Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-24550 State: PUBLISHED Published: 2021-03-31T21:32:40 Last Updated: 2024-08-04T15:12:08.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL. Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2020-24550-open-redirect-in-episerver-find/
CVE ID: CVE-2020-24551 State: PUBLISHED Published: 2020-10-14T12:45:16.360987Z Last Updated: 2024-09-16T23:55:31.451Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IProom Products: MMC+ Server Problem Types: CWE-601 Description: IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim's login credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4053-6e9a2-1.html
CVE ID: CVE-2020-24552 State: PUBLISHED Published: 2020-09-10T08:40:20.444489Z Last Updated: 2024-09-16T18:18:22.551Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Atop Technology Products: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901B, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5904D, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908A, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916, 3G/4G LTE Cellu
Industrial Gateway SE5908A, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916, 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916A Problem Types: CWE-78 Description: Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface allows attackers to inject specific code and execute system commands without privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3956-608f1-1.html
CVE ID: CVE-2020-24553 State: PUBLISHED Published: 2020-09-02T16:25:52 Last Updated: 2024-08-04T15:12:09.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Sep/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg000
g/opensuse-security-announce/2020-10/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs - http://seclists.org/fulldisclosure/2020/Sep/5 - http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html - https://security.netapp.com/advisory/ntap-20200924-0003/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.redteam-pentesting.de/advisories/rt-sa-2020-004
CVE ID: CVE-2020-24554 State: PUBLISHED Published: 2020-09-01T13:49:14 Last Updated: 2024-08-04T15:12:09.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784956
CVE ID: CVE-2020-24556 State: PUBLISHED Published: 2020-09-01T18:55:26 Last Updated: 2024-08-04T15:12:09.086Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security Problem Types: Privilege Escalation Description: A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to expl
xecution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000263632 - https://success.trendmicro.com/solution/000263633 - https://www.zerodayinitiative.com/advisories/ZDI-20-1093/ - https://success.trendmicro.com/solution/000267260
CVE ID: CVE-2020-24557 State: PUBLISHED Published: 2020-09-01T18:55:27.000Z Last Updated: 2025-10-21T23:35:37.172Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Improper Access Control Privilege Escalation Description: A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note t
in the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000263632 - https://www.zerodayinitiative.com/advisories/ZDI-20-1094/ - https://success.trendmicro.com/solution/000267260
CVE ID: CVE-2020-24558 State: PUBLISHED Published: 2020-09-01T18:55:27 Last Updated: 2024-08-04T15:19:07.400Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Improper Access Control Privilege Escalation Description: A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an attacker to manipulate it to cause an out-of-bounds read that crashes multiple processes in the product. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Con
privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000263632 - https://www.zerodayinitiative.com/advisories/ZDI-20-1095/ - https://success.trendmicro.com/solution/000267260
CVE ID: CVE-2020-24559 State: PUBLISHED Published: 2020-09-01T18:55:27 Last Updated: 2024-08-04T15:19:07.401Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Hard Link Privilege Escalation Description: A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain binary to load and run a script from a user-writable folder, which then would allow them to execute arbitrary code as root. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Add
first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000263632 - https://www.zerodayinitiative.com/advisories/ZDI-20-1096/ - https://success.trendmicro.com/solution/000267260
CVE ID: CVE-2020-24560 State: PUBLISHED Published: 2020-09-24T01:50:22 Last Updated: 2024-08-04T15:19:07.405Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Improper Certification Validation Description: An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-295: Improper server certificate verification in the communication with the update server. Additional Analyst Notes: - CVE Program Container: References: - https:/
on in the communication with the update server. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09890 - https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673 - https://jvn.jp/en/jp/JVN60093979/ - https://jvn.jp/jp/JVN60093979/
CVE ID: CVE-2020-24561 State: PUBLISHED Published: 2020-09-15T20:00:16 Last Updated: 2024-08-04T15:19:07.396Z Vendors: Trend Micro Products: Trend Micro ServerProtect for Linux Problem Types: Command Injection Description: A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attacker must first obtain admin/root privileges on the SPLX console to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000268419
CVE ID: CVE-2020-24562 State: PUBLISHED Published: 2020-09-28T23:30:41 Last Updated: 2024-08-04T15:19:07.370Z Vendors: Trend Micro Products: Trend Micro OfficeScan Problem Types: Hard Link Priv Escalation Description: A vulnerability in Trend Micro OfficeScan XG SP1 on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This CVE is similar, but not identical to CVE-2020-24556. Additional Analyst Notes: - CVE Program Container: References: - h
CVE is similar, but not identical to CVE-2020-24556. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000263633 - https://www.zerodayinitiative.com/advisories/ZDI-20-1226/
CVE ID: CVE-2020-24563 State: PUBLISHED Published: 2020-09-28T23:30:42 Last Updated: 2024-08-04T15:19:07.401Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Authentication Bypass Description: A vulnerability in Trend Micro Apex One may allow a local attacker to manipulate the process of the security agent unload option (if configured), which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zer
nalyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1218/
CVE ID: CVE-2020-24564 State: PUBLISHED Published: 2020-09-28T23:30:42 Last Updated: 2024-08-04T15:19:08.922Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Read Info Disclosure Description: An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24565 and CVE-2020-25770. Additional Ana
in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24565 and CVE-2020-25770. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1219/
CVE ID: CVE-2020-24565 State: PUBLISHED Published: 2020-09-28T23:30:42 Last Updated: 2024-08-04T15:19:07.757Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Read Info Disclosure Description: An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770. Additional Ana
in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1220/
CVE ID: CVE-2020-24566 State: PUBLISHED Published: 2020-09-09T15:31:25 Last Updated: 2024-08-04T15:19:07.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then (under certain circumstances) the account password is exposed in cleartext in the verbose task logs output. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/6563 - https://github.com/OctopusDeploy/Issues/issues/6564
CVE ID: CVE-2020-24567 State: PUBLISHED Published: 2020-08-21T02:26:29 Last Updated: 2024-08-04T15:19:07.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: this is only relevant if low-privileged users can write to the installation directory, which may be considered a site-specific configuration error Additional Analyst Notes: - CVE Program Container: References: - https://www.cymaera.com/articles/everything.html - https://www.voidtools.com/forum/viewtopic.php?p=32509#p32509
CVE ID: CVE-2020-24568 State: PUBLISHED Published: 2020-10-02T18:19:43 Last Updated: 2024-08-04T15:19:09.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/
CVE ID: CVE-2020-24569 State: PUBLISHED Published: 2020-09-29T19:39:40 Last Updated: 2024-08-04T15:19:08.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/
CVE ID: CVE-2020-24570 State: PUBLISHED Published: 2020-09-29T19:44:26 Last Updated: 2024-08-04T15:19:08.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module, allowing attackers to steal session information from logged-in users with a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/
CVE ID: CVE-2020-24571 State: PUBLISHED Published: 2020-08-21T03:05:08 Last Updated: 2024-08-04T15:19:07.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371
CVE ID: CVE-2020-24572 State: PUBLISHED Published: 2020-08-24T19:14:58 Last Updated: 2024-08-04T15:19:07.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/billz/raspap-webgui/releases - https://github.com/lb0x - https://github.com/billz/raspap-webgui/commit/dd5ab7bdc2
ub.com/billz/raspap-webgui/releases - https://github.com/lb0x - https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 - https://deadb0x.io/lunchb0x/cve-2020-24572/
CVE ID: CVE-2020-24573 State: PUBLISHED Published: 2020-11-12T17:38:47 Last Updated: 2024-08-04T15:19:08.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: BAB TECHNOLOGIE GmbH eibPort V3 prior to 3.8.3 devices allow denial of service (Uncontrolled Resource Consumption) via requests to the lighttpd component. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2020-24573/
CVE ID: CVE-2020-24574 State: PUBLISHED Published: 2020-08-21T03:41:50 Last Updated: 2024-08-04T15:19:09.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based "trusted client" protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://www.gog.com/galaxy - https://www.positronsecurity.com/blog/2020-08-13-gog-galaxy
rogram Container: References: - https://www.gog.com/galaxy - https://www.positronsecurity.com/blog/2020-08-13-gog-galaxy_client-local-privilege-escalation_deuce/ - https://github.com/jtesta/gog_galaxy_client_service_poc - https://github.com/jtesta/gog_galaxy_client_service_poc/issues/1#issuecomment-926932218
CVE ID: CVE-2020-24576 State: PUBLISHED Published: 2021-08-12T10:45:07 Last Updated: 2024-08-04T15:19:08.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://www.netskope.com - https://www.netskope.com/company/security-compliance-and-assurance/release-78-security-advisory-nskpsa2020-001
CVE ID: CVE-2020-24577 State: PUBLISHED Published: 2021-01-08T06:45:09 Last Updated: 2024-08-04T15:19:09.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-r
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241
CVE ID: CVE-2020-24578 State: PUBLISHED Published: 2020-12-22T18:04:24 Last Updated: 2024-08-04T15:19:09.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files (such as the password hash file). Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
CVE ID: CVE-2020-24579 State: PUBLISHED Published: 2020-12-22T18:04:52 Last Updated: 2024-08-04T15:19:07.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
CVE ID: CVE-2020-24580 State: PUBLISHED Published: 2020-12-22T18:04:56 Last Updated: 2024-08-04T15:19:08.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. Lack of authentication functionality allows an attacker to assign a static IP address that was once used by a valid user. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
CVE ID: CVE-2020-24581 State: PUBLISHED Published: 2020-12-22T18:05:02 Last Updated: 2024-08-04T15:19:07.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable via the web user interface) that lets an authenticated user execute Operating System commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
CVE ID: CVE-2020-24582 State: PUBLISHED Published: 2020-09-10T16:11:44 Last Updated: 2024-08-04T15:19:09.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2020/09/10/zulip-desktop-5-4-3-security-release/