Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
he database), and in some cases would allow remote login to the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.fiserv.com - https://github.com/micahvandeusen/PrologueDecrypt
CVE ID: CVE-2020-36002 State: PUBLISHED Published: 2021-02-17T14:32:18 Last Updated: 2024-08-04T17:16:14.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seat-Reservation-System 1.0 has a SQL injection vulnerability in index.php in the id parameter where attackers can obtain sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Seat-Reservation-System - https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip - https://www.sourcecodester.com/php/14452/seat-reservation-system-movie-theater-project-using-phpmysql.htm
CVE ID: CVE-2020-36003 State: PUBLISHED Published: 2021-02-17T14:32:25 Last Updated: 2024-08-04T17:16:13.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14383/online-book-store.html - https://www.sourcecodester.com/download-code?nid=14383&title=Online+Book+Store - https://github.com/TCSWT/Online-Book-Store/blob/main/Online-Book-Store.md
CVE ID: CVE-2020-36004 State: PUBLISHED Published: 2021-06-03T22:15:37 Last Updated: 2024-08-04T17:16:14.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppCMS 2.0.101 in /admin/download_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/appcms/issues/2
CVE ID: CVE-2020-36005 State: PUBLISHED Published: 2021-06-03T22:15:48 Last Updated: 2024-08-04T17:16:13.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/appcms/issues/3
CVE ID: CVE-2020-36006 State: PUBLISHED Published: 2021-06-03T22:15:58 Last Updated: 2024-08-04T17:16:13.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/appcms/issues/4
CVE ID: CVE-2020-36007 State: PUBLISHED Published: 2021-06-03T22:16:08 Last Updated: 2024-08-04T17:16:14.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive information of other users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/appcms/issues/7
CVE ID: CVE-2020-36008 State: PUBLISHED Published: 2021-06-03T22:16:17 Last Updated: 2024-08-04T17:16:14.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SomeBottle/OBottle/issues/7
CVE ID: CVE-2020-36009 State: PUBLISHED Published: 2021-06-03T22:16:26 Last Updated: 2024-08-04T17:16:13.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SomeBottle/OBottle/issues/6
CVE ID: CVE-2020-36011 State: PUBLISHED Published: 2021-01-26T06:53:49 Last Updated: 2024-08-04T17:16:14.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field. Additional Analyst Notes: - CVE Program Container: References: - http://qdocs.com - https://www.exploit-db.com/exploits/49290
CVE ID: CVE-2020-36012 State: PUBLISHED Published: 2021-01-27T12:11:02 Last Updated: 2024-08-04T17:16:13.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field. Additional Analyst Notes: - CVE Program Container: References: - http://bdtask.com - http://multi-store.com - https://kislay00.medium.com/m-store-multi-store-inventory-management-system-add-customer-stored-xss-875a376770ec
CVE ID: CVE-2020-36023 State: PUBLISHED Published: 2023-08-11T00:00:00.000Z Last Updated: 2025-11-03T19:25:33.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013 - https://lists.debian.org/debian-lts-announce/2023/08/msg00017.html
CVE ID: CVE-2020-36024 State: PUBLISHED Published: 2023-08-11T00:00:00.000Z Last Updated: 2025-11-03T19:25:35.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1016 - https://lists.debian.org/debian-lts-announce/2023/08/msg00017.html
CVE ID: CVE-2020-36033 State: PUBLISHED Published: 2021-07-22T17:34:09 Last Updated: 2024-08-04T17:16:13.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TCSWT/Water-Billing-System
CVE ID: CVE-2020-36034 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:55:36.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manage_user.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/14535/school-faculty-scheduling-system-using-phpmysqli-source-code.html - https://github.com/TCSWT/School-Faculty-Scheduling-System - https://www.sourcecodester
sing-phpmysqli-source-code.html - https://github.com/TCSWT/School-Faculty-Scheduling-System - https://www.sourcecodester.com/download-code?nid=14535&title=School+Faculty+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code
CVE ID: CVE-2020-36037 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:55:00.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wuzhicms/wuzhicms/issues/192
CVE ID: CVE-2020-36048 State: PUBLISHED Published: 2021-01-07T23:24:33 Last Updated: 2024-08-04T17:16:14.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b - https://blog.caller.xyz/socketio-engineio-dos/ - https://github.com/bcaller/kill-engine-io
CVE ID: CVE-2020-36049 State: PUBLISHED Published: 2021-01-07T23:24:23 Last Updated: 2024-08-04T17:16:14.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used. Additional Analyst Notes: - CVE Program Container: References: - https://blog.caller.xyz/socketio-engineio-dos/ - https://github.com/bcaller/kill-engine-io - https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
CVE ID: CVE-2020-36051 State: PUBLISHED Published: 2021-01-05T21:12:59 Last Updated: 2024-08-04T17:16:14.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/39
CVE ID: CVE-2020-36052 State: PUBLISHED Published: 2021-01-05T21:12:58 Last Updated: 2024-08-04T17:16:14.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/38
CVE ID: CVE-2020-36056 State: PUBLISHED Published: 2022-01-31T12:48:41 Last Updated: 2024-08-04T17:16:14.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scripting (XSS) vulnerability via the Ping diagnostic option. Additional Analyst Notes: - CVE Program Container: References: - https://www.linkedin.com/in/vivek-panday-796768149 - https://github.com/VivekPanday12/CVE-/issues/5
CVE ID: CVE-2020-36062 State: PUBLISHED Published: 2022-02-11T15:03:42 Last Updated: 2024-08-04T17:16:14.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/ - https://phpgurukul.com - https://github.com/VivekPanday12/CVE-/issues/3
CVE ID: CVE-2020-36064 State: PUBLISHED Published: 2022-01-31T12:43:48 Last Updated: 2024-08-04T17:16:13.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ - https://www.sourcecodester.com/sites/default/files/download/razormist/online-course-registration.zip - https://github.com/VivekPanday12/CVE-/issues/2
CVE ID: CVE-2020-36065 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T15:25:53.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admin_save. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sunkaifei/FlyCms/issues/8 - https://github.com/sunkaifei/FlyCms
CVE ID: CVE-2020-36066 State: PUBLISHED Published: 2021-01-05T20:41:16 Last Updated: 2024-08-04T17:16:14.045Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tidwall/gjson/issues/195
CVE ID: CVE-2020-36067 State: PUBLISHED Published: 2021-01-05T20:41:05 Last Updated: 2024-08-04T17:16:14.100Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tidwall/gjson/issues/196
CVE ID: CVE-2020-36070 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T16:57:42.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/the-control-group/voyager/
CVE ID: CVE-2020-36071 State: PUBLISHED Published: 2023-04-06T00:00:00.000Z Last Updated: 2025-02-12T16:09:08.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Abdallah-Fouad-X/CVE-s/blob/main/README.md
CVE ID: CVE-2020-36072 State: PUBLISHED Published: 2023-04-06T00:00:00.000Z Last Updated: 2025-02-12T16:04:53.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the id parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Abdallah-Fouad-X/CVE-s/blob/main/README.md
CVE ID: CVE-2020-36073 State: PUBLISHED Published: 2023-04-06T00:00:00.000Z Last Updated: 2025-02-11T19:42:01.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Abdallah-Fouad-X/CVE-s/blob/main/README.md
CVE ID: CVE-2020-36074 State: PUBLISHED Published: 2023-04-06T00:00:00.000Z Last Updated: 2025-02-12T16:02:44.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Abdallah-Fouad-X/CVE-s/blob/main/README.md
CVE ID: CVE-2020-36077 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-12T14:22:02.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the customer parameter of the orderadd.php file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/abdallah-fouad/ - https://github.com/Abdallah-Fouad-X/CVE-s/blob/main/README.md
CVE ID: CVE-2020-36079 State: PUBLISHED Published: 2021-02-26T22:49:40 Last Updated: 2024-08-04T17:16:14.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site. Additional Analyst Notes: - CVE Program Container: Refere
an admin who has "lots of other possibilities to harm a site. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/161569/Zenphoto-CMS-1.5.7-Shell-Upload.html - https://www.zenphoto.org/news/why-not-every-security-issue-is-really-an-issue/ - https://github.com/zenphoto/zenphoto/issues/1292
CVE ID: CVE-2020-36082 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:40:19.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alexlang24/bloofoxCMS/issues/7
CVE ID: CVE-2020-36084 State: PUBLISHED Published: 2025-02-05T00:00:00.000Z Last Updated: 2025-02-06T15:26:00.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_students.php?id= parameter via id field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/49357
CVE ID: CVE-2020-36085 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-11T14:35:23.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary code via First and Last Name in Apply For This Job Form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/manitorpotterk/CVE/blob/main/Egavilan%20Media%20XSS.md
CVE ID: CVE-2020-36109 State: PUBLISHED Published: 2021-02-01T13:14:20 Last Updated: 2024-08-04T17:16:13.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module that can cause code execution when an attacker constructs malicious data. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/
CVE ID: CVE-2020-36112 State: PUBLISHED Published: 2021-01-04T14:46:37 Last Updated: 2024-08-04T17:16:14.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in cart.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database on which the web application is running. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49314
CVE ID: CVE-2020-36115 State: PUBLISHED Published: 2021-01-28T19:15:37 Last Updated: 2024-08-04T17:16:14.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49484
CVE ID: CVE-2020-36120 State: PUBLISHED Published: 2021-04-14T13:50:40 Last Updated: 2024-08-04T17:16:14.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saitoha/libsixel/issues/143
CVE ID: CVE-2020-36123 State: REJECTED Published: N/A Last Updated: 2024-05-02T21:49:22.252458 Description: No description available.
CVE ID: CVE-2020-36124 State: PUBLISHED Published: 2021-05-07T10:35:14 Last Updated: 2024-08-04T17:16:14.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user (clients and administrators). Additional Analyst Notes: - CVE Program Container: References: - https://marketing.paxtechnology.com/about-pax - https://www.whatspos.com/ - https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/
CVE ID: CVE-2020-36125 State: PUBLISHED Published: 2021-05-07T10:35:09 Last Updated: 2024-08-04T17:16:14.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly. Additional Analyst Notes: - CVE Program Container: References: - https://marketing.paxtechnology.com/about-pax - https://www.whatspos.com/ - https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/
CVE ID: CVE-2020-36126 State: PUBLISHED Published: 2021-05-07T10:34:58 Last Updated: 2024-08-04T17:16:14.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and payment terminals, where an attacker can impersonate any user which may lead to the unauthorized disclosure, modification, or destruction of information. Additional Analyst Notes: - CVE Program Container: References: - https://marketing.paxtec
or destruction of information. Additional Analyst Notes: - CVE Program Container: References: - https://marketing.paxtechnology.com/about-pax - https://www.whatspos.com/ - https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/
CVE ID: CVE-2020-36127 State: PUBLISHED Published: 2021-05-07T10:34:50 Last Updated: 2024-08-04T17:16:14.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the option to replace the current certificate and it is not possible to view the certificate password (p12) already deployed on the platform. The replacement p12 certificate returns to users in base64 with its password, which can be acces
ployed on the platform. The replacement p12 certificate returns to users in base64 with its password, which can be accessed by non-administrator users. Additional Analyst Notes: - CVE Program Container: References: - https://marketing.paxtechnology.com/about-pax - https://www.whatspos.com/ - https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/