Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28138 State: PUBLISHED Published: 2020-11-17T18:56:20 Last Updated: 2024-08-04T16:33:57.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14185/online-clothing-store.html - https://www.exploit-db.com/exploits/48429
CVE ID: CVE-2020-28139 State: PUBLISHED Published: 2020-11-17T18:58:49 Last Updated: 2024-08-04T16:33:57.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14185/online-clothing-store.html - https://www.exploit-db.com/exploits/48426
CVE ID: CVE-2020-28140 State: PUBLISHED Published: 2020-11-17T19:00:25 Last Updated: 2024-08-04T16:33:57.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14185/online-clothing-store.html - https://www.exploit-db.com/exploits/48438
CVE ID: CVE-2020-28141 State: PUBLISHED Published: 2021-04-19T15:45:16 Last Updated: 2024-08-04T16:33:57.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48897
CVE ID: CVE-2020-28144 State: PUBLISHED Published: 2021-02-03T12:48:41 Last Updated: 2024-08-04T16:33:57.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/support/support/security-advisory/edr-g903-g902-810-secure-router-vulnerability
CVE ID: CVE-2020-28145 State: PUBLISHED Published: 2021-10-12T10:21:39 Last Updated: 2024-08-04T16:33:57.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/191 - https://www.cnvd.org.cn/flaw/show/2394661
CVE ID: CVE-2020-28146 State: PUBLISHED Published: 2021-08-18T16:41:40 Last Updated: 2024-08-04T16:33:57.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48530 - https://github.com/eyoucms/eyoucms/issues/12 - https://www.eyoucms.com/ask/list_1_0/4511.html
CVE ID: CVE-2020-28149 State: PUBLISHED Published: 2021-03-15T17:32:41 Last Updated: 2024-08-04T16:33:57.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: CSRF Token. The attack vector is: CSRF token injection to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://c41nc.co.uk/cve-2020-28149/
CVE ID: CVE-2020-28150 State: PUBLISHED Published: 2021-03-09T17:53:30 Last Updated: 2024-08-04T16:33:57.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect. Additional Analyst Notes: - CVE Program Container: References: - https://c41nc.co.uk/?page_id=85
CVE ID: CVE-2020-28163 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:20:12.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/davea42/libdwarf-code/commit/faf99408e3f9f706fc3809dd400e831f989778d3 - https://www.prevanders.net/dwarfbug.html#DW202010-003 - http://web.archive.org/web/20190601140703/https://sourceforge.net/projects/libdwarf/ - https://bugzilla.redhat.com/s
3 - http://web.archive.org/web/20190601140703/https://sourceforge.net/projects/libdwarf/ - https://bugzilla.redhat.com/show_bug.cgi?id=2026000
CVE ID: CVE-2020-28165 State: PUBLISHED Published: 2021-08-12T11:01:33 Last Updated: 2024-08-04T16:33:57.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function. Additional Analyst Notes: - CVE Program Container: References: - https://www.zentao.net/dynamic/zentaopms12.4.2-80263.html
CVE ID: CVE-2020-28168 State: PUBLISHED Published: 2020-11-06T19:22:38 Last Updated: 2024-08-04T16:33:57.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axios/axios/issues/3369 - https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9
3b35d1f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rdfd2901b8b697a3f6e2c9c6ecc688fd90d7f881937affb5144d61d6e%40%3Ccommits.druid.apache.org%3E - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
CVE ID: CVE-2020-28169 State: PUBLISHED Published: 2020-12-24T14:36:09 Last Updated: 2024-08-04T16:33:57.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://docs.fluentd.org/installation/install-by-msi - https://td-agent-package-browser.herokuapp.com/4/windows - https://www.fluentd.org/ - https://github.com/kenhys/td-agent-builder/commit/eec6e2dedf12f2e0c01c2bbe7b8c15b639b3b938 - https://github.com/fluent/f
https://github.com/kenhys/td-agent-builder/commit/eec6e2dedf12f2e0c01c2bbe7b8c15b639b3b938 - https://github.com/fluent/fluentd/issues/3201 - https://github.com/fluent-plugins-nursery/td-agent-builder/pull/247/commits/6f9cb6393392d62caa99907c0ebbcbab6b94a3f1 - http://packetstormsecurity.com/files/160791/Fluentd-TD-agent-4.0.1-Insecure-Folder-Permission.html - https://www.debian.org/security/2021/dsa-4949
CVE ID: CVE-2020-28172 State: PUBLISHED Published: 2021-03-31T12:13:34 Last Updated: 2024-08-04T16:33:57.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in college_website/admin/ajax.php?action=login, thus gaining access to the website administrative panel. Additional Analyst Notes: - CVE Program Container: References: - https://dl.packetstormsecurity.net/2010-exploits/simplecollegewebsite10-sqlexec.txt - https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html - https://www.sourcecodester.
w.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html - https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip - https://github.com/yunaranyancat/poc-dump/blob/main/simplecollegewebsite/sqli_rce.py
CVE ID: CVE-2020-28173 State: PUBLISHED Published: 2021-03-31T12:13:41 Last Updated: 2024-08-04T16:33:57.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/. Additional Analyst Notes: - CVE Program Container: References: - https://dl.packetstormsecurity.net/2010-exploits/simplecollegewebsite10-sqlexec.txt - https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html - https://www.sourcecodester.com/site
codester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html - https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip - https://github.com/yunaranyancat/poc-dump/blob/main/simplecollegewebsite/sqli_rce.py
CVE ID: CVE-2020-28175 State: PUBLISHED Published: 2020-12-03T17:54:15 Last Updated: 2024-08-04T16:33:57.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. Attackers can use constructed programs to increase user privileges Additional Analyst Notes: - CVE Program Container: References: - http://www.almico.com/speedfan.php - https://github.com/y5s5k5/exp/blob/main/exp - https://github.com/y5s5k5/CVE-2020-28175
CVE ID: CVE-2020-28183 State: PUBLISHED Published: 2020-11-17T22:05:04 Last Updated: 2024-08-04T16:33:57.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sartlabs/0days/tree/main/WBS - https://www.exploit-db.com/exploits/49032 - https://research-labs.net/search/exploits/water-billing-system-10-username-and-password-parameters-sql-injection
CVE ID: CVE-2020-28184 State: PUBLISHED Published: 2020-12-24T14:28:16 Last Updated: 2024-08-04T16:33:57.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.terra-master.com/ - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
CVE ID: CVE-2020-28185 State: PUBLISHED Published: 2020-12-24T14:26:55 Last Updated: 2024-08-04T16:33:57.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.terra-master.com/ - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
CVE ID: CVE-2020-28186 State: PUBLISHED Published: 2020-12-24T14:30:11 Last Updated: 2024-08-04T16:33:57.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.terra-master.com/ - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
CVE ID: CVE-2020-28187 State: PUBLISHED Published: 2020-12-24T14:31:58 Last Updated: 2024-08-04T16:33:58.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to /include/core/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.terra-master.com/ - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
CVE ID: CVE-2020-28188 State: PUBLISHED Published: 2020-12-24T00:00:00 Last Updated: 2024-08-04T16:33:58.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.terra-master.com/ - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ - http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote
ewest-vulnerabilities-for-creating-a-botnet/ - http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html
CVE ID: CVE-2020-28189 State: REJECTED Published: 2020-12-24T14:41:27 Last Updated: 2020-12-24T14:41:27 Description: No description available.
CVE ID: CVE-2020-28190 State: PUBLISHED Published: 2020-12-24T14:34:32 Last Updated: 2024-08-04T16:33:57.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates. Additional Analyst Notes: - CVE Program Container: References: - https://www.terra-master.com/ - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
CVE ID: CVE-2020-28191 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:55:59.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: The console in Togglz before 2.9.4 allows CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/advisories/GHSA-697v-pxg3-j262 - https://github.com/togglz/togglz/pull/495 - https://github.com/togglz/togglz/commit/ed66e3f584de954297ebaf98ea4a235286784707
CVE ID: CVE-2020-28194 State: PUBLISHED Published: 2021-02-01T13:13:47 Last Updated: 2024-08-04T16:33:58.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr - https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69
CVE ID: CVE-2020-28196 State: PUBLISHED Published: 2020-11-06T07:07:38 Last Updated: 2024-08-04T16:33:58.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/ - https://lists.fedoraproject.org/a
package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/ - https://security.gentoo.org/glsa/202011-17 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/ - https://www.debian.org/security/2020/dsa-4795 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210513-0002/ - https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd - https://security.netapp.com/advisory/ntap-20201202-0001/ -
/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd - https://security.netapp.com/advisory/ntap-20201202-0001/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-28198 State: PUBLISHED Published: 2021-05-06T19:25:28 Last Updated: 2024-08-04T16:33:57.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to an exploitable stack buffer overflow. Note: the vulnerability can be exploited when it is used in "interactive" mode while, cause of a max number characters limitation, it cannot be exploited in batch or command line usage (e.g. dsmadmc.exe -id=username -password=pwd). NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: -
TE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/VoidSec/Exploit-Development/blob/master/windows/x86/local/IBM_ITSM_Administrator_Client_v.5.2.0.1/IBM_TSM_v.5.2.0.1_exploit.py - https://voidsec.com/tivoli-madness/#IBM_Tivoli_Storage_Manager
CVE ID: CVE-2020-28199 State: PUBLISHED Published: 2021-02-26T14:56:33 Last Updated: 2024-08-04T16:33:58.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor. Additional Analyst Notes: - CVE Program Container: References: - https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-amazon-secret-key-offentlich-einsehbar-cve-2020-28199 - https://aramido.de/media/aramido-2020-006-disclosure-amazon-secret-access-key.md
CVE ID: CVE-2020-28200 State: PUBLISHED Published: 2021-06-28T12:08:46 Last Updated: 2024-08-04T16:33:58.153Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - https://www.openwall.com/lists/oss-security/2021/06/28/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
CVE ID: CVE-2020-28203 State: PUBLISHED Published: 2020-12-15T12:53:05 Last Updated: 2024-08-04T16:33:58.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier. There is a null pointer access/dereference while opening a crafted PDF file, leading the application to crash (denial of service). Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-28206 State: PUBLISHED Published: 2020-12-02T18:34:06 Last Updated: 2024-08-04T16:33:58.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows brute-force attacks on the passwords of users not in the administrator group. Additional Analyst Notes: - CVE Program Container: References: - https://justrealstag.medium.com/user-enumeration-improper-restriction-of-excessive-authenti
ram Container: References: - https://justrealstag.medium.com/user-enumeration-improper-restriction-of-excessive-authentication-attempts-in-bitrix-98933a97e0e6
CVE ID: CVE-2020-28208 State: PUBLISHED Published: 2021-01-08T17:26:39 Last Updated: 2024-08-04T16:33:58.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://trovent.io/security-advisory-2010-01 - http://www.openwall.com/lists/oss-security/2021/01/07/1 - http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.html - http://www.openwall.com/lists/oss-security/2021/01/08/1 - https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt - http://seclists.org
ecurity/2021/01/08/1 - https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt - http://seclists.org/fulldisclosure/2021/Jan/32 - http://www.openwall.com/lists/oss-security/2021/01/13/1 - http://seclists.org/fulldisclosure/2021/Jan/43
CVE ID: CVE-2020-28209 State: PUBLISHED Published: 2020-11-19T21:15:07 Last Updated: 2024-08-04T16:33:58.340Z Vendors: n/a Products: EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 Problem Types: CWE-428 Description: A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterpris
ent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/