ID: CVE-2020-14181 State: PUBLISHED Published: 2020-09-17T00:35:13.239120Z Last Updated: 2024-09-16T21:57:12.718Z Vendors: Atlassian Products: Jira Server Problem Types: Broken Access Control Description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71560 - http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1
- https://jira.atlassian.com/browse/JRASERVER-71560 - http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html
CVE ID: CVE-2020-14183 State: PUBLISHED Published: 2020-10-06T22:20:13.382590Z Last Updated: 2024-09-17T02:16:18.539Z Vendors: Atlassian Products: Jira Server Problem Types: Information Disclosure Description: Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71646
CVE ID: CVE-2020-14184 State: PUBLISHED Published: 2020-10-12T03:15:14.763070Z Last Updated: 2024-09-17T00:10:51.045Z Vendors: Atlassian Products: Jira Server Problem Types: Cross-Site Scripting (XSS) Description: Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71652
CVE ID: CVE-2020-14185 State: PUBLISHED Published: 2020-10-15T21:25:13.824292Z Last Updated: 2024-09-16T16:24:13.539Z Vendors: Atlassian Products: Jira Server Problem Types: Broken Authentication Description: Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource. The affected versions are before 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before version 8.12.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71696
CVE ID: CVE-2020-14188 State: PUBLISHED Published: 2020-11-09T21:45:18.910155Z Last Updated: 2024-09-17T04:25:28.696Z Vendors: Atlassian Products: gajira-create Problem Types: Template Injection Description: The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atlassian/gajira-create/security/advisories/GHSA-4xqx-pqpj-9fqw
CVE ID: CVE-2020-14189 State: PUBLISHED Published: 2020-11-09T21:45:19.325810Z Last Updated: 2024-09-16T20:13:22.226Z Vendors: Atlassian Products: gajira-comment Problem Types: Template Injection Description: The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atlassian/gajira-comment/security/advisories/GHSA-hj6w-pm28-h8hf
CVE ID: CVE-2020-14190 State: PUBLISHED Published: 2020-11-25T22:40:12.690452Z Last Updated: 2024-09-16T17:18:22.523Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Regex Denial of Service (ReDoS) Description: Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8498 - https://jira.atlassian.com/browse/FE-7336
CVE ID: CVE-2020-14191 State: PUBLISHED Published: 2020-11-25T21:55:12.551152Z Last Updated: 2024-09-17T04:09:47.835Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Denial of Service (DoS) Description: Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8501 - https://jira.atlassian.com/browse/FE-7332
CVE ID: CVE-2020-14192 State: PUBLISHED Published: 2021-02-01T23:45:15.351944Z Last Updated: 2024-09-16T16:14:04.913Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Information Disclosure Description: Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7334 - https://jira.atlassian.com/browse/CRUC-8502
CVE ID: CVE-2020-14193 State: PUBLISHED Published: 2020-11-30T23:05:16.049659Z Last Updated: 2024-09-17T04:09:57.670Z Vendors: Atlassian Products: Automation for Jira Problem Types: Template Injection Description: Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are those before version 7.1.15. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JIRAAUTOSERVER-185
CVE ID: CVE-2020-14194 State: PUBLISHED Published: 2020-08-21T04:37:27 Last Updated: 2024-08-04T12:39:36.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/
CVE ID: CVE-2020-14195 State: PUBLISHED Published: 2020-06-16T15:07:11 Last Updated: 2024-08-04T12:39:36.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/2765 - https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200702-0003/ - https://www.oracle.com/security
rity-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200702-0003/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-14196 State: PUBLISHED Published: 2020-07-01T17:03:04 Last Updated: 2024-08-04T12:39:36.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/07/01/1 - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00043.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00044.html - http://list
nnounce/2020-07/msg00043.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00044.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00042.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TUNCUZNASYSTVD35QGFAI6XO2BFMQ2F/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html
CVE ID: CVE-2020-14198 State: PUBLISHED Published: 2020-09-10T16:36:45 Last Updated: 2024-08-04T12:39:36.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core 0.20.0 allows remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2020-14198 - https://github.com/bitcoin/bitcoin/commits/master - https://security.gentoo.org/glsa/202009-18
CVE ID: CVE-2020-14199 State: PUBLISHED Published: 2020-06-16T17:07:22 Last Updated: 2024-08-04T12:39:36.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the Trezor One and 2.3.1 for the Trezor Model T. Additional Analyst Notes: - CVE Program Container: References: - https://blog.trezor.io/details-of-firmware-updates-for-trezor-one-version-1-9-1-and-trezor-model-t-version-2-3-1-1eba8f60f2dd
CVE ID: CVE-2020-14201 State: PUBLISHED Published: 2020-08-21T18:30:46 Last Updated: 2024-08-04T12:39:36.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-011
CVE ID: CVE-2020-14202 State: PUBLISHED Published: 2020-06-22T12:47:09 Last Updated: 2024-08-04T12:39:36.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.hooperlabs.xyz/disclosures/webfocus.php
CVE ID: CVE-2020-14203 State: PUBLISHED Published: 2020-06-22T12:47:06 Last Updated: 2024-08-04T12:39:36.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) endpoint. The impact may be creation of an administrative user. It can also be exploited in conjunction with CVE-2016-9044. Additional Analyst Notes: - CVE Program Container: References: - https://www.hooperlabs.xyz/disclosures/webfocus.php
CVE ID: CVE-2020-14204 State: PUBLISHED Published: 2020-06-22T12:47:07 Last Updated: 2024-08-04T12:39:36.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibi_apps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes to the application repository configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.hooperlabs.xyz/disclosures/webfocus.php
CVE ID: CVE-2020-14205 State: PUBLISHED Published: 2020-12-08T19:46:28 Last Updated: 2024-08-04T12:39:36.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/divebook/#developers - https://www.hooperlabs.xyz/disclosures/divebook.php