Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2020-002-cve-2020-8948/#sthash.ByZB8ifG.dpbs
CVE ID: CVE-2020-8949 State: PUBLISHED Published: 2020-02-12T18:21:16 Last Updated: 2024-08-04T10:12:11.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/02/gocloud-rce-in-gocloud-routers.html
CVE ID: CVE-2020-8950 State: PUBLISHED Published: 2020-02-12T20:00:12 Last Updated: 2024-08-04T10:12:11.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing a crafted file in %PROGRAMDATA%\AMD\PPC\upload and then creating a symbolic link in %PROGRAMDATA%\AMD\PPC\temp that points to an arbitrary folder with an arbitrary file name. Additional Analyst Notes: - CVE Program Container: References: - https://heynowyouseeme.blogspot.com/2020/02/privilege-escalation-filewrite-eop-in.html - https://heynowyouseeme.blogspot.com/2020/02/another-privilege-e
com/2020/02/privilege-escalation-filewrite-eop-in.html - https://heynowyouseeme.blogspot.com/2020/02/another-privilege-escalation-filewrite.html
CVE ID: CVE-2020-8951 State: PUBLISHED Published: 2020-02-26T15:28:58 Last Updated: 2024-08-04T10:12:11.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Translation) page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eSecure-CVEs/CVEs/blob/master/CVE-2020-8951
CVE ID: CVE-2020-8952 State: PUBLISHED Published: 2020-02-26T15:27:51 Last Updated: 2024-08-04T10:12:10.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eSecure-CVEs/CVEs/blob/master/CVE-2020-8952
CVE ID: CVE-2020-8953 State: PUBLISHED Published: 2020-02-13T03:13:02 Last Updated: 2024-08-04T10:12:11.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/security-advisories/
CVE ID: CVE-2020-8954 State: PUBLISHED Published: 2020-06-08T16:30:32 Last Updated: 2024-08-04T10:19:18.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in the browser can be manipulated] Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=de.marcel.opensearch&hl=en_US - https://raw.githubusercontent.com/marcelbohland/OpenSerach-CVE-SVE-reference-/master/CVE-list
CVE ID: CVE-2020-8955 State: PUBLISHED Published: 2020-02-12T21:58:51 Last Updated: 2024-08-04T10:19:18.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode). Additional Analyst Notes: - CVE Program Container: References: - https://weechat.org/doc/security/ - https://github.com/weechat/weechat/commit/6f4f147d8e86adf9ad34a8ffd7e7f1f23a7e74da - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00032.html - https://lists
df9ad34a8ffd7e7f1f23a7e74da - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00032.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ASRTCQFFDAAK347URWNDH6NSED2BGNY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER23GT23US5JXDLUZAMGMWXKZ74MI4S2/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00031.html - https://security.gentoo.org/glsa/202003-51 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3LAJTLI3LWZRNCFYJ7PCBBTHUMCCBHH/ - https://lists.debian.org/debian-lts-announce/2021/09/msg00018.html
CVE ID: CVE-2020-8956 State: PUBLISHED Published: 2020-10-27T04:13:22 Last Updated: 2024-08-04T10:19:18.158Z Severity: LOW (CVSS 3.8 CVSS:3.0/AC:L/AV:L/A:N/C:L/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
CVE ID: CVE-2020-8958 State: PUBLISHED Published: 2020-07-15T20:13:32 Last Updated: 2024-08-04T10:19:18.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field. Additional Analyst Notes: - CVE Program Container: References: - https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html - https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html - https://github.com/qurbat/gpon - https://www.karansaini.com/os-command-injection-v-sol/
CVE ID: CVE-2020-8959 State: PUBLISHED Published: 2020-02-19T16:12:36 Last Updated: 2024-08-04T10:19:19.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads - https://www.westerndigital.com/support/productsecurity/wdc-20001-ssd-dashboard-setup-privilege-escalation
CVE ID: CVE-2020-8960 State: PUBLISHED Published: 2020-02-20T22:03:05 Last Updated: 2024-08-04T10:19:18.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads - https://www.westerndigital.com/support/productsecurity/wdc-20003-mycloud-xss-vulnerability - https://www.westerndigital.com/support/productsecurity/wdc-20003-mycloud-site-version-2-2-0-134
CVE ID: CVE-2020-8961 State: PUBLISHED Published: 2020-04-09T19:54:59 Last Updated: 2024-08-04T10:19:19.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality. Additional Analyst Notes: - CVE Program Container: References: - https://support.avira.com/hc/en-us/articles/360000109798-Avira-Antivirus-for-
es: - CVE Program Container: References: - https://support.avira.com/hc/en-us/articles/360000109798-Avira-Antivirus-for-Windows
CVE ID: CVE-2020-8962 State: PUBLISHED Published: 2020-02-13T04:17:16 Last Updated: 2024-08-04T10:19:18.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://ctrsec.io/index.php/2020/02/12/cve-2020-8962-d-link-dir-842-stack-based-buffer-overflow/
CVE ID: CVE-2020-8963 State: PUBLISHED Published: 2020-02-13T02:56:47 Last Updated: 2024-08-04T10:19:18.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html
CVE ID: CVE-2020-8964 State: PUBLISHED Published: 2020-02-13T02:56:32 Last Updated: 2024-08-04T10:19:18.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie." Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html
CVE ID: CVE-2020-8966 State: PUBLISHED Published: 2020-04-01T20:18:19.303817Z Last Updated: 2024-09-16T16:23:22.402Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Tiki-Wiki Groupware Products: Tiki-Wiki CMS Problem Types: CWE-80 Description: There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisori
onal Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/cross-site-scripting-xss-flaws-found-tiki-wiki-cms-software - https://sourceforge.net/p/tikiwiki/code/75455
CVE ID: CVE-2020-8967 State: PUBLISHED Published: 2020-06-01T13:05:29.043593Z Last Updated: 2024-09-16T16:42:51.243Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Gesio (GESTIÓN INTEGRAL ONLINE, SL) Products: GESIO ERP Problem Types: CWE-89 Description: There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability
CVE ID: CVE-2020-8968 State: PUBLISHED Published: 2021-12-17T16:10:37.247061Z Last Updated: 2024-09-17T01:02:06.573Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Parallels Products: Parallels Remote Application Server (Client) Problem Types: CWE-255 Description: Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password. Additional Analyst Notes: - CVE Program Container: Refere
omised if an attacker is able to recover the profile password. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors
CVE ID: CVE-2020-8973 State: PUBLISHED Published: 2022-10-17T21:17:28.108Z Last Updated: 2025-05-13T15:00:32.012Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: ZGR Products: ZGR TPS200 NG Problem Types: CWE-284 Description: ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with access to the network where the affected asset is located, to operate and change several parameters without having to be registered as a user on the web that owns the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incib
the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng
CVE ID: CVE-2020-8974 State: PUBLISHED Published: 2022-10-17T21:16:42.734Z Last Updated: 2025-05-13T15:00:47.241Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: ZGR Products: ZGR TPS200 NG Problem Types: CWE-434 Description: In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200
P Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng
CVE ID: CVE-2020-8975 State: PUBLISHED Published: 2022-10-17T21:15:25.826Z Last Updated: 2025-05-12T18:32:17.109Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ZGR Products: ZGR TPS200 NG Problem Types: CWE-201 Description: ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (URIs) used by the application, to access sensitive information about the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/multiple-vulnerabilities-zgr-tps200-ng
CVE ID: CVE-2020-8976 State: PUBLISHED Published: 2022-10-17T21:18:06.952Z Last Updated: 2025-04-23T16:45:51.672Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: ZGR Products: ZGR TPS200 NG Problem Types: CWE-352 Description: The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permissions of a victim user. For this to happen, the victim user has to have an active session and triggers the malicious request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/multi
ogram Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/multiple-vulnerabilities-zgr-tps200-ng
CVE ID: CVE-2020-8981 State: PUBLISHED Published: 2020-02-13T16:46:51 Last Updated: 2024-08-04T10:19:18.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mantisbt-plugins/source-integration/issues/338 - https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0
CVE ID: CVE-2020-8982 State: PUBLISHED Published: 2020-05-07T13:55:59 Last Updated: 2024-08-04T10:19:19.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of
n use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8983. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX269106 - https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/ - https://drive.google.com/file/d/1Izd5MF_HHuq8YSwAyJLBErWL_nbe6f9v/view
CVE ID: CVE-2020-8983 State: PUBLISHED Published: 2020-05-07T13:57:03 Last Updated: 2024-08-04T10:19:18.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, which allows remote code execution. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a c
ct version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8982. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX269106 - https://drive.google.com/file/d/15iy6S8CN9Hku0a2zrcrXK9FAocmQvMwT/view?usp=sharing - https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-66634329
haring - https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/
CVE ID: CVE-2020-8984 State: PUBLISHED Published: 2020-03-24T20:12:07 Last Updated: 2024-08-04T10:19:19.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header. Additional Analyst Notes: - CVE Program Container: References: - https://zend.to/changelog.php - http://jul.es/pipermail/zendto/2020-January/003845.html
CVE ID: CVE-2020-8985 State: PUBLISHED Published: 2020-03-24T20:12:22 Last Updated: 2024-08-04T10:19:19.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality. Additional Analyst Notes: - CVE Program Container: References: - https://zend.to/changelog.php
CVE ID: CVE-2020-8986 State: PUBLISHED Published: 2020-03-24T20:12:27 Last Updated: 2024-08-04T10:19:19.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests. Additional Analyst Notes: - CVE Program Container: References: - https://zend.to/changelog.php
CVE ID: CVE-2020-8987 State: PUBLISHED Published: 2020-03-09T16:38:32 Last Updated: 2024-08-04T10:19:19.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.) Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports
Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast - https://www.davideade.com/2020/03/avast-antitrack.html
CVE ID: CVE-2020-8988 State: PUBLISHED Published: 2020-02-13T20:46:48 Last Updated: 2024-08-04T10:19:19.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers (after using root access to make a copy of the local database) to discover login credentials and voting history via an offline brute-force approach. Additional Analyst Notes: - CVE Program Container: References: - https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf - https://blog.voatz.com/?p=1209
CVE ID: CVE-2020-8989 State: PUBLISHED Published: 2020-02-13T20:46:12 Last Updated: 2024-08-04T10:19:19.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate
ta. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf - https://blog.voatz.com/?p=1209
CVE ID: CVE-2020-8990 State: PUBLISHED Published: 2020-02-20T21:59:42 Last Updated: 2024-08-04T10:19:20.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads - https://www.westerndigital.com/support/productsecurity/wdc-19013-my-cloud-home-and-ibi-session-invalidation-vulnerability
CVE ID: CVE-2020-8991 State: PUBLISHED Published: 2020-02-14T04:27:16 Last Updated: 2024-08-04T10:19:20.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceware.org/git/?p=lvm2.git%3Ba=commit%3Bh=bcf9556b8fcd16ad8997f80cc92785f295c66701