Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10776 State: PUBLISHED Published: 2020-11-17T01:26:24 Last Updated: 2024-08-04T11:14:15.457Z Vendors: n/a Products: keycloak Problem Types: CWE-79 Description: A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847428
CVE ID: CVE-2020-10777 State: PUBLISHED Published: 2020-08-11T12:17:53 Last Updated: 2024-08-04T11:14:15.588Z Vendors: n/a Products: CloudForms Problem Types: Cross Site Scripting Description: A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847605 - https://access.redhat.com/security/cve/cve-2020-10777
CVE ID: CVE-2020-10778 State: PUBLISHED Published: 2020-08-11T12:25:07 Last Updated: 2024-08-04T11:14:15.585Z Vendors: n/a Products: CloudForms Problem Types: Incorrect Authorization Description: In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847628 - https://access.redhat.com/security/cve/cve-2020-10778
CVE ID: CVE-2020-10779 State: PUBLISHED Published: 2020-08-11T12:40:35 Last Updated: 2024-08-04T11:14:15.372Z Vendors: n/a Products: CloudForms Problem Types: Improper Access Control Description: Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847647 - https://access.redhat.com/security/cve/cve-2020-10779
CVE ID: CVE-2020-10780 State: PUBLISHED Published: 2020-08-11T13:32:24 Last Updated: 2024-08-04T11:14:15.599Z Vendors: n/a Products: CloudForms Problem Types: Improper Input Validation Description: Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.r
rigger several attack possibilities. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847794 - https://access.redhat.com/security/cve/cve-2020-10780
CVE ID: CVE-2020-10781 State: PUBLISHED Published: 2020-09-16T00:00:00 Last Updated: 2024-08-04T11:14:15.582Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Linux Kernel Products: kernel Problem Types: CWE-732 Description: A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memo
n of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=853eab68afc80f59f36bbdeb715e5c88c501e680 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10781 - https://www.openwall.com/lists/oss-security/2020/06/18/1 - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
CVE ID: CVE-2020-10782 State: PUBLISHED Published: 2020-06-18T12:49:07 Last Updated: 2024-08-04T11:14:15.612Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Red Hat Products: Ansible Tower Problem Types: CWE-276, CWE-200 Description: An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality. This is fixed in Ansible version 3.7.1. Additional Analyst Notes: - CVE Program Container: References: - https://bu
ity. This is fixed in Ansible version 3.7.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10782
CVE ID: CVE-2020-10783 State: PUBLISHED Published: 2020-08-11T12:35:13 Last Updated: 2024-08-04T11:14:15.473Z Vendors: n/a Products: CloudForms Problem Types: Improper Access Control Description: Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847811 - https://access.redhat.com/security/cve/cve-2020-10783
CVE ID: CVE-2020-10786 State: PUBLISHED Published: 2020-04-21T16:54:24 Last Updated: 2024-08-04T11:14:15.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/snippets/1954764
CVE ID: CVE-2020-10787 State: PUBLISHED Published: 2020-04-21T16:54:47 Last Updated: 2024-08-04T11:14:15.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password (aka the user password change script). Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/snippets/1954764
CVE ID: CVE-2020-10788 State: PUBLISHED Published: 2020-03-25T14:04:47 Last Updated: 2024-08-04T11:14:15.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee - https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
CVE ID: CVE-2020-10789 State: PUBLISHED Published: 2020-03-25T14:00:49 Last Updated: 2024-08-04T11:14:15.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/it-novum/openITCOCKPIT/commit/73b5b34afa8bd82ff26c0097558341214c768cfc - https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
CVE ID: CVE-2020-10790 State: PUBLISHED Published: 2020-03-25T13:59:59 Last Updated: 2024-08-04T11:14:15.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/it-novum/openITCOCKPIT/commit/6c9bb1d7cf5f24683e704cee8c84b8b6d850d8bf - https://github.com/it-novum/openITCOCKPIT/commit/3838d98d35ececc7e83cf0f7cf785c9a7729cdbf - https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
CVE ID: CVE-2020-10791 State: PUBLISHED Published: 2020-03-25T13:58:31 Last Updated: 2024-08-04T11:14:15.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/it-novum/openITCOCKPIT/commit/50722befae4cfedd0103f9b0ec2a7e22530b2385 - https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
CVE ID: CVE-2020-10792 State: PUBLISHED Published: 2020-03-20T17:48:21 Last Updated: 2024-08-04T11:14:15.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/it-novum/openITCOCKPIT/commit/719410b9ffff7d7b29dba7aad58faceb5eff789f - https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
CVE ID: CVE-2020-10793 State: PUBLISHED Published: 2020-03-23T14:12:20 Last Updated: 2024-08-04T11:14:15.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Ses
ecause the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeigniter-framework-ca30741ad297 - https://codeigniter4.github.io/userguide/extending/authentication.html
CVE ID: CVE-2020-10794 State: PUBLISHED Published: 2020-05-07T20:31:12 Last Updated: 2024-08-04T11:14:15.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined with CVE-2020-10795 for remote root access. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE ID: CVE-2020-10795 State: PUBLISHED Published: 2020-05-07T20:33:04 Last Updated: 2024-08-04T11:14:15.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE ID: CVE-2020-10797 State: PUBLISHED Published: 2020-04-29T13:29:52 Last Updated: 2024-08-04T11:14:15.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/10355 - https://github.com/pfsense/pfsense/commit/cc3990a334059018b004c91eeb66c147d8afe83d - https://docs.netgate.com/pfsense/en/latest/releases/2-4-5-new-features-and-changes.html
CVE ID: CVE-2020-10799 State: PUBLISHED Published: 2020-03-20T22:40:23 Last Updated: 2024-08-04T11:14:15.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/deeplook/svglib/issues/229
CVE ID: CVE-2020-10800 State: PUBLISHED Published: 2020-03-21T14:06:56 Last Updated: 2024-08-04T11:14:15.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/1306
CVE ID: CVE-2020-10802 State: PUBLISHED Published: 2020-03-22T03:48:33 Last Updated: 2024-08-04T11:14:15.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/s
licious database or table. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2020-3/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40li
ject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
CVE ID: CVE-2020-10803 State: PUBLISHED Published: 2020-03-22T03:48:16 Last Updated: 2024-08-04T11:14:15.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/securi
igger the XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2020-4/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.f
org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
CVE ID: CVE-2020-10804 State: PUBLISHED Published: 2020-03-22T03:47:59 Last Updated: 2024-08-04T11:14:15.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges). Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2020-2/ - http://
tional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2020-2/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ - http://lists.opensuse.org/opensuse
ackage-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html
CVE ID: CVE-2020-10806 State: PUBLISHED Published: 2020-03-22T15:34:08 Last Updated: 2024-08-04T11:14:15.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution. Additional Analyst Notes: - CVE Program Container: References: - https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads
CVE ID: CVE-2020-10807 State: PUBLISHED Published: 2020-03-22T15:50:57 Last Updated: 2024-08-04T11:14:15.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mitre/caldera/issues/1405 - https://github.com/mitre/caldera/pull/1407 - https://github.com/mitre/caldera/compare/2.6.4...2.6.5 - https://github.com/mitre/caldera/releases/tag/2.6.5
CVE ID: CVE-2020-10808 State: PUBLISHED Published: 2020-03-22T16:07:34 Last Updated: 2024-08-04T11:14:15.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - https://forum.vestacp.com/viewforum.php?f=25 - https://pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis/ -
rum.php?f=25 - https://pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis/ - https://github.com/rapid7/metasploit-framework/pull/13094 - http://packetstormsecurity.com/files/157111/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.html - http://packetstormsecurity.com/files/157219/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.html
CVE ID: CVE-2020-10809 State: PUBLISHED Published: 2020-03-22T17:42:35 Last Updated: 2024-08-04T11:14:15.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress() located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/heap-overflow-in-decompress-c-hdf5-1-13-0/ - https://github.com/Loginsoft-Research/hdf5-reports/tree/master/Vuln_1 - https://bitbucket.hdfgroup.org/projects/HDFFV/repos/hdf5/
ithub.com/Loginsoft-Research/hdf5-reports/tree/master/Vuln_1 - https://bitbucket.hdfgroup.org/projects/HDFFV/repos/hdf5/browse/release_docs/RELEASE.txt
CVE ID: CVE-2020-10810 State: PUBLISHED Published: 2020-03-22T17:42:26 Last Updated: 2024-08-04T11:14:15.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.hdfgroup.org/projects/HDFFV/repos/hdf5/browse/release_docs/RELEASE.txt - https://research.loginsoft.com/bugs/null-pointer-dereference-in-h5ac-c-hdf5-1-13-0/ - https://github.com/Loginsoft-Research/hdf5-reports/tree/master/Vuln_3
CVE ID: CVE-2020-10811 State: PUBLISHED Published: 2020-03-22T17:42:17 Last Updated: 2024-08-04T11:14:15.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5Olayout.c. It allows an attacker to cause Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.hdfgroup.org/projects/HDFFV/repos/hdf5/browse/release_docs/RELEASE.txt - https://research.loginsoft.com/bugs/heap-buffer-overflow-in-h5olayout-c-hdf5-1-13-0/ - https://github.com/Loginsoft-Research/hdf5-reports/tree/master/Vuln_2
CVE ID: CVE-2020-10812 State: PUBLISHED Published: 2020-03-22T17:42:04 Last Updated: 2024-08-04T11:14:15.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.hdfgroup.org/projects/HDFFV/repos/hdf5/browse/release_docs/RELEASE.txt - https://research.loginsoft.com/bugs/null-pointer-dereference-in-h5fquery-c-hdf5-1-13-0/ - https://github.com/Loginsoft-Research/hdf5-reports/tree/master/Vuln_4
CVE ID: CVE-2020-10813 State: PUBLISHED Published: 2020-04-17T12:37:10 Last Updated: 2024-08-04T11:14:15.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentex.ca/~mwandel/ftpdmin/ - https://www.povonsec.com/ftpdmin-denial-of-service-exploit/