Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25091 State: PUBLISHED Published: 2020-09-03T01:40:39 Last Updated: 2024-08-04T15:26:09.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/7c3c32d6526268b1c78d6d5741361e79292e9c22
CVE ID: CVE-2020-25092 State: PUBLISHED Published: 2020-09-03T01:40:32 Last Updated: 2024-08-04T15:26:09.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/7c3c32d6526268b1c78d6d5741361e79292e9c22
CVE ID: CVE-2020-25093 State: PUBLISHED Published: 2020-09-03T01:40:24 Last Updated: 2024-08-04T15:26:09.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/7c3c32d6526268b1c78d6d5741361e79292e9c22
CVE ID: CVE-2020-25094 State: PUBLISHED Published: 2020-12-17T02:04:12 Last Updated: 2024-08-04T15:26:09.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
CVE ID: CVE-2020-25095 State: PUBLISHED Published: 2020-12-17T02:04:03 Last Updated: 2024-08-04T15:26:09.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution. Additional Analyst No
ntext of the logged-in user. This can include WebSocket payloads that result in command execution. Additional Analyst Notes: - CVE Program Container: References: - https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
CVE ID: CVE-2020-25096 State: PUBLISHED Published: 2020-12-17T02:03:48 Last Updated: 2024-08-04T15:26:09.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application server, which will forward requests to any configured back-end server, regardless of whether the user's access rights should permit this. As a result, even the most low-privileged user can interact with any back-end component that
rights should permit this. As a result, even the most low-privileged user can interact with any back-end component that has a LogRhythm agent installed. Additional Analyst Notes: - CVE Program Container: References: - https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
CVE ID: CVE-2020-25097 State: PUBLISHED Published: 2021-03-19T04:08:54 Last Updated: 2024-08-04T15:26:09.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6 - http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch - http://www.squid-cache
ies/GHSA-jvf6-h9gj-pmj6 - http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch - http://www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patch - https://www.debian.org/security/2021/dsa-4873 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJMDRVV677AJL4BZAOLCT5LMFCGBZTC2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBXFWKIGXPERDVQXG556LLPUOCMQGERC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RYBDMJCPYGOSURWDR3WJTE474UFT77/ - https://security.gentoo.org/glsa/202105-14 - https://security.netapp.com/advisory/n
/O3RYBDMJCPYGOSURWDR3WJTE474UFT77/ - https://security.gentoo.org/glsa/202105-14 - https://security.netapp.com/advisory/ntap-20210727-0010/
CVE ID: CVE-2020-25102 State: PUBLISHED Published: 2020-09-03T16:35:21 Last Updated: 2024-08-04T15:26:09.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview) when an SVG document is provided in the Description parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nyeholt/silverstripe-advancedreports/releases - https://gist.git
CVE Program Container: References: - https://github.com/nyeholt/silverstripe-advancedreports/releases - https://gist.github.com/ahpaleus/c3bd2d41d306544ca3158569335d12f2
CVE ID: CVE-2020-25104 State: PUBLISHED Published: 2020-09-03T14:20:12 Last Updated: 2024-08-04T15:26:09.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension. Additional Analyst Notes: - CVE Program Container: References: - https://discussions.eramba.org/t/bug-security-vulnerabilities-not-serious/1650 - https://gitlab.com/gitlab-com/gl-security/disclosures/-/blob/master/005_eramba/eramba_persistent_xss.md
CVE ID: CVE-2020-25105 State: PUBLISHED Published: 2020-09-03T14:19:27 Last Updated: 2024-08-04T15:26:09.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities). Additional Analyst Notes: - CVE Program Container: References: - https://discussions.eramba.org/t/bug-security-vulnerabilities-not-serious/1650/2 - https://gitlab.com/gitlab-com/gl-security/disclosures/-/blob/master/005_eramba/eramba_weak_password_reset.md
CVE ID: CVE-2020-25106 State: PUBLISHED Published: 2020-12-22T17:54:55 Last Updated: 2024-08-04T15:26:09.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename. Additional Analyst Notes: - CVE Program Container: References: - https://www.supremocontrol.com/changelog/ - https://seclists.org/fulldisclosure/2020/Dec/42 - http://packetstormsecurity.com/files/160666/SUPREMO-4.1.3.2348-Privilege-Escalation.html
CVE ID: CVE-2020-25107 State: PUBLISHED Published: 2020-12-11T22:57:15 Last Updated: 2024-08-04T15:26:09.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. There is no check on whether a domain name has '\0' termination. This may lead to successful Denial-of-Service, and possibly Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-25108 State: PUBLISHED Published: 2020-12-11T22:58:01 Last Updated: 2024-08-04T15:26:09.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The DNS response data length is not checked (it can be set to an arbitrary value from a packet). This may lead to successful Denial-of-Service, and possibly Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-25109 State: PUBLISHED Published: 2020-12-11T22:58:53 Last Updated: 2024-08-04T15:26:09.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The number of DNS queries/responses (set in a DNS header) is not checked against the data present. This may lead to successful Denial-of-Service, and possibly Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-25110 State: PUBLISHED Published: 2020-12-11T22:59:38 Last Updated: 2024-08-04T15:26:09.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations. This may lead to successful Denial-of-Service, and possibly Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-25111 State: PUBLISHED Published: 2020-12-11T23:00:39 Last Updated: 2024-08-04T15:26:10.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-25112 State: PUBLISHED Published: 2020-12-11T23:01:24 Last Updated: 2024-08-04T15:26:09.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-25115 State: PUBLISHED Published: 2020-09-03T17:20:44 Last Updated: 2024-08-04T15:26:10.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25116 State: PUBLISHED Published: 2020-09-03T17:20:26 Last Updated: 2024-08-04T15:26:09.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25117 State: PUBLISHED Published: 2020-09-03T17:20:14 Last Updated: 2024-08-04T15:26:09.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25118 State: PUBLISHED Published: 2020-09-03T17:19:59 Last Updated: 2024-08-04T15:26:09.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25119 State: PUBLISHED Published: 2020-09-03T17:19:47 Last Updated: 2024-08-04T15:26:09.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25120 State: PUBLISHED Published: 2020-09-03T17:19:32 Last Updated: 2024-08-04T15:26:10.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25121 State: PUBLISHED Published: 2020-09-03T17:19:19 Last Updated: 2024-08-04T15:26:09.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25122 State: PUBLISHED Published: 2020-09-03T17:19:09 Last Updated: 2024-08-04T15:26:09.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25123 State: PUBLISHED Published: 2020-09-03T17:18:59 Last Updated: 2024-08-04T15:26:09.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25124 State: PUBLISHED Published: 2020-09-03T17:18:45 Last Updated: 2024-08-04T15:26:09.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI. Additional Analyst Notes: - CVE Program Container: References: - https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-multiple-persistent-cross.html
CVE ID: CVE-2020-25125 State: PUBLISHED Published: 2020-09-03T17:48:07 Last Updated: 2024-08-04T15:26:09.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 - https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc - https://lists.gnu
nsuse.org/show_bug.cgi?id=1176034 - https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc - https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html - https://dev.gnupg.org/T5050 - http://www.openwall.com/lists/oss-security/2020/09/03/4 - http://www.openwall.com/lists/oss-security/2020/09/03/5
CVE ID: CVE-2020-25130 State: PUBLISHED Published: 2020-09-25T13:45:20 Last Updated: 2024-08-04T15:26:09.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL Injection sanitization. Authenticated users are able to inject malicious SQL queries. This vulnerability leads to full database leak including ckeys that can be used in the authentication process without knowing the username and cleartext
database leak including ckeys that can be used in the authentication process without knowing the username and cleartext password. This can occur via the ajax/actions.php group_id field. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/243d1e7c07adc736bae8069fe831745c
CVE ID: CVE-2020-25131 State: PUBLISHED Published: 2020-09-25T13:56:00 Last Updated: 2024-08-04T15:26:09.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the role_name or role_descr parameter to the roles/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/9eab675bdafb7974d0114578f1ec1845
CVE ID: CVE-2020-25132 State: PUBLISHED Published: 2020-09-25T14:03:41 Last Updated: 2024-08-04T15:26:09.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability.
full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/e70bc0afe5853e283d3fd3511a1ce09d
CVE ID: CVE-2020-25133 State: PUBLISHED Published: 2020-09-25T14:13:31 Last Updated: 2024-08-04T15:26:09.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /ports/?format=../ URIs to pages/ports.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpop
pages/ports.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/e9796c9d83e820302ea2ffec5ff9b298
CVE ID: CVE-2020-25134 State: PUBLISHED Published: 2020-09-25T14:19:24 Last Updated: 2024-08-04T15:26:09.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /settings/?format=../ URIs to pages/settings.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mari
to pages/settings.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/a3d18fc3d7113cf9c004161ebd9420c9
CVE ID: CVE-2020-25135 State: PUBLISHED Published: 2020-09-25T14:22:03 Last Updated: 2024-08-04T15:26:10.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the graph_title parameter to the graphs/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/9eb94a617a7193c6d3b455f5348bcc1e
CVE ID: CVE-2020-25136 State: PUBLISHED Published: 2020-09-25T14:26:24 Last Updated: 2024-08-04T15:26:09.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=routing&proto=../ URIs to device/routing.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://
ting&proto=../ URIs to device/routing.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/5ae335a080ba40996d4020181759e02f
CVE ID: CVE-2020-25137 State: PUBLISHED Published: 2020-09-25T16:28:09 Last Updated: 2024-08-04T15:26:10.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the alert_name or alert_message parameter to the /alert_check URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/015b605a9bd31f43a8080a105c4312a8
CVE ID: CVE-2020-25138 State: PUBLISHED Published: 2020-09-25T16:30:05 Last Updated: 2024-08-04T15:26:10.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alert_check/action=delete_alert_checker/alert_test_id= because of pages/alert_check.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mariuszpoplawski/bfb6dea73586dbb668d280d412ecb6d8