Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-6814 State: PUBLISHED Published: 2020-03-25T21:11:21 Last Updated: 2024-08-04T09:11:05.046Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Memory safety bugs fixed in Thunderbird 68.6 Description: Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisorie
ESR < 68.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-08/ - https://www.mozilla.org/security/advisories/mfsa2020-10/ - https://www.mozilla.org/security/advisories/mfsa2020-09/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1592078%2C1604847%2C1608256%2C1612636%2C1614339 - https://usn.ubuntu.com/4328-1/ - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2020-6815 State: PUBLISHED Published: 2020-03-25T21:10:58 Last Updated: 2024-08-04T09:11:05.122Z Vendors: Mozilla Products: Firefox Problem Types: Memory and script safety bugs fixed in Firefox 74 Description: Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 74. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-08/ - https://bugzilla.mozilla.org/buglist.cgi
ainer: References: - https://www.mozilla.org/security/advisories/mfsa2020-08/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1181957%2C1557732%2C1557739%2C1611457%2C1612431
CVE ID: CVE-2020-6816 State: PUBLISHED Published: 2020-03-24T21:15:40 Last Updated: 2024-08-04T09:11:05.111Z Vendors: n/a Products: Mozilla Bleach Problem Types: mutation XSS Description: In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 - https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/ - http
oraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/ - https://advisory.checkmarx.net/advisory/CX-2020-4277
CVE ID: CVE-2020-6817 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T15:21:23.888Z Vendors: Mozilla Products: Mozilla Bleach Problem Types: regular expression denial-of-service (ReDoS) in BleachSanitizerFilter.sanitize_css gauntlet regular expression Description: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mozilla/bleach/security/a
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm - https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
CVE ID: CVE-2020-6819 State: PUBLISHED Published: 2020-04-24T15:56:56.000Z Last Updated: 2025-10-21T23:35:45.566Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Use-after-free while running the nsDocShell destructor Description: Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://www.mozilla.org/s
ISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://www.mozilla.org/security/advisories/mfsa2020-11/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1620818 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2020-6820 State: PUBLISHED Published: 2020-04-24T15:56:04.000Z Last Updated: 2025-10-21T23:35:45.737Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Use-after-free when handling a ReadableStream Description: Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://www.mozilla.org/security/advisorie
ent: References: - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://www.mozilla.org/security/advisories/mfsa2020-11/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1626728 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2020-6821 State: PUBLISHED Published: 2020-04-24T15:55:25 Last Updated: 2024-08-04T09:11:05.018Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Uninitialized memory could be read when using the WebGL copyTexSubImage method Description: When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - h
rbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/ - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1625404 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2020-6822 State: PUBLISHED Published: 2020-04-24T15:54:39 Last Updated: 2024-08-04T09:11:05.085Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Out of bounds write in GMPDecodeData when processing large images Description: On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/
ditional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/ - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1544181 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2020-6823 State: PUBLISHED Published: 2020-04-24T15:53:30 Last Updated: 2024-08-04T09:11:05.127Z Vendors: Mozilla Products: Firefox Problem Types: Malicious Extension could obtain auth codes from OAuth login flows Description: A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1614919
CVE ID: CVE-2020-6824 State: PUBLISHED Published: 2020-04-24T15:52:47 Last Updated: 2024-08-04T09:11:05.150Z Vendors: Mozilla Products: Firefox Problem Types: Generated passwords may be identical on the same site between separate private browsing sessions Description: Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This vulnerability affects Firefox < 75. Additional Analyst Notes: - CVE Progra
been identical, rather than independent. This vulnerability affects Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1621853
CVE ID: CVE-2020-6825 State: PUBLISHED Published: 2020-04-24T15:50:53 Last Updated: 2024-08-04T09:11:05.021Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 Description: Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Additional Analyst Notes: - CVE Program Container:
affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/ - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://www.mozilla.org/security/advisories/mfsa2020-14/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1572541%2C1620193%2C1620203 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2020-6826 State: PUBLISHED Published: 2020-04-24T15:51:43 Last Updated: 2024-08-04T09:11:05.117Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 75 Description: Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 75. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=161
rences: - https://www.mozilla.org/security/advisories/mfsa2020-12/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1613009%2C1613195%2C1616734%2C1617488%2C1619229%2C1620719%2C1624897
CVE ID: CVE-2020-6827 State: PUBLISHED Published: 2020-04-24T15:49:40 Last Updated: 2024-08-04T09:11:05.149Z Vendors: Mozilla Products: Firefox ESR Problem Types: Custom Tabs in Firefox for Android could have the URI spoofed Description: When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. <br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/ - https://bugzilla.mozilla.
VE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1622278
CVE ID: CVE-2020-6828 State: PUBLISHED Published: 2020-04-24T15:48:22 Last Updated: 2024-08-04T09:11:05.021Z Vendors: Mozilla Products: Firefox ESR Problem Types: Preference overwrite via crafted Intent from malicious Android application Description: A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference values. Control of arbitrary preferences can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution.<br> *Note: This
ces can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution.<br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1617928
CVE ID: CVE-2020-6829 State: PUBLISHED Published: 2020-10-28T00:00:00 Last Updated: 2024-08-04T09:11:05.159Z Vendors: Mozilla Products: Firefox, Firefox for Android Problem Types: P-384 and P-521 vulnerable to an electro-magnetic side channel attack on signature generation Description: When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Additional Analyst Notes: - CVE Program Container: Refer
ulnerability affects Firefox < 80 and Firefox for Android < 80. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-39/ - https://www.mozilla.org/security/advisories/mfsa2020-36/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1631583 - https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
CVE ID: CVE-2020-6830 State: PUBLISHED Published: 2020-05-26T17:06:52 Last Updated: 2024-08-04T09:11:05.047Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Native-to-JS bridging security token exploit Description: For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-15/ - https://bugzilla.mozilla.org/show_bug.cgi?i
er: References: - https://www.mozilla.org/security/advisories/mfsa2020-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1632387
CVE ID: CVE-2020-6831 State: PUBLISHED Published: 2020-05-26T17:05:57 Last Updated: 2024-08-04T09:11:05.112Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Buffer overflow in SCTP chunk input validation Description: A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-18/ - https://www.mozilla.org/security/advisories/mfsa2020-16/ - https://www.mozilla.org/se
security/advisories/mfsa2020-18/ - https://www.mozilla.org/security/advisories/mfsa2020-16/ - https://www.mozilla.org/security/advisories/mfsa2020-17/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 - https://usn.ubuntu.com/4373-1/ - https://security.gentoo.org/glsa/202005-03 - https://security.gentoo.org/glsa/202005-04 - https://www.debian.org/security/2020/dsa-4714 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00000.html - http://packetstormsecurity.com/files/158480/usrsctp-Stack-Buffer-Overflow.html
CVE ID: CVE-2020-6832 State: PUBLISHED Published: 2020-01-13T19:47:56 Last Updated: 2024-08-04T09:11:05.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/
CVE ID: CVE-2020-6833 State: PUBLISHED Published: 2020-02-05T16:23:11 Last Updated: 2024-08-04T09:11:05.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-6835 State: PUBLISHED Published: 2020-01-10T20:43:40 Last Updated: 2024-08-04T09:11:05.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking. Additional Analyst Notes: - CVE Program Container: References: - https://fossies.org/linux/bftpd/CHANGELOG - http://bftpd.sourceforge.net/news.html#302460
CVE ID: CVE-2020-6836 State: PUBLISHED Published: 2020-01-11T00:42:28 Last Updated: 2024-08-04T09:11:05.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/1439 - https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb
nces: - https://www.npmjs.com/advisories/1439 - https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e - https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser/
CVE ID: CVE-2020-6838 State: PUBLISHED Published: 2020-01-11T02:06:11 Last Updated: 2024-08-04T09:11:05.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/4926
CVE ID: CVE-2020-6839 State: PUBLISHED Published: 2020-01-11T02:05:59 Last Updated: 2024-08-04T09:11:05.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/4929
CVE ID: CVE-2020-6840 State: PUBLISHED Published: 2020-01-11T02:05:24 Last Updated: 2024-08-04T09:11:05.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/4927
CVE ID: CVE-2020-6841 State: PUBLISHED Published: 2020-02-21T15:35:04 Last Updated: 2024-08-04T09:11:05.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10152 - https://gist.github.com/jezzaaa/38c752d0a129576b2cc523ce6325050f
CVE ID: CVE-2020-6842 State: PUBLISHED Published: 2020-02-21T15:55:49 Last Updated: 2024-08-04T09:11:05.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10152 - https://gist.github.com/jezzaaa/9d704400a7e23f988dfb4f73658678b8
CVE ID: CVE-2020-6843 State: PUBLISHED Published: 2020-01-23T13:34:01 Last Updated: 2024-08-04T09:11:05.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/vulnerability-lab/advisories/index.html - http://seclists.org/fulldisclosure/2020/Jan/32 - https://seclists.org/bugtraq/2020/Jan/34 - http://packetstormsecurity.com/files/156050/ZOHO-ManageEngine-ServiceDeskPlus-11.0-Build-11007-Cross-Site-Scripting.html - https://www.manageengine.com/products/service-desk/readme.h
ServiceDeskPlus-11.0-Build-11007-Cross-Site-Scripting.html - https://www.manageengine.com/products/service-desk/readme.html#11010%20-%20SD-83959
CVE ID: CVE-2020-6844 State: PUBLISHED Published: 2020-02-18T14:15:59 Last Updated: 2024-08-04T09:11:05.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php - https://www.exploit-db.com/exploits/47960
CVE ID: CVE-2020-6845 State: PUBLISHED Published: 2020-02-18T14:17:18 Last Updated: 2024-08-04T09:11:05.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php - https://www.exploit-db.com/exploits/47960
CVE ID: CVE-2020-6847 State: PUBLISHED Published: 2020-01-11T03:46:02 Last Updated: 2024-08-04T09:11:05.204Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Marshall-Hallenbeck/bf6a4a4f408bb7a5e0a47cb39dc1dbbe - https://github.com/3s3s/opentrade/blob/4f91391164219da30533453e1ff6800ef2ef3c6b/static_pages/js/index.js#L473 - https://github.com/3s3s/opentrade/pull/337
CVE ID: CVE-2020-6848 State: PUBLISHED Published: 2020-01-13T04:04:50 Last Updated: 2024-08-04T09:11:05.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/flir-brickstream-recuento-y-seguimiento.html