Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-11043 State: PUBLISHED Published: 2020-05-29T00:00:00 Last Updated: 2024-08-04T11:21:14.637Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5mr4-28w3-rc84 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.
GHSA-5mr4-28w3-rc84 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11044 State: PUBLISHED Published: 2020-05-07T00:00:00 Last Updated: 2024-08-04T11:21:14.476Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-415 Description: In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqh-p732-6x2w - https://github.com/FreeRDP/FreeRDP/issues/6013 - https://github.com/FreeRDP/FreeRDP/commit/6
ories/GHSA-cgqh-p732-6x2w - https://github.com/FreeRDP/FreeRDP/issues/6013 - https://github.com/FreeRDP/FreeRDP/commit/67c2aa52b2ae0341d469071d1bc8aab91f8d2ed8 - https://usn.ubuntu.com/4379-1/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11045 State: PUBLISHED Published: 2020-05-07T00:00:00 Last Updated: 2024-08-04T11:21:14.543Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3x39-248q-f4q6 - https://github.com/FreeRDP/FreeRDP/issues/6005 - https://github.com/FreeRDP/FreeRDP/commit/f8890a645c221823ac
48q-f4q6 - https://github.com/FreeRDP/FreeRDP/issues/6005 - https://github.com/FreeRDP/FreeRDP/commit/f8890a645c221823ac133dbf991f8a65ae50d637 - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11046 State: PUBLISHED Published: 2020-05-07T00:00:00 Last Updated: 2024-08-04T11:21:14.384Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-119 Description: In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hx48-wmmm-mr5q - https://github.com/FreeRDP/FreeRDP/issues/6006 - https://github.com/FreeRDP/FreeRDP/commit/ed53cd148f43cbab905eaa0f5308c2bf3c48cc37 - https://usn.ubuntu.c
/issues/6006 - https://github.com/FreeRDP/FreeRDP/commit/ed53cd148f43cbab905eaa0f5308c2bf3c48cc37 - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11047 State: PUBLISHED Published: 2020-05-07T00:00:00 Last Updated: 2024-08-04T11:21:14.613Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9fw6-m2q8-h5pw -
tes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9fw6-m2q8-h5pw - https://github.com/FreeRDP/FreeRDP/issues/6009 - https://github.com/FreeRDP/FreeRDP/commit/f5e73cc7c9cd973b516a618da877c87b80950b65 - https://usn.ubuntu.com/4379-1/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11048 State: PUBLISHED Published: 2020-05-07T00:00:00 Last Updated: 2024-08-04T11:21:14.514Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hv8w-f2hx-5gcv - https://github.com/FreeRDP/FreeRDP/issues/6007 - https://github.com/FreeRDP/FreeRDP/commit/9301bfe730c66180263248b74353daa99f5a969b - https
FreeRDP/FreeRDP/issues/6007 - https://github.com/FreeRDP/FreeRDP/commit/9301bfe730c66180263248b74353daa99f5a969b - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11049 State: PUBLISHED Published: 2020-05-07T00:00:00 Last Updated: 2024-08-04T11:21:14.582Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wwh7-r2r8-xjpr - https://github.com/FreeRDP/FreeRDP/issues/6008 - https://github.com/FreeRDP/FreeRDP/pull/6019 - https://github.com/FreeRDP/FreeRDP/commit/c
FreeRDP/FreeRDP/issues/6008 - https://github.com/FreeRDP/FreeRDP/pull/6019 - https://github.com/FreeRDP/FreeRDP/commit/c367f65d42e0d2e1ca248998175180aa9c2eacd0 - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11050 State: PUBLISHED Published: 2020-05-07T20:15:12 Last Updated: 2024-08-04T11:21:14.437Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TooTallNate Products: Java-WebSocket Problem Types: CWE-297 Description: In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339
CVE ID: CVE-2020-11051 State: PUBLISHED Published: 2020-05-05T20:45:12 Last Updated: 2024-08-04T11:21:14.495Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: Requarks Products: Wiki.js Problem Types: CWE-79 Description: In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security mod
view panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Requarks/wiki/security/advisories/GHSA-vj72-c9vq-qxrv - https://github.com/Requarks/wiki/commit/05e8a71ceff39167aee830ba8ad5eb0161f2911a
CVE ID: CVE-2020-11052 State: PUBLISHED Published: 2020-05-07T20:25:14 Last Updated: 2024-08-04T11:21:14.666Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Sorcery Products: Sorcery Problem Types: CWE-307 Description: In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account l
s not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x - https://github.com/Sorcery/sorcery/issues/231 - https://github.com/Sorcery/sorcery/pull/235 - https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7
CVE ID: CVE-2020-11053 State: PUBLISHED Published: 2020-05-07T20:30:13 Last Updated: 2024-08-04T11:21:14.610Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: OAuth2 Proxy Products: OAuth2 Proxy Problem Types: CWE-601 Description: In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. H
nd validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. However, by crafting a redirect URL with HTML encoded whitespace characters the validation could be bypassed and allow a redirect to any URL provided. This has been patched in 5.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg
CVE ID: CVE-2020-11054 State: PUBLISHED Published: 2020-05-07T20:35:29 Last Updated: 2024-08-04T11:21:14.636Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: qutebrowser Products: qutebrowser Problem Types: CWE-684 Description: In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this p
ayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j - htt
rogram Container: References: - https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv2f-898j - https://github.com/qutebrowser/qutebrowser/issues/5403 - https://github.com/qutebrowser/qutebrowser/commit/021ab572a319ca3db5907a33a59774f502b3b975 - https://github.com/qutebrowser/qutebrowser/commit/19f01bb42d02da539446a52a25bb0c1232b86327 - https://github.com/qutebrowser/qutebrowser/commit/1b7946ed14b386a24db050f2d6dba81ba6518755 - https://github.com/qutebrowser/qutebrowser/commit/2281a205c3e70ec20f35ec8fafecee0d5c4f3478 - https://github.com/qutebrowser/qutebrowser/commit/4020210b193f77cf1785b21717f6ef7c5de5f0f8 - https://github.com/qutebrowser/qutebrowser/commit/6821c236f9a
ebrowser/commit/4020210b193f77cf1785b21717f6ef7c5de5f0f8 - https://github.com/qutebrowser/qutebrowser/commit/6821c236f9ae23adf21d46ce0d56768ac8d0c467 - https://github.com/qutebrowser/qutebrowser/commit/9bd1cf585fccdfe8318fff7af793730e74a04db3 - https://github.com/qutebrowser/qutebrowser/commit/a45ca9c788f648d10cccce2af41405bf25ee2948 - https://github.com/qutebrowser/qutebrowser/commit/d28ed758d077a5bf19ddac4da468f7224114df23 - https://github.com/qutebrowser/qutebrowser/commit/f5d801251aa5436aff44660c87d7013e29ac5864 - https://bugs.kde.org/show_bug.cgi?id=420902 - https://tracker.die-offenbachs.homelinux.org/eric/issue328 - https://lists.fedoraproject.org/archives/list/package-announce%40list
acker.die-offenbachs.homelinux.org/eric/issue328 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YWJ5QNHXKTGG5NLV7EGEOKPBVZBA5GS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKAZOOTJ2MBHTYVYQQ52NL53F5CB2XAP/
CVE ID: CVE-2020-11055 State: PUBLISHED Published: 2020-05-07T20:40:14 Last Updated: 2024-08-04T11:21:14.640Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: BookStackApp Products: BookStack Problem Types: CWE-79 Description: In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios w
ability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BookStackApp/BookStack/security/advisories/GHSA-5vf7-q87h-pg6w - https://bookstackapp.com/blog/beta-release-v0-29-2/ - https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2 - http://jvn.jp/en/jp/JVN41035278/index.html
CVE ID: CVE-2020-11056 State: PUBLISHED Published: 2020-05-07T20:50:12 Last Updated: 2024-08-04T11:21:14.644Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: barrelstrength Products: Sprout Forms Problem Types: CWE-94 Description: In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/barrelstrength/craft-sprout-forms/security/advisories/GHSA-px8v-hxxx-2rgh - https://github.com/barrelstrength/craft-sprout-forms/bl
gth/craft-sprout-forms/security/advisories/GHSA-px8v-hxxx-2rgh - https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical
CVE ID: CVE-2020-11057 State: PUBLISHED Published: 2020-05-12T20:55:13 Last Updated: 2024-08-04T11:21:14.645Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: xwiki Products: XWiki Platform Problem Types: CWE-94 Description: In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40andrew.levkin/tews-4c47cfc011d1 - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmp6-jjg8-9424 - https://jira.xw
in/tews-4c47cfc011d1 - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmp6-jjg8-9424 - https://jira.xwiki.org/browse/XWIKI-16960
CVE ID: CVE-2020-11058 State: PUBLISHED Published: 2020-05-12T00:00:00 Last Updated: 2024-08-04T11:21:14.624Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-119 Description: In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wjg2-2f82-466g - https://github.com/FreeRDP/FreeRDP/iss
s: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wjg2-2f82-466g - https://github.com/FreeRDP/FreeRDP/issues/6011 - https://github.com/FreeRDP/FreeRDP/commit/3627aaf7d289315b614a584afb388f04abfb5bbf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
CVE ID: CVE-2020-11059 State: PUBLISHED Published: 2020-05-27T20:55:10 Last Updated: 2024-08-04T11:21:14.488Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: IPFS Products: AEgir Problem Types: CWE-200 Description: In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ipfs/aegir/security/advisories/GHSA-qfcv-5whw-7pcw
CVE ID: CVE-2020-11060 State: PUBLISHED Published: 2020-05-12T19:30:14 Last Updated: 2024-08-04T11:21:14.633Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: glpi-project Products: GLPI Problem Types: CWE-74 Description: In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6. Additional Analyst Notes: - CVE Program Container: Refe
the right to add WIFI networks. This is fixed in version 9.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f - https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c - http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html
CVE ID: CVE-2020-11061 State: PUBLISHED Published: 2020-07-10T19:25:13 Last Updated: 2024-08-04T11:21:14.507Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Bareos GmbH & Co. KG Products: Bareos Director Problem Types: CWE-122 Description: In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10. Additional Analyst Notes: - CVE Program Container: References: - https://github.co
versions 19.2.8, 18.2.9 and 17.2.10. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bareos/bareos/security/advisories/GHSA-mm45-cg35-54j4 - https://bugs.bareos.org/view.php?id=1210 - https://lists.debian.org/debian-lts-announce/2020/08/msg00051.html
CVE ID: CVE-2020-11062 State: PUBLISHED Published: 2020-05-12T19:25:12 Last Updated: 2024-08-04T11:21:14.505Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: GLPI Products: GLPI Problem Types: CWE-79 Description: In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h - https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf
CVE ID: CVE-2020-11063 State: PUBLISHED Published: 2020-05-13T22:15:12 Last Updated: 2024-12-03T19:08:03.534Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-204 Description: In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx - https://githu
Program Container: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx - https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574
CVE ID: CVE-2020-11064 State: PUBLISHED Published: 2020-05-13T22:50:11 Last Updated: 2024-08-04T11:21:14.609Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-79 Description: In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://g
ty. This has been fixed in 9.5.17 and 10.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-43gj-mj2w-wh46
CVE ID: CVE-2020-11065 State: PUBLISHED Published: 2020-05-13T23:05:13 Last Updated: 2024-08-04T11:21:14.504Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-79 Description: In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3
en fixed in 9.5.17 and 10.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4j77-gg36-9864