Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-29500 State: PUBLISHED Published: 2021-01-05T21:40:24.482354Z Last Updated: 2024-09-17T03:38:02.802Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerStore Problem Types: CWE-312 Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CVE Pro
als to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000180775
CVE ID: CVE-2020-29501 State: PUBLISHED Published: 2021-01-05T21:40:25.090386Z Last Updated: 2024-09-16T16:43:52.517Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerStore Problem Types: CWE-312 Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - C
edentials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000180775
CVE ID: CVE-2020-29502 State: PUBLISHED Published: 2021-01-05T21:40:25.741355Z Last Updated: 2024-09-17T00:42:14.381Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerStore Problem Types: CWE-312 Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CVE
entials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000180775
CVE ID: CVE-2020-29503 State: PUBLISHED Published: 2021-07-19T21:30:29.655977Z Last Updated: 2024-09-17T04:29:02.406Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerStore Problem Types: CWE-276 Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the information disclosure of certain system directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000180775
CVE ID: CVE-2020-29504 State: PUBLISHED Published: 2024-02-02T15:58:57.404Z Last Updated: 2024-08-04T16:55:10.319Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Dell Products: BSAFE Crypto-C Micro Edition, Dell BSAFE Micro Edition Suite Problem Types: CWE-295 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Required Cryptographic Step Vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-
://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities
CVE ID: CVE-2020-29505 State: PUBLISHED Published: 2022-07-11T19:25:17.304277Z Last Updated: 2024-09-16T22:09:51.306Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-331 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://ww
bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-29506 State: PUBLISHED Published: 2022-07-11T19:25:21.332861Z Last Updated: 2024-09-17T00:06:38.373Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-385 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities
20-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-29507 State: PUBLISHED Published: 2022-07-11T19:25:26.309406Z Last Updated: 2024-09-16T20:22:19.654Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-20 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input Validation Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https
dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-29508 State: PUBLISHED Published: 2022-07-11T19:25:32.041607Z Last Updated: 2024-09-16T16:13:48.635Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: Dell BSAFE Micro Edition Suite Problem Types: CWE-331 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https:/
ll-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-29509 State: PUBLISHED Published: 2020-12-14T20:02:02.448358Z Last Updated: 2024-09-17T03:43:39.703Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Golang Products: Go Problem Types: CWE-115 Description: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories
tes: - CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md - https://security.netapp.com/advisory/ntap-20210129-0006/
CVE ID: CVE-2020-29510 State: PUBLISHED Published: 2020-12-14T19:57:44.107145Z Last Updated: 2024-09-16T16:48:42.611Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Golang Products: Go Problem Types: CWE-115 Description: The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstab
CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md - https://security.netapp.com/advisory/ntap-20210129-0006/
CVE ID: CVE-2020-29511 State: PUBLISHED Published: 2020-12-14T19:59:50.700201Z Last Updated: 2024-09-17T04:09:22.123Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Golang Products: Go Problem Types: CWE-115 Description: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/u
s: - CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md - https://security.netapp.com/advisory/ntap-20210129-0006/
CVE ID: CVE-2020-29529 State: PUBLISHED Published: 2020-12-03T19:04:50 Last Updated: 2024-08-04T16:55:10.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/go-slug/releases/tag/v0.5.0 - https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0 - https://github.com/hashicorp/go-slug/pull/12 - https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
CVE ID: CVE-2020-29534 State: PUBLISHED Published: 2020-12-03T20:00:48 Last Updated: 2024-08-04T16:55:10.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=2089 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0f2122045b946241a9e549c2a76cea54fa58a7ff - https://cdn.kernel.org/pub/linux/kernel/v5
/git/torvalds/linux.git/commit/?id=0f2122045b946241a9e549c2a76cea54fa58a7ff - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.3
CVE ID: CVE-2020-29535 State: PUBLISHED Published: 2021-01-29T06:32:39 Last Updated: 2024-08-04T16:55:10.305Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program
ts executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.rsa.com/en-us/company/vulnerability-response-policy - https://community.rsa.com/docs/DOC-115223
CVE ID: CVE-2020-29536 State: PUBLISHED Published: 2021-01-29T06:34:47 Last Updated: 2024-08-04T16:55:10.536Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain sensitive information to use it in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.rsa.com/en-us/company/vulnerability-response-policy - https://community.rsa.com/docs/DOC-115223
CVE ID: CVE-2020-29537 State: PUBLISHED Published: 2021-01-29T06:33:40 Last Updated: 2024-08-04T16:55:10.559Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred. Additional Analyst Notes: - CVE Program Container: References: - https://www.rsa.com/en-us/com
izing an attack occurred. Additional Analyst Notes: - CVE Program Container: References: - https://www.rsa.com/en-us/company/vulnerability-response-policy - https://community.rsa.com/docs/DOC-115223
CVE ID: CVE-2020-29538 State: PUBLISHED Published: 2021-01-29T06:35:55 Last Updated: 2024-08-04T16:55:10.931Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated malicious administrative user can potentially exploit this vulnerability to gather information about the system, and may use this information in subsequent attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.rsa.com/en-us/company/vulnerability-response-policy - https://community.rsa.com/docs/DOC-115223
CVE ID: CVE-2020-29539 State: PUBLISHED Published: 2020-12-08T12:52:38 Last Updated: 2024-08-04T16:55:10.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7.0 allows a threat actor to have a remote authenticated user run JavaScript from a malicious site. Additional Analyst Notes: - CVE Program Container: References: - https://www.systransoft.com/translation-products/systran-pure-neural-server/ - https://grave-rose.medium.com/two-systran-vulnerabilities-and-their-exploits-8bc83ba29e14
CVE ID: CVE-2020-29540 State: PUBLISHED Published: 2020-12-08T12:51:26 Last Updated: 2024-08-04T16:55:10.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Server as a Denial-of-Service proxy by sending a large amount of translation requests to a destination host on any given TCP port regardless of whether a web service is running on the destination port. Additional Analyst Notes: - CVE Program Container: References: - https://www.systransoft.com/translation-products/systran-pure-neural-server/ - https://grave-rose.medium.com/two-systran-vulnera
www.systransoft.com/translation-products/systran-pure-neural-server/ - https://grave-rose.medium.com/two-systran-vulnerabilities-and-their-exploits-8bc83ba29e14
CVE ID: CVE-2020-29547 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:52:53.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user session. This can lead to credential disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://uncensored.citadel.org/msg/4576039 - http://uncensored.citadel.org/dotgoto?room=Citadel%20Security
CVE ID: CVE-2020-29548 State: PUBLISHED Published: 2021-08-17T17:16:05 Last Updated: 2024-08-04T16:55:10.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session. Additional Analyst Notes: - CVE Program Container: References: - https://www.smartertools.com/smartermail/release-notes/current - https://nostarttls.secvuln.info/
CVE ID: CVE-2020-29550 State: PUBLISHED Published: 2020-12-23T15:06:55 Last Updated: 2024-08-04T16:55:10.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimpor
data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5. Additional Analyst Notes: - CVE Program Container: References: - https://urve.co.uk/system-rezerwacji-sal - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-042.txt - http://seclists.org/fulldisclosure/2020/Dec/49 - http://packetstormsecurity.com/files/160726/URVE-Software-Build-24.03.2020-Information-Disclosure.html
CVE ID: CVE-2020-29551 State: PUBLISHED Published: 2020-12-23T15:40:29 Last Updated: 2024-08-04T16:55:10.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: _internal/pc/abort.php, _internal/pc/restart.php, _internal/pc/vpro.php, _internal/pc/wake.php, _internal/error_u201409.txt, _internal/runcmd.php, _internal/getConfiguration.php, ews/autoload.php, ews/del.php, ews/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, krea
/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, kreator.html5/test.php, and addedlogs.txt. Additional Analyst Notes: - CVE Program Container: References: - https://urve.co.uk/system-rezerwacji-sal - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-041.txt - http://seclists.org/fulldisclosure/2020/Dec/48 - http://packetstormsecurity.com/files/160725/URVE-Software-Build-24.03.2020-Missing-Authorization.html
CVE ID: CVE-2020-29552 State: PUBLISHED Published: 2020-12-23T15:12:03 Last Updated: 2024-08-04T16:55:10.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root. Additional Analyst Notes: - CVE Program Container: References: - https://urve.co.uk/system-rezerwacji-sal - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-040.txt - http://seclists.org/fulldisclosure/2020/Dec/47 - http://packetstormsecurity.com/files/1
n/Advisories/SYSS-2020-040.txt - http://seclists.org/fulldisclosure/2020/Dec/47 - http://packetstormsecurity.com/files/160722/URVE-Software-Build-24.03.2020-Authentication-Bypass-Remote-Code-Execution.html
CVE ID: CVE-2020-29553 State: PUBLISHED Published: 2021-03-15T18:20:50 Last Updated: 2024-08-04T16:55:10.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
CVE ID: CVE-2020-29555 State: PUBLISHED Published: 2021-03-15T18:00:01 Last Updated: 2024-08-04T16:55:10.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.) Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
CVE ID: CVE-2020-29556 State: PUBLISHED Published: 2021-03-15T17:58:17 Last Updated: 2024-08-04T16:55:10.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.) Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
CVE ID: CVE-2020-29557 State: PUBLISHED Published: 2021-01-29T19:32:51.000Z Last Updated: 2025-10-21T23:35:29.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.ru/ru/download2/5/19/2354/441/ - https://shaqed.github.io/dlink/
CVE ID: CVE-2020-29561 State: PUBLISHED Published: 2020-12-04T05:49:16 Last Updated: 2024-08-04T16:55:10.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SonicBOOM riscv-boom 3.0.0. For LR, it does not avoid acquiring a reservation in the case where a load translates successfully but still generates an exception. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/riscv-boom/riscv-boom/issues/504#issuecomment-736196635