Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7911 State: PUBLISHED Published: 2020-01-30T17:14:58 Last Updated: 2024-08-04T09:48:23.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/
CVE ID: CVE-2020-7912 State: PUBLISHED Published: 2020-01-30T17:16:26 Last Updated: 2024-08-04T09:48:23.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/
CVE ID: CVE-2020-7913 State: PUBLISHED Published: 2020-01-30T17:17:39 Last Updated: 2024-08-04T09:48:23.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/
CVE ID: CVE-2020-7914 State: PUBLISHED Published: 2020-01-31T12:02:40 Last Updated: 2024-08-04T09:48:23.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/
CVE ID: CVE-2020-7915 State: PUBLISHED Published: 2020-01-22T22:19:45 Last Updated: 2024-08-04T09:48:23.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/eaton-authenticated-stored-cross-site.html
CVE ID: CVE-2020-7916 State: PUBLISHED Published: 2020-03-16T17:04:42 Last Updated: 2024-08-04T09:48:23.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/learnpress/#developers
CVE ID: CVE-2020-7918 State: PUBLISHED Published: 2020-03-27T13:43:49 Last Updated: 2024-08-04T09:48:23.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration. Additional Analyst Notes: - CVE Program Container: References: - https://www.totemo.com/en/solutions/email-encryption - https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.html
CVE ID: CVE-2020-7919 State: PUBLISHED Published: 2020-03-16T20:55:31 Last Updated: 2024-08-04T09:48:23.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC/ - https://groups.google.com/forum/#%21forum/golang-announce - https://www.debian.org/security/2021/dsa-4848 - https://www.ora
ps://groups.google.com/forum/#%21forum/golang-announce - https://www.debian.org/security/2021/dsa-4848 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA - https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470 - https://security.netapp.com/advisory/ntap-20200327-0001/
CVE ID: CVE-2020-7920 State: PUBLISHED Published: 2020-02-06T16:51:52 Last Updated: 2024-08-04T09:48:23.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.percona.com/doc/percona-monitoring-and-management/2.x/release-notes/2.2.1.html - https://jira.percona.com/browse/PMM-5233 - https://jira.percona.com/browse/PMM-5232 - https://www.percona.com/blog/2020/02/03/improvements-in-pmm-bug-fixes-in-percona-server-percona-backup-for-mongodb-alert-release-roundup-2-3-2020/
CVE ID: CVE-2020-7921 State: PUBLISHED Published: 2020-05-06T14:55:12 Last Updated: 2024-11-18T17:30:33.314Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-182 Description: Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and MongoDB Server v3.6 versions prior to 3.6.1
4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and MongoDB Server v3.6 versions prior to 3.6.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-45472
CVE ID: CVE-2020-7922 State: PUBLISHED Published: 2020-04-09T17:35:12.278509Z Last Updated: 2024-09-16T20:37:43.815Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: MongoDB Inc. Products: MongoDB Enterprise Kubernetes Operator Problem Types: CWE-295 Description: X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Ku
ertificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.2.5
CVE ID: CVE-2020-7923 State: PUBLISHED Published: 2020-08-21T14:25:12.201543Z Last Updated: 2024-09-17T02:27:47.252Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-755 Description: A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
B Server v4.0 versions prior to 4.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-47773
CVE ID: CVE-2020-7924 State: PUBLISHED Published: 2021-04-12T16:25:11.147020Z Last Updated: 2024-09-16T16:28:23.095Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: MongoDB Inc. Products: MongoDB Database Tools, Mongomirror Problem Types: CWE-295 Description: Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 10
versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/TOOLS-2587
CVE ID: CVE-2020-7925 State: PUBLISHED Published: 2020-11-23T14:50:12.258045Z Last Updated: 2024-09-17T00:20:32.900Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-475 Description: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-49142
CVE ID: CVE-2020-7926 State: PUBLISHED Published: 2020-11-23T15:05:15.299714Z Last Updated: 2024-09-16T20:36:34.645Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-755 Description: A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects MongoDB Server v4.4 versions prior to 4.4.1. Versions before 4.4 are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-50170
CVE ID: CVE-2020-7927 State: PUBLISHED Published: 2020-11-23T19:00:18.244403Z Last Updated: 2024-09-17T02:01:37.645Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc. Products: MongoDB Ops Manager Problem Types: CWE-648 Description: Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2. Additional Analyst Notes: - CVE Program Container: References
DB Ops Manager v4.4 versions prior to and including 4.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3
CVE ID: CVE-2020-7928 State: PUBLISHED Published: 2020-11-23T16:35:12.958268Z Last Updated: 2024-09-17T00:20:37.058Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-158 Description: A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongod
rver v3.6 versions prior to 3.6.20. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-49404
CVE ID: CVE-2020-7929 State: PUBLISHED Published: 2021-03-01T16:05:17.498045Z Last Updated: 2024-09-16T19:46:52.238Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-185 Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-51083
CVE ID: CVE-2020-7931 State: PUBLISHED Published: 2020-01-23T14:27:25 Last Updated: 2024-08-04T09:48:24.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md - https://www.jfrog.com/confluence/display/RTF
://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md - https://www.jfrog.com/confluence/display/RTF/Release+Notes
CVE ID: CVE-2020-7932 State: PUBLISHED Published: 2020-06-17T16:15:32 Last Updated: 2024-08-04T09:48:24.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed. Additional Analyst Notes: - CVE Program Container: References: - https://www.openmicroscopy.org/security/advisories/2019-SV4/
CVE ID: CVE-2020-7934 State: PUBLISHED Published: 2020-01-28T13:03:44 Last Updated: 2024-08-04T09:48:24.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1. Additional Analyst
d fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1. Additional Analyst Notes: - CVE Program Container: References: - https://semanticbits.com/liferay-portal-authenticated-xss-disclosure/ - https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934 - http://packetstormsecurity.com/files/160168/LifeRay-7.2.1-GA2-Cross-Site-Scripting.html
CVE ID: CVE-2020-7935 State: PUBLISHED Published: 2020-03-23T15:08:25 Last Updated: 2024-08-04T09:48:24.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a (or use an existing) directory that is externally accessible to store PHP files. The filename and the exact path is known by the attacker, so it is possible to execute PHP code in the context of the application. The vulnerability is exploitable only with Administrator access. Additional Analyst Notes: - CVE Program Container: References:
nerability is exploitable only with Administrator access. Additional Analyst Notes: - CVE Program Container: References: - https://k4m1ll0.com/cve-2020-7935.html
CVE ID: CVE-2020-7936 State: PUBLISHED Published: 2020-01-23T20:39:12 Last Updated: 2024-08-04T09:48:23.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places - https://plone.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - http://www.openwall.com/lists
.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - http://www.openwall.com/lists/oss-security/2020/01/24/1
CVE ID: CVE-2020-7937 State: PUBLISHED Published: 2020-01-23T20:38:51 Last Updated: 2024-08-04T09:48:23.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher - http://www.openwall.com/lists/oss-security/2020/01/24/1
CVE ID: CVE-2020-7938 State: PUBLISHED Published: 2020-01-23T20:38:42 Last Updated: 2024-08-04T09:48:24.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installed - http://www.openwall.com/lists/oss-security/2020/01/24/1
CVE ID: CVE-2020-7939 State: PUBLISHED Published: 2020-01-23T20:38:34 Last Updated: 2024-08-04T09:48:24.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects - http://www.openwall.com/lists/oss-security/2020/01/24/1
CVE ID: CVE-2020-7940 State: PUBLISHED Published: 2020-01-23T20:38:26 Last Updated: 2024-08-04T09:48:24.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked - http://www.openwall.com/lists/oss-security/2020/01/24/1
CVE ID: CVE-2020-7941 State: PUBLISHED Published: 2020-01-23T20:38:13 Last Updated: 2024-08-04T09:48:24.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20200121 - https://www.openwall.com/lists/oss-security/2020/01/22/1 - https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content - http://www.openwall.com/lists/oss-security/2020/01/24/1
CVE ID: CVE-2020-7942 State: PUBLISHED Published: 2020-02-19T20:52:03 Last Updated: 2024-08-04T09:48:24.553Z Vendors: Puppet Products: Puppet, Puppet Agent Problem Types: Arbitrary retrieval Description: Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 chan
gated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19 Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2020-7942
nt 5.5.19 Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2020-7942/
CVE ID: CVE-2020-7943 State: PUBLISHED Published: 2020-03-11T21:56:41 Last Updated: 2024-08-04T09:48:24.659Z Vendors: n/a Products: Puppet Enterprise 2018.1.x stream, Puppet Enterprise, Puppet Server, PuppetDB, Resolved in Puppet Enterprise, Puppet Server, PuppetDB Problem Types: CWE-276 Description: Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5
ell as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13 Additional Analyst Notes: - CVE Program Container:
pet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13 Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2020-7943/
CVE ID: CVE-2020-7944 State: PUBLISHED Published: 2020-03-26T14:16:44 Last Updated: 2024-08-04T09:48:24.523Z Vendors: n/a Products: Continuous Delivery for Puppet Enterprise (CD4PE) Problem Types: Insertion of Sensitive Information into Externally-Accessible File or Directory Description: In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2020-7944