Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ould tamper with the data transmitted, causing the product to store wrong information or act on wrong data or display wrong information. This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2. For an attack to be successful, the attacker must have local access to a node in the system and be able to start a specially crafted application that disrupts the communication. An attacker who successfully exploited the vulnerability would be able to manipulate the data in such way as allowing reads and writes to the controllers or cause Windows processes in 800xA for MOD 300 and AdvaBuild to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
MOD 300 and AdvaBuild to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200044199.882581162.1721753430-284724496.1718609177
CVE ID: CVE-2020-11640 State: PUBLISHED Published: 2024-07-23T17:36:51.458Z Last Updated: 2024-08-04T11:35:13.681Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Advant MOD 300 AdvaBuild Problem Types: CWE-269 Description: AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any executable on the AdvaBuild node. The executables that can be run are not limited to AdvaBuild specific executables. Improper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2. Additiona
ability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200044199.882581162.1721753430-284724496.1718609177
CVE ID: CVE-2020-11641 State: PUBLISHED Published: 2020-10-15T14:58:27.058521Z Last Updated: 2024-09-17T04:28:49.241Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: B&R Products: SiteManager Problem Types: CWE-552 Description: A local file inclusion vulnerability in B&R SiteManager versions <9.2.620236042 allows authenticated users to read sensitive files from SiteManager instances. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE ID: CVE-2020-11642 State: PUBLISHED Published: 2020-10-15T14:58:48.634942Z Last Updated: 2024-09-17T01:11:16.044Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: B&R Products: SiteManager Problem Types: CWE-552 Description: The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager instances. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE ID: CVE-2020-11643 State: PUBLISHED Published: 2020-10-15T14:57:22.323453Z Last Updated: 2024-09-17T02:41:20.734Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: B&R Products: GateManager Problem Types: CWE-532 Description: An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view information of devices belonging to foreign domains. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa
om/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE ID: CVE-2020-11644 State: PUBLISHED Published: 2020-10-15T14:57:58.788754Z Last Updated: 2024-09-16T19:31:37.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: B&R Products: GateManager Problem Types: CWE-117 Description: The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to generate fake audit log messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE ID: CVE-2020-11645 State: PUBLISHED Published: 2020-10-15T14:59:08.500788Z Last Updated: 2024-09-17T01:31:40.263Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: B&R Products: GateManager Problem Types: CWE-400 Description: A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to limit availability of GateManager instances. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE ID: CVE-2020-11646 State: PUBLISHED Published: 2020-10-15T14:59:26.606024Z Last Updated: 2024-09-17T04:20:30.486Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: B&R Products: GateManager Problem Types: CWE-532 Description: A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view log information reserved for other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-
oads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE ID: CVE-2020-11647 State: PUBLISHED Published: 2020-04-10T20:16:21 Last Updated: 2024-08-04T11:35:13.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16474 - https://www.wireshark.org/security/wnpa-sec-2020-07.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=6f56fc9496db158218243ea87e3660c874a0bab0 - https://security.gentoo.org/glsa/202007-1
tweb?p=wireshark.git%3Ba=commit%3Bh=6f56fc9496db158218243ea87e3660c874a0bab0 - https://security.gentoo.org/glsa/202007-13 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-11649 State: PUBLISHED Published: 2020-04-22T19:52:15 Last Updated: 2024-08-04T11:35:13.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
CVE ID: CVE-2020-11650 State: PUBLISHED Published: 2020-04-08T22:12:46 Last Updated: 2024-08-04T11:35:13.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent. Additional Analyst Notes: - CVE Program Container: References: - https://jira.ixsystems.com/browse/NAS-104748 - https://security.ixsystems.com/cves/2020-04-08-cve-2020-11650/
CVE ID: CVE-2020-11651 State: PUBLISHED Published: 2020-04-30T16:58:09.000Z Last Updated: 2025-10-21T23:35:44.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html - https://gith
- CISA ADP Vulnrichment: References: - https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html - https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html - http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html - https://www.debian.org/security/2020/dsa-4676 - http://www.vmware.com/security/advisories/VMSA-2020-0009.html - http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG - https://lists.d
on.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG - https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html - https://usn.ubuntu.com/4459-1/
CVE ID: CVE-2020-11652 State: PUBLISHED Published: 2020-04-30T17:00:03.000Z Last Updated: 2025-10-21T23:35:44.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html - https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst - http://lists.opensuse.org/
4.html - https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html - http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html - https://www.debian.org/security/2020/dsa-4676 - http://www.vmware.com/security/advisories/VMSA-2020-0009.html - http://packetstormsecurity.com/files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG - https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html - http://support.blackberry.com/kb/articleDetai
5AG - https://lists.debian.org/debian-lts-announce/2020/05/msg00027.html - http://support.blackberry.com/kb/articleDetail?articleNumber=000063758 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html - https://usn.ubuntu.com/4459-1/
CVE ID: CVE-2020-11653 State: PUBLISHED Published: 2020-04-08T00:00:00 Last Updated: 2024-08-04T11:35:13.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss. Additional Analyst Notes: - CVE Program Container: References: - https://varnish-cache.org/security/VSV00005.html#vsv00005 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html - http://lists.opensuse.org/opensuse-security-annou
/lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html
CVE ID: CVE-2020-11655 State: PUBLISHED Published: 2020-04-09T02:49:33 Last Updated: 2024-08-04T11:35:13.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html - https://usn.ubuntu.com/4394-1/ - https://www.oracle.com/security-alerts/cpujul2020.html - https://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c - https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11 - https:/
ttps://www3.sqlite.org/cgi/src/tktview?name=af4556bb5c - https://www3.sqlite.org/cgi/src/info/4a302b42c7bf5e11 - https://security.netapp.com/advisory/ntap-20200416-0001/ - https://security.gentoo.org/glsa/202007-26 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc - https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-14 - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-11656 State: PUBLISHED Published: 2020-04-09T02:49:18 Last Updated: 2024-08-04T11:35:13.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200416-0001/ - https://www3.sqlite.org/cgi/src/info/b64674919f673602 - https://www.sqlite.org/src/info/d09f8c3621d5f7f8 - https://security.gentoo.org/glsa/202007-26 - https://security.FreeBSD.org/advisor
sqlite.org/src/info/d09f8c3621d5f7f8 - https://security.gentoo.org/glsa/202007-26 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-14 - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-11658 State: PUBLISHED Published: 2020-04-15T20:46:55 Last Updated: 2024-08-04T11:35:13.703Z Vendors: n/a Products: CA API Developer Portal Problem Types: Authorization Bypass Description: CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypas
ulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11659 State: PUBLISHED Published: 2020-04-15T20:47:05 Last Updated: 2024-08-04T11:35:13.689Z Vendors: n/a Products: CA API Developer Portal Problem Types: Authorization Schema Bypass Description: CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.
http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11660 State: PUBLISHED Published: 2020-04-15T20:47:13 Last Updated: 2024-08-04T11:35:13.631Z Vendors: n/a Products: CA API Developer Portal Problem Types: Authorization Schema Bypass Description: CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view restricted sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-
clists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11661 State: PUBLISHED Published: 2020-04-15T19:08:23 Last Updated: 2024-08-04T11:35:13.461Z Vendors: n/a Products: CA API Developer Portal Problem Types: Authorization Schema Bypass Description: CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/f
ity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11662 State: PUBLISHED Published: 2020-04-15T19:08:30 Last Updated: 2024-08-04T11:35:13.638Z Vendors: n/a Products: CA API Developer Portal Problem Types: CORS OriginHeaderScrutiny Description: CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass
PI-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11663 State: PUBLISHED Published: 2020-04-15T19:08:37 Last Updated: 2024-08-04T11:35:13.501Z Vendors: n/a Products: CA API Developer Portal Problem Types: Open Redirect Description: CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/ful
y.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11664 State: PUBLISHED Published: 2020-04-15T19:02:58 Last Updated: 2024-08-04T11:35:13.551Z Vendors: n/a Products: CA API Developer Portal Problem Types: Open Redirect Description: CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://s
ketstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11665 State: PUBLISHED Published: 2020-04-15T19:03:09 Last Updated: 2024-08-04T11:35:13.550Z Vendors: n/a Products: CA API Developer Portal Problem Types: Open Redirect Description: CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://
cketstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html
CVE ID: CVE-2020-11666 State: PUBLISHED Published: 2020-04-15T19:03:19 Last Updated: 2024-08-04T11:35:13.620Z Vendors: n/a Products: CA API Developer Portal Problem Types: Privilege Issue Description: CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.html - http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020
44/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Apr/24 - http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.html