Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8777 State: PUBLISHED Published: 2020-03-02T18:30:08 Last Updated: 2024-08-04T10:12:10.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/snippets/1937042 - https://issues.alfresco.com/jira/browse/ALF-22110 - http://packetstormsecurity.com/files/156599/Alfresco-5.2.4-Cross-Site-Scripting.html
CVE ID: CVE-2020-8778 State: PUBLISHED Published: 2020-03-02T18:30:13 Last Updated: 2024-08-04T10:12:10.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/snippets/1937042 - https://issues.alfresco.com/jira/browse/ALF-22110 - http://packetstormsecurity.com/files/156599/Alfresco-5.2.4-Cross-Site-Scripting.html
CVE ID: CVE-2020-8781 State: PUBLISHED Published: 2020-10-06T13:50:37 Last Updated: 2024-08-04T10:12:10.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-005/
CVE ID: CVE-2020-8782 State: PUBLISHED Published: 2020-10-06T13:54:53.534973Z Last Updated: 2024-09-16T21:58:13.333Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-005/
CVE ID: CVE-2020-8783 State: PUBLISHED Published: 2020-03-16T21:26:55 Last Updated: 2024-08-04T10:12:10.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11 - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE ID: CVE-2020-8784 State: PUBLISHED Published: 2020-03-16T21:35:31 Last Updated: 2024-08-04T10:12:10.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11 - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE ID: CVE-2020-8785 State: PUBLISHED Published: 2020-03-16T21:35:24 Last Updated: 2024-08-04T10:12:10.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11 - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE ID: CVE-2020-8786 State: PUBLISHED Published: 2020-03-16T21:35:16 Last Updated: 2024-08-04T10:12:10.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11 - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE ID: CVE-2020-8787 State: PUBLISHED Published: 2020-03-16T21:34:43 Last Updated: 2024-08-04T10:12:10.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11 - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE ID: CVE-2020-8788 State: PUBLISHED Published: 2020-02-07T13:07:53 Last Updated: 2024-08-04T10:12:10.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClearCanvas/ClearCanvas/issues/227
CVE ID: CVE-2020-8789 State: PUBLISHED Published: 2020-05-22T13:20:13 Last Updated: 2024-08-04T10:12:10.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/157787/Composr-CMS-10.0.30-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2020/May/39
CVE ID: CVE-2020-8790 State: PUBLISHED Published: 2020-05-04T13:18:57 Last Updated: 2024-08-04T10:12:10.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excessive authentication attempts, which could allow a remote attacker to discover user credentials and obtain access via a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fierceoj/ownklok
CVE ID: CVE-2020-8791 State: PUBLISHED Published: 2020-05-04T13:22:14 Last Updated: 2024-08-04T10:12:10.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and o
the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fierceoj/ownklok
CVE ID: CVE-2020-8792 State: PUBLISHED Published: 2020-05-04T13:34:52 Last Updated: 2024-08-04T10:12:10.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid barcode inputs can be easily guessed because barcode strings follow a predictable pattern. Correctly guessed valid barcode inputs entered through the app interface disclose arbitrary users' email addresses and lock names. Additiona
lid barcode inputs entered through the app interface disclose arbitrary users' email addresses and lock names. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fierceoj/ownklok
CVE ID: CVE-2020-8793 State: PUBLISHED Published: 2020-02-25T16:22:02 Last Updated: 2024-08-04T10:12:10.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.openbsd.org/security.html - http://www.openwall.com/lists/oss-security/2020/02/24/4 - http://seclists.org/fulldisclosure/2020/Feb/28 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/me
fulldisclosure/2020/Feb/28 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/ - https://usn.ubuntu.com/4294-1/
CVE ID: CVE-2020-8794 State: PUBLISHED Published: 2020-02-25T16:38:07 Last Updated: 2024-08-04T10:12:10.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling. Additional Analyst Notes: - CVE Program Container: References: - https://www.openbsd.org/security.html - https://www.openwall.com/lists/oss-security/2020/02/24/5 - http://www.openwall.com/lists/oss-security/2020/02/26/1 - h
- https://www.openwall.com/lists/oss-security/2020/02/24/5 - http://www.openwall.com/lists/oss-security/2020/02/26/1 - https://www.debian.org/security/2020/dsa-4634 - http://seclists.org/fulldisclosure/2020/Feb/32 - http://www.openwall.com/lists/oss-security/2020/03/01/1 - http://www.openwall.com/lists/oss-security/2020/03/01/2 - http://packetstormsecurity.com/files/156633/OpenSMTPD-Out-Of-Bounds-Read-Local-Privilege-Escalation.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/ - https://usn.ubuntu.com/4294-1/ - http://www.openwall.com/lists/oss-security/2021/05/04/7
CVE ID: CVE-2020-8795 State: PUBLISHED Published: 2020-02-17T14:48:10 Last Updated: 2024-08-04T10:12:10.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/
CVE ID: CVE-2020-8796 State: PUBLISHED Published: 2020-02-07T19:57:43 Last Updated: 2024-08-04T10:12:10.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. Additional Analyst Notes: - CVE Program Container: References: - https://cve.biscom.com/bis-sft-cv-0009/
CVE ID: CVE-2020-8797 State: PUBLISHED Published: 2020-04-23T18:01:22 Last Updated: 2024-08-04T10:12:10.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network. Additional Analyst Notes: - CVE Program Container: References: - https://cerne.xyz/bugs/CVE-2020-8797.html
CVE ID: CVE-2020-8798 State: PUBLISHED Published: 2020-04-23T18:03:37 Last Updated: 2024-08-04T10:12:10.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network. Additional Analyst Notes: - CVE Program Container: References: - https://cerne.xyz/bugs/CVE-2020-8798.html
CVE ID: CVE-2020-8799 State: PUBLISHED Published: 2020-05-05T15:03:18 Last Updated: 2024-08-04T10:12:10.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wti-like-post/#developers - https://wpvulndb.com/vulnerabilities/10210
CVE ID: CVE-2020-8800 State: PUBLISHED Published: 2020-02-13T15:11:09 Last Updated: 2024-08-04T10:12:10.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - https://seclists.org/fulldisclosure/2020/Feb/3 - http://packetstormsecurity.com/files/156321/SuiteCRM-7.11.11-Second-Order-PHP-Object-Injection.html
CVE ID: CVE-2020-8801 State: PUBLISHED Published: 2020-02-13T15:12:21 Last Updated: 2024-08-04T10:12:10.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.11.11 allows PHAR Deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - http://seclists.org/fulldisclosure/2020/Feb/4 - http://packetstormsecurity.com/files/156324/SuiteCRM-7.11.11-Phar-Deserialization.html
CVE ID: CVE-2020-8802 State: PUBLISHED Published: 2020-02-13T15:13:31 Last Updated: 2024-08-04T10:12:10.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - http://seclists.org/fulldisclosure/2020/Feb/5 - http://packetstormsecurity.com/files/156327/SuiteCRM-7.11.11-Bean-Manipulation.html
CVE ID: CVE-2020-8803 State: PUBLISHED Published: 2020-02-13T15:14:48 Last Updated: 2024-08-04T10:12:10.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - http://seclists.org/fulldisclosure/2020/Feb/6 - http://packetstormsecurity.com/files/156329/SuiteCRM-7.11.11-Broken-Access-Control-Local-File-Inclusion.html
CVE ID: CVE-2020-8804 State: PUBLISHED Published: 2020-02-13T15:15:56 Last Updated: 2024-08-04T10:12:10.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - http://seclists.org/fulldisclosure/2020/Feb/7 - http://packetstormsecurity.com/files/156331/SuiteCRM-7.11.10-SQL-Injection.html
CVE ID: CVE-2020-8806 State: PUBLISHED Published: 2021-02-05T09:08:28 Last Updated: 2024-08-04T10:12:10.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected because timestamp requirements on block headers were not properly enforced. Additional Analyst Notes: - CVE Program Container: References: - https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/
CVE ID: CVE-2020-8807 State: PUBLISHED Published: 2021-02-05T09:13:58 Last Updated: 2024-08-04T10:12:10.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel. Additional Analyst Notes: - CVE Program Container: References: - https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/
CVE ID: CVE-2020-8808 State: PUBLISHED Published: 2020-02-07T22:23:08 Last Updated: 2024-08-04T10:12:10.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary physical memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, via a function call such as MmMapIoSpace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-001.md - https://forum.corsair.com/v3/showthread.php?t=193831
CVE ID: CVE-2020-8809 State: PUBLISHED Published: 2020-02-25T18:57:18 Last Updated: 2024-08-04T10:12:10.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the ene
to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810. Additional Analyst Notes: - CVE Program Container: References: - https://seqred.pl/en/cve-gurux-gxdlms-director/ - https://github.com/seqred-s-a/gxdlmsdirector-cve
CVE ID: CVE-2020-8810 State: PUBLISHED Published: 2020-02-25T18:55:10 Last Updated: 2024-08-04T10:12:10.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed. Addit
GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed. Additional Analyst Notes: - CVE Program Container: References: - https://seqred.pl/en/cve-gurux-gxdlms-director/ - https://github.com/seqred-s-a/gxdlmsdirector-cve
CVE ID: CVE-2020-8811 State: PUBLISHED Published: 2020-02-07T22:59:42 Last Updated: 2024-08-04T10:12:10.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1131
CVE ID: CVE-2020-8812 State: PUBLISHED Published: 2020-02-07T22:59:35 Last Updated: 2024-08-04T10:12:10.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1132
CVE ID: CVE-2020-8813 State: PUBLISHED Published: 2020-02-22T00:00:00 Last Updated: 2024-08-04T10:12:10.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129 - https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view - https://github.com/Cacti/cacti/releases - https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ - https://github.c
cti/releases - https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ - https://github.com/Cacti/cacti/issues/3285 - http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html - http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html - http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACK
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html - http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html - https://security.gentoo.org/glsa/202004-16 - https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html
CVE ID: CVE-2020-8815 State: PUBLISHED Published: 2020-02-12T14:39:23 Last Updated: 2024-08-04T10:12:10.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach by sending a large volume of small packets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kolya5544/BearFTP - https://github.com/kolya5544/BearFTP/blob/f5a8047587c1a96456d4f291c12b038b9ab0d0c5/BearFTP/Program.cs#L503-L525 - https://github.com/kolya5544/BearFTP/commit/17a6ead72d4a25cbfcef5e27613aa0a5f88a4b26 - https://gith
ogram.cs#L503-L525 - https://github.com/kolya5544/BearFTP/commit/17a6ead72d4a25cbfcef5e27613aa0a5f88a4b26 - https://github.com/kolya5544/BearFTP/commit/66dc9d95e58bca133f265457d32007cdf38b66ad - https://github.com/kolya5544/BearFTP/releases/tag/0.4.0
CVE ID: CVE-2020-8816 State: PUBLISHED Published: 2020-05-29T18:57:14.000Z Last Updated: 2025-10-21T23:35:43.171Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pi-hole/AdminLTE/commits/master - http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html - https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/
MAC-OS-Command-Execution.html - https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/ - https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20 - https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3 - https://github.com/pi-hole/AdminLTE/pull/1165 - http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html
CVE ID: CVE-2020-8817 State: PUBLISHED Published: 2020-09-14T13:47:19 Last Updated: 2024-08-04T10:12:10.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata. Additional Analyst Notes: - CVE Program Container: References: - https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html - https://doc.dataiku.com/dss/latest/release_notes/6.0.htm