Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13382 State: PUBLISHED Published: 2020-07-01T14:20:03 Last Updated: 2024-08-04T12:18:17.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: openSIS through 7.4 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Responsive-Design/commits/master - http://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.html - http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html
CVE ID: CVE-2020-13383 State: PUBLISHED Published: 2020-07-01T14:23:18 Last Updated: 2024-08-04T12:18:17.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: openSIS through 7.4 allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8 - http://packetstormsecurity.com/files/158256/openSIS-7.4-Local-File-Inclusion.html - http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html
CVE ID: CVE-2020-13384 State: PUBLISHED Published: 2020-05-22T04:45:43 Last Updated: 2024-08-04T12:18:17.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48479
CVE ID: CVE-2020-13386 State: PUBLISHED Published: 2020-05-27T12:29:21 Last Updated: 2024-08-04T12:18:17.850Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installation folder. Additionally, when the product is installed, two scheduled tasks are created on the machine, SDMsgUpdate (Local) and SDMsgUpdate (TE). The scheduled tasks run in the context of the user who installed the product. Both scheduled tasks attempt to run the same binary, C:\SmartDraw 2020\Messages\SDNotify.exe. T
o installed the product. Both scheduled tasks attempt to run the same binary, C:\SmartDraw 2020\Messages\SDNotify.exe. The folder Messages doesn't exist by default and (by extension) neither does SDNotify.exe. Due to the weak folder permissions, these can be created by any user. A malicious actor can therefore create a malicious SDNotify.exe binary, and have it automatically run, whenever the user who installed the product logs on to the machine. The malicious SDNotify.exe could, for example, create a new local administrator account on the machine. Additional Analyst Notes: - CVE Program Container: References: - https://improsec.com/tech-blog/how-not-do-handle-responsible-disclosure-smartdra
- CVE Program Container: References: - https://improsec.com/tech-blog/how-not-do-handle-responsible-disclosure-smartdraw-2020
CVE ID: CVE-2020-13387 State: PUBLISHED Published: 2020-09-25T03:34:45 Last Updated: 2024-08-04T12:18:17.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323. Additional Analyst Notes: - CVE Program Container: References: - https://www.pexip.com - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2020-13388 State: PUBLISHED Published: 2020-05-22T16:07:19 Last Updated: 2024-08-04T12:18:17.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/ - https://security.netapp.com/
s://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/ - https://security.netapp.com/advisory/ntap-20200528-0002/
CVE ID: CVE-2020-13389 State: PUBLISHED Published: 2020-05-22T16:07:10 Last Updated: 2024-08-04T12:18:17.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/openSchedWifi schedStartTime and schedEndTime parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker ca
d in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13389-Tenda-vulnerability/
CVE ID: CVE-2020-13390 State: PUBLISHED Published: 2020-05-22T16:07:03 Last Updated: 2024-08-04T12:18:17.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/addressNat entrys and mitInterface parameters for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construc
ntf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13390-Tenda-vulnerability/
CVE ID: CVE-2020-13391 State: PUBLISHED Published: 2020-05-22T16:06:55 Last Updated: 2024-08-04T12:18:17.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetSpeedWan speed_dir parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to
variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13391-Tenda-vulnerability/
CVE ID: CVE-2020-13392 State: PUBLISHED Published: 2020-05-22T16:06:47 Last Updated: 2024-08-04T12:18:17.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carr
able placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13392-Tenda-vulnerability/
CVE ID: CVE-2020-13393 State: PUBLISHED Published: 2020-05-22T16:06:41 Last Updated: 2024-08-04T12:18:17.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/saveParentControlInfo deviceId and time parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can cons
strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13393-Tenda-vulnerability/
CVE ID: CVE-2020-13394 State: PUBLISHED Published: 2020-05-22T16:06:34 Last Updated: 2024-08-04T12:18:17.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetNetControlList list parameter for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to
variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://joel-malwarebenchmark.github.io - https://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13394-Tenda-vulnerability/
CVE ID: CVE-2020-13396 State: PUBLISHED Published: 2020-05-22T00:00:00 Last Updated: 2024-08-04T12:18:17.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/compare/2.1.0...2.1.1 - https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae91104628c7bb69 - https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20e1da6bc - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.co
FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20e1da6bc - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-13397 State: PUBLISHED Published: 2020-05-22T00:00:00 Last Updated: 2024-08-04T12:18:17.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/compare/2.1.0...2.1.1 - https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae91104628c7bb69 - https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a348826a9ef8 - https://usn.ubuntu.com/4379-1/ - https://u
/github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a348826a9ef8 - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-13398 State: PUBLISHED Published: 2020-05-22T00:00:00 Last Updated: 2024-08-04T12:18:17.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/compare/2.1.0...2.1.1 - https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae91104628c7bb69 - https://github.com/FreeRDP/FreeRDP/commit/8305349a943c68b1bc8c158f431dc607655aadea - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://li
t/8305349a943c68b1bc8c158f431dc607655aadea - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-13401 State: PUBLISHED Published: 2020-06-02T13:42:09 Last Updated: 2024-08-04T12:18:17.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/engine/release-notes/ - http://www.openwall.com/lists/oss-security/2020/06/01/5 - https://github.com/docker/docker-ce/releases/tag/v19.03.11 - https://lists.fedoraproject.org/archiv
urity/2020/06/01/5 - https://github.com/docker/docker-ce/releases/tag/v19.03.11 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DN4JQAOXBE3XUNK3FD423LHE3K74EMJT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZLKRCOJMOGUIJI2AS27BOZS3RBEF3K/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00040.html - https://www.debian.org/security/2020/dsa-4716 - https://security.netapp.com/advisory/ntap-20200717-0002/ - https://security.gentoo.org/glsa/202008-15
CVE ID: CVE-2020-13404 State: PUBLISHED Published: 2020-08-05T20:59:41 Last Updated: 2024-08-04T12:18:17.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3.0.5 for Magento allows command injection. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/ - https://github.com/quadra-informatique/Atos-Magento/releases - https://sysdream.com/news/lab/2020-06-09-cve-2020-13404-remote-system-command-injection-in-atos-magento-module/
CVE ID: CVE-2020-13405 State: PUBLISHED Published: 2020-07-16T18:23:35 Last Updated: 2024-08-04T12:18:17.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6 - https://rhinosecuritylabs.com/research/microweber-database-disclosure/
CVE ID: CVE-2020-13407 State: PUBLISHED Published: 2021-02-09T04:28:47 Last Updated: 2024-08-04T12:18:17.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3) Additional An
hich can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13408 State: PUBLISHED Published: 2021-02-09T04:28:36 Last Updated: 2024-08-04T12:18:17.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 2 of 3) Additional An
hich can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 2 of 3) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13409 State: PUBLISHED Published: 2021-02-09T04:28:41 Last Updated: 2024-08-04T12:18:18.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 3 of 3) Additional An
hich can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 3 of 3) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13410 State: PUBLISHED Published: 2020-08-26T14:35:52 Last Updated: 2024-08-04T12:18:17.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moscajs/aedes/pull/493 - https://payatu.com/advisory/dos-in-aedes-mqtt-broker - https://cwe.mitre.org/data/definitions/248.html
CVE ID: CVE-2020-13412 State: PUBLISHED Published: 2020-05-22T20:48:50 Last Updated: 2024-08-04T12:18:17.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#cross-site-request-forgery-csrf
CVE ID: CVE-2020-13413 State: PUBLISHED Published: 2020-05-22T20:48:39 Last Updated: 2024-08-04T12:18:18.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#observable-response-discrepancy-from-api - https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/
CVE ID: CVE-2020-13414 State: PUBLISHED Published: 2020-05-22T20:48:31 Last Updated: 2024-08-04T12:18:17.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#clean-up-old-code - https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/
CVE ID: CVE-2020-13415 State: PUBLISHED Published: 2020-05-22T20:48:23 Last Updated: 2024-08-04T12:18:17.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#xml-signature-wrapping-in-saml
CVE ID: CVE-2020-13416 State: PUBLISHED Published: 2020-05-22T20:48:09 Last Updated: 2024-08-04T12:18:17.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#csrf-on-password-reset
CVE ID: CVE-2020-13417 State: PUBLISHED Published: 2020-05-22T20:47:37 Last Updated: 2024-08-04T12:18:17.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-client-elevation-of-privilege - https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix/
CVE ID: CVE-2020-13418 State: PUBLISHED Published: 2021-04-06T20:10:27 Last Updated: 2024-08-04T12:18:17.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenIAM before 4.2.0.3 allows XSS in the Add New User feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13419 State: PUBLISHED Published: 2021-04-06T20:17:08 Last Updated: 2024-08-04T12:18:18.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13420 State: PUBLISHED Published: 2021-04-06T20:08:45 Last Updated: 2024-08-04T12:18:17.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md