Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15817 State: PUBLISHED Published: 2020-08-08T20:05:37 Last Updated: 2024-08-04T13:30:22.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15818 State: PUBLISHED Published: 2020-08-08T20:03:57 Last Updated: 2024-08-04T13:30:22.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15819 State: PUBLISHED Published: 2020-08-08T20:07:14 Last Updated: 2024-08-04T13:30:22.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15820 State: PUBLISHED Published: 2020-08-08T20:08:41 Last Updated: 2024-08-04T13:30:22.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15821 State: PUBLISHED Published: 2020-08-08T20:15:24 Last Updated: 2024-08-04T13:30:22.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15822 State: PUBLISHED Published: 2020-10-19T18:45:49 Last Updated: 2024-08-04T13:30:21.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15823 State: PUBLISHED Published: 2020-08-08T20:17:00 Last Updated: 2024-08-04T13:30:21.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15824 State: PUBLISHED Published: 2020-08-08T20:21:43 Last Updated: 2024-08-04T13:30:21.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E - https://lists.apache.org/thread.html/ra12c3e23b021f259a
b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/12/06/1 - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/ - https://www.oracle.com/security-alerts/cpujan2022
g.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/ - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2020-15825 State: PUBLISHED Published: 2020-08-08T20:39:03 Last Updated: 2024-08-04T13:30:21.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15826 State: PUBLISHED Published: 2020-08-08T20:32:39 Last Updated: 2024-08-04T13:30:22.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15827 State: PUBLISHED Published: 2020-08-08T20:24:52 Last Updated: 2024-08-04T13:30:21.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15828 State: PUBLISHED Published: 2020-08-08T20:48:14 Last Updated: 2024-08-04T13:30:21.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15829 State: PUBLISHED Published: 2020-08-08T20:40:40 Last Updated: 2024-08-04T13:30:22.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15830 State: PUBLISHED Published: 2020-08-08T20:51:35 Last Updated: 2024-08-04T13:30:22.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15831 State: PUBLISHED Published: 2020-08-08T20:50:17 Last Updated: 2024-08-04T13:30:23.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
CVE ID: CVE-2020-15832 State: PUBLISHED Published: 2021-02-01T01:36:34 Last Updated: 2024-08-04T13:30:21.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The poof.cgi script contains undocumented code that provides the ability to remotely reboot the device. An adversary with the private key (but not the root password) can remotely reboot the device. Additional Analyst Notes: - CVE Program Container: References: - https://mofinetwork.com/index.php?main_page=page&id=14 - https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/
CVE ID: CVE-2020-15833 State: PUBLISHED Published: 2021-02-01T01:39:35 Last Updated: 2024-08-04T13:30:21.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location that cannot be modified by the device owner. Additional Analyst Notes: - CVE Program Container: References: - https://mofinetwork.com/index.php?main_page=page&id=14 - https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/
CVE ID: CVE-2020-15834 State: PUBLISHED Published: 2021-02-01T01:41:31 Last Updated: 2024-08-04T13:30:22.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in a QR encoded picture that an unauthenticated adversary can download via the web-management interface. Additional Analyst Notes: - CVE Program Container: References: - https://mofinetwork.com/index.php?main_page=page&id=14 - https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/
CVE ID: CVE-2020-15835 State: PUBLISHED Published: 2021-02-01T01:42:32 Last Updated: 2024-08-04T13:30:22.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the management interface as root. Additional Analyst Notes: - CVE Program Container: References: - https://mofinetwork.com/index.php?main_page=page&id=14 - https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/
CVE ID: CVE-2020-15836 State: PUBLISHED Published: 2021-02-01T01:44:26 Last Updated: 2024-08-04T13:30:22.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://mofinetwork.com/index.php?main_page=page&id=14 - https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/
CVE ID: CVE-2020-15838 State: PUBLISHED Published: 2020-10-09T06:37:47 Last Updated: 2024-08-04T13:30:22.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.connectwise.com/company/trust/security-bulletins - https://dbeta.com/2020/10/05/PrivilegeEscalationInAutomateAgent
CVE ID: CVE-2020-15839 State: PUBLISHED Published: 2020-09-22T17:27:49 Last Updated: 2024-08-04T13:30:22.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928 - https://issues.life
feray.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928 - https://issues.liferay.com/browse/LPE-17029 - https://issues.liferay.com/browse/LPE-17055
CVE ID: CVE-2020-15840 State: PUBLISHED Published: 2020-09-24T14:56:23 Last Updated: 2024-08-04T13:30:22.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities - https://issues.liferay.com/browse/LPE-17046 - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204
CVE ID: CVE-2020-15841 State: PUBLISHED Published: 2020-07-20T01:06:39 Last Updated: 2024-08-04T13:30:22.302Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439 -
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439 - https://issues.liferay.com/browse/LPE-16928
CVE ID: CVE-2020-15842 State: PUBLISHED Published: 2020-07-20T01:06:54 Last Updated: 2024-08-04T13:30:22.940Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427 - https://issues.liferay.com
ev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427 - https://issues.liferay.com/browse/LPE-16963
CVE ID: CVE-2020-15843 State: PUBLISHED Published: 2020-09-24T22:16:43 Last Updated: 2024-08-04T13:30:22.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client\, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal\. The folder permissions allow "Full Control" to "Everyone". An authenticated local attacker can exploit this to replace the TSClientB.exe binary in the Terminal directory, which is executed on logon for every user. Alternatively, the attacker can replace any of the binaries in the Clien
ory, which is executed on logon for every user. Alternatively, the attacker can replace any of the binaries in the Client or Install directories. The latter requires additional user interaction, for example starting the client. Additional Analyst Notes: - CVE Program Container: References: - https://blog.to.com/advisory-actfax-7-10-build-0335-privilege-escalation-cve-2020-15843/
CVE ID: CVE-2020-15849 State: PUBLISHED Published: 2020-09-30T18:28:20 Last Updated: 2024-08-04T13:30:22.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for authorization bypass and taking over additional accounts by means of modifying password-reset tokens stored in the database. Remote command execution is also possible by leveraging this to abuse the Yii framework's bizRule functiona
he database. Remote command execution is also possible by leveraging this to abuse the Yii framework's bizRule functionality, allowing for arbitrary PHP code to be executed by the application. Remote command execution is also possible by using this together with a separate insecure file upload vulnerability (CVE-2020-15488). Additional Analyst Notes: - CVE Program Container: References: - https://www.re-desk.com/download-help-desk-software.html - https://labs.f-secure.com/advisories/redesk-v2-3-multiple-issues/
CVE ID: CVE-2020-15850 State: PUBLISHED Published: 2020-09-24T20:23:24 Last Updated: 2024-08-04T13:30:22.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gain root privileges. This occurs because the database containing the users of the web application and the password-recovery secret value is readable. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/nakivo-backup-and-replication-multiple-vulnerabilities - https://helpcenter.nakivo.com/display/RN/v10.3+Release+Notes
CVE ID: CVE-2020-15851 State: PUBLISHED Published: 2020-09-24T20:24:52 Last Updated: 2024-08-04T13:30:22.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access unencrypted backup repositories and the Nakivo Controller configuration via a network accessible transporter service. It is also possible to create or delete backup repositories. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/nakivo-backup-and-replication-multiple-vulnerabilities - https://helpcenter.nakivo.com/display/RN/v10.3+Release+Notes
CVE ID: CVE-2020-15852 State: PUBLISHED Published: 2020-07-20T18:54:52 Last Updated: 2024-08-04T13:30:22.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-329.html - https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2
enbits.xen.org/xsa/advisory-329.html - https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cadfad870154e14f745ec845708bc17d166065f2 - http://www.openwall.com/lists/oss-security/2020/07/21/2 - https://security.netapp.com/advisory/ntap-20200810-0001/
CVE ID: CVE-2020-15853 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-13T15:03:16.324Z Vendors: n/a Products: supybot-fedora Problem Types: CWE-400 Description: supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fedora-infra/supybot-fedora/issues/69
CVE ID: CVE-2020-15855 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-04T13:30:22.338Z Vendors: n/a Products: bodhi Problem Types: CWE-79 Description: Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1. Additional Analyst Notes: - CVE Program Container: References: - https://pyup.io/packages/pypi/bodhi/changelog#5.6.1
CVE ID: CVE-2020-15858 State: PUBLISHED Published: 2020-08-21T00:00:00.000Z Last Updated: 2025-02-13T16:27:31.725Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AC:L/AV:P/A:L/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN
(Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04 Additional Analyst Notes: - CVE Program Container: References: - https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modules - http://seclists.org/fulldisclosure/2023/Apr/11 - http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass
fulldisclosure/2023/Apr/11 - http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass-Heap-Overflow.html
CVE ID: CVE-2020-15859 State: PUBLISHED Published: 2020-07-21T15:25:03 Last Updated: 2024-08-04T13:30:22.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/qemu/+bug/1886362 - https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg05304.html - https://www.openwall.com/lists/oss-security/2020/07/21/3 - https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html - https://security.gentoo.org/glsa/202208-27 - https://l
ps://lists.debian.org/debian-lts-announce/2021/02/msg00024.html - https://security.gentoo.org/glsa/202208-27 - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-15860 State: PUBLISHED Published: 2020-07-24T16:01:41 Last Updated: 2024-08-04T13:30:22.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm. Additional Analyst Notes: - CVE Program Contai
ions or the mentioned host is no longer associated with that server farm. Additional Analyst Notes: - CVE Program Container: References: - https://www.parallels.com/products/ras/remote-application-server/ - https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution - https://kb.parallels.com/en/125112
CVE ID: CVE-2020-15861 State: PUBLISHED Published: 2020-08-19T18:28:30 Last Updated: 2024-08-04T13:30:22.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966599 - https://github.com/net-snmp/net-snmp/commit/4fd9a450444a434a993bc72f7c3486ccce41f602 - https://github.com/net-snmp/net-snmp/issues/145 - https://security.gentoo.org/glsa/202008-12 - https://usn.ubuntu.com/4471-1/ - https://security.netapp.com/advisory/ntap-20200904-0001/