Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7328 State: PUBLISHED Published: 2020-11-11T09:10:13.230347Z Last Updated: 2024-09-17T03:08:02.941Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee, LLC Products: MVISION Endpoint ePO extension Problem Types: CWE-918 Description: External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request, where the content for the attack has been loaded into ePO by an ePO administrator. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corp
ePO by an ePO administrator. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10334
CVE ID: CVE-2020-7329 State: PUBLISHED Published: 2020-11-11T09:15:15.729231Z Last Updated: 2024-09-17T02:21:36.244Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee, LLC Products: MVISION Endpoint ePO extension Problem Types: CWE-918 Description: Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO administrator. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10334
CVE ID: CVE-2020-7330 State: PUBLISHED Published: 2020-10-14T08:55:16 Last Updated: 2024-08-04T09:25:49.094Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Trial Problem Types: CWE-269 Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial prior to 4.0.176.1 allows local users to schedule tasks which call malicious software to execute with elevated privileges via editing of environment variables Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103082
CVE ID: CVE-2020-7331 State: PUBLISHED Published: 2020-11-12T09:40:13.442009Z Last Updated: 2024-09-16T18:18:41.482Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee, LLC Products: McAfee Endpoint Security (ENS) Problem Types: CWE-428 Description: Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10335
CVE ID: CVE-2020-7332 State: PUBLISHED Published: 2020-11-12T09:45:15.185321Z Last Updated: 2024-09-17T00:30:40.241Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Mcafee, LLC Products: Endpoint Security for Windows Problem Types: CWE-352 Description: Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute arbitrary HTML code due to incorrect security configuration. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10335
CVE ID: CVE-2020-7333 State: PUBLISHED Published: 2020-11-12T09:50:14.822195Z Last Updated: 2024-09-16T19:45:59.328Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Mcafee, LLC Products: Endpoint Security for Windows Problem Types: CWE-79 Description: Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10335
CVE ID: CVE-2020-7334 State: PUBLISHED Published: 2020-10-15T09:05:17.539028Z Last Updated: 2024-09-16T22:45:11.642Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Application and Change Control (MACC) Problem Types: CWE-266 Description: Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further controls for installation/uninstallation of software. Additional Analyst Notes: - CVE Program Container:
on adds further controls for installation/uninstallation of software. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10333
CVE ID: CVE-2020-7335 State: PUBLISHED Published: 2020-12-01T08:50:14 Last Updated: 2024-08-04T09:25:49.121Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Problem Types: CWE-269 Description: Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploitable in a small time window. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQD
in a small time window. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103089 - https://www.zerodayinitiative.com/advisories/ZDI-20-1388/
CVE ID: CVE-2020-7336 State: PUBLISHED Published: 2021-01-05T23:10:17 Last Updated: 2024-08-04T09:25:49.109Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: McAfee Products: Network Security Management (NSM) Problem Types: CWE-352 Description: Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10341
CVE ID: CVE-2020-7337 State: PUBLISHED Published: 2020-12-09T08:40:14.736661Z Last Updated: 2024-09-16T18:18:07.120Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: McAfee, LLC Products: VirusScan Enterprise (VSE) Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/cor
of the Code Integrity checks. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10338
CVE ID: CVE-2020-7339 State: PUBLISHED Published: 2020-12-09T23:15:14 Last Updated: 2024-08-04T09:25:49.002Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: McAfee Products: Database Security Problem Types: CWE-327 Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certificate that would allow an attacker on the same local network to potentially intercept communication between the Server and Sensors. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10340
CVE ID: CVE-2020-7343 State: PUBLISHED Published: 2021-01-18T12:15:19.338899Z Last Updated: 2024-09-17T03:47:52.262Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: McAfee, LLC Products: McAfee Agent Problem Types: CWE-862 Description: Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10343
CVE ID: CVE-2020-7346 State: PUBLISHED Published: 2021-03-23T16:05:23 Last Updated: 2024-08-04T09:25:49.105Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Data Loss Prevention (DLP) Endpoint for Windows Problem Types: CWE-59 Description: Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attacker along with sending a specific IOTL command at the correct time. Additional Analyst Notes: - CVE Pr
tions by the attacker along with sending a specific IOTL command at the correct time. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10344
CVE ID: CVE-2020-7350 State: PUBLISHED Published: 2020-04-22T21:25:13.300204Z Last Updated: 2024-09-17T00:51:34.097Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: Rapid7 Products: Metasploit Framework Problem Types: CWE-78 Description: Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metas
by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/issues/13026
CVE ID: CVE-2020-7351 State: PUBLISHED Published: 2020-05-01T15:50:13.910425Z Last Updated: 2024-09-16T22:55:46.483Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Fonality Products: Trixbox Community Edition Problem Types: CWE-78 Description: An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected. A
ssue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/13353 - http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html
CVE ID: CVE-2020-7352 State: PUBLISHED Published: 2020-08-06T15:45:27.543775Z Last Updated: 2024-09-16T17:48:55.879Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GOG Products: GOG GalaxyClientService Problem Types: CWE-264 Description: The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:99
execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/13444 - https://www.positronsecurity.com/blog/2020-04-28-gog-galaxy-client-local-privilege-escalation/
CVE ID: CVE-2020-7354 State: PUBLISHED Published: 2020-06-25T17:15:15.535412Z Last Updated: 2024-09-17T00:25:26.208Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Rapid7 Products: Metasploit Pro Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versi
d host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7355, which describes a similar issue, but involving the generated 'notes' field of a discovered scan asset. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/metasploit/release-notes/archive/2020/05/#20200514 - https://avalz.it/research/metasploit-pro-xss-to-rce/
CVE ID: CVE-2020-7355 State: PUBLISHED Published: 2020-06-25T17:15:15.975135Z Last Updated: 2024-09-17T02:31:45.777Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Rapid7 Products: Metasploit Pro Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior version
host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7354, which describes a similar issue, but involving the generated 'host' field of a discovered scan asset. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/metasploit/release-notes/archive/2020/05/#20200514 - https://avalz.it/research/metasploit-pro-xss-to-rce/
CVE ID: CVE-2020-7356 State: PUBLISHED Published: 2020-08-06T15:45:28.016670Z Last Updated: 2024-09-17T03:37:28.730Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Cayin Technology Products: Cayin xPost Problem Types: CWE-89 Description: CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands. Additional Analyst Notes: - CVE Program Container: References: - https://www
trary SQL code and execute SYSTEM commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php - https://github.com/rapid7/metasploit-framework/pull/13607
CVE ID: CVE-2020-7357 State: PUBLISHED Published: 2020-08-06T15:45:28.433116Z Last Updated: 2024-09-17T03:12:42.262Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Cayin Technology Products: Cayin CMS-SE, Cayin CMS-60, Cayin CMS-40, Cayin CMS-20, Cayin CMS Problem Types: CWE-78 Description: Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-4
ystem.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/13607 - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/182925
CVE ID: CVE-2020-7358 State: PUBLISHED Published: 2020-09-18T14:55:12 Last Updated: 2024-08-04T09:25:48.976Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Rapid7 Products: AppSpider Problem Types: CWE-427 Description: In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7
xecutable using the same file name. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126
CVE ID: CVE-2020-7360 State: PUBLISHED Published: 2020-08-13T19:05:15.783973Z Last Updated: 2024-09-17T01:21:03.461Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Philips Products: SmartControl Problem Types: CWE-427 Description: An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was released after April 15, 2020. (Note, the version numbering system changed significantly between version 4.3.15 and version 1.0.7.) Addit
ril 15, 2020. (Note, the version numbering system changed significantly between version 4.3.15 and version 1.0.7.) Additional Analyst Notes: - CVE Program Container: References: - https://blog.vonahi.io/when-the-path-to-system-is-wide-open/
CVE ID: CVE-2020-7361 State: PUBLISHED Published: 2020-08-06T15:45:28.912800Z Last Updated: 2024-09-16T22:01:33.434Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: EasyCorp Products: ZenTao Pro Problem Types: CWE-78 Description: The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system. Additional Analyst Notes: - CVE Program Container: References: - https:
text on the underlying Windows operating system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/13828
CVE ID: CVE-2020-7363 State: PUBLISHED Published: 2020-10-20T16:40:23.335056Z Last Updated: 2024-09-17T02:10:40.344Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: UCWeb Products: UC Browser Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html - https://b
tainer: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html - https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE ID: CVE-2020-7364 State: PUBLISHED Published: 2020-10-20T16:40:23.771447Z Last Updated: 2024-09-16T19:40:23.808Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: UCWeb Products: UC Browser Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html - https://b
CVE ID: CVE-2020-7369 State: PUBLISHED Published: 2020-10-20T16:40:24.201075Z Last Updated: 2024-09-17T01:21:44.428Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Yandex Products: Yandex Browser Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version 20.8.4 released October 1, 2020. Additional Analyst Notes: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10
ed October 1, 2020. Additional Analyst Notes: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html - https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE ID: CVE-2020-7370 State: PUBLISHED Published: 2020-10-20T16:40:24.626149Z Last Updated: 2024-09-16T17:08:52.609Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Danyil Vasilenko Products: Bolt Browser Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabili
es: - CVE Program Container: References: - https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html - https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/