Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
il/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25870 State: REJECTED Published: N/A Last Updated: 2023-10-30T13:35:18.125134 Description: No description available.
CVE ID: CVE-2020-25872 State: PUBLISHED Published: 2021-10-29T19:11:07 Last Updated: 2024-08-04T15:49:06.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traversal attack via a GET request urlencode parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/34
CVE ID: CVE-2020-25873 State: PUBLISHED Published: 2021-10-29T19:11:08 Last Updated: 2024-08-04T15:49:06.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attackers to arbitrarily delete folders on the server via the "id" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baijiacms/baijiacmsV4/issues/6
CVE ID: CVE-2020-25875 State: PUBLISHED Published: 2021-07-09T21:56:04 Last Updated: 2024-08-04T15:49:06.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Smiley Code' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://codoforum.com/ - https://github.com/r0ck3t1973/xss_payload/issues/4
CVE ID: CVE-2020-25876 State: PUBLISHED Published: 2021-07-09T21:56:03 Last Updated: 2024-08-04T15:49:06.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Page Title' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://codoforum.com/ - https://github.com/r0ck3t1973/xss_payload/issues/3
CVE ID: CVE-2020-25877 State: PUBLISHED Published: 2021-07-09T21:56:00 Last Updated: 2024-08-04T15:49:05.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackCatDevelopment/BlackCatCMS/issues/401 - https://blackcat-cms.org/
CVE ID: CVE-2020-25878 State: PUBLISHED Published: 2021-07-09T21:55:58 Last Updated: 2024-08-04T15:49:06.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the 'Output Filters' and 'Droplets' modules. Additional Analyst Notes: - CVE Program Container: References: - https://blackcat-cms.org/ - https://github.com/BlackCatDevelopment/BlackCatCMS/issues/402
CVE ID: CVE-2020-25879 State: PUBLISHED Published: 2021-07-09T21:55:57 Last Updated: 2024-08-04T15:49:05.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Username' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://codoforum.com/ - https://github.com/r0ck3t1973/xss_payload/issues/5
CVE ID: CVE-2020-25881 State: PUBLISHED Published: 2021-10-29T19:54:49 Last Updated: 2024-08-04T15:49:05.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in the filename parameter in pathindex.php?r=cms-backend/attachment/delete&sub=&filename=../../../../111.txt&filetype=image/jpeg of the master version of RKCMS. This vulnerability allows for an attacker to perform a directory traversal via a crafted .txt file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AubreyJun/cms/issues/2 - http://www.ranko.cn/index.html - https://gitee.com/wuxi_ranko/cms
CVE ID: CVE-2020-25887 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T19:29:25.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mongoose/issues/1140
CVE ID: CVE-2020-25889 State: PUBLISHED Published: 2020-12-08T13:00:53 Last Updated: 2024-08-04T15:49:06.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html - http://seclists.org/fulldisclosure/2020/Dec/4 - https://seclists.org/fulldisclosure/2020/Dec/4 - http://packetstormsecurity.com/files/160397/Onl
disclosure/2020/Dec/4 - https://seclists.org/fulldisclosure/2020/Dec/4 - http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html
CVE ID: CVE-2020-25890 State: PUBLISHED Published: 2020-11-17T20:05:23 Last Updated: 2024-08-04T15:49:06.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address Book". Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions Additional Analyst Notes: - CVE Program Container: References: - https://vitor-santos.medium.com/xss-in-kyocera-printer-ecosys-m2640idw-cf6d3bc525e3
CVE ID: CVE-2020-25901 State: PUBLISHED Published: 2020-12-18T14:30:34 Last Updated: 2024-08-04T15:49:06.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Spiceworks%20version%207.5%20HTTP%20Header%20Injection - http://packetstormsecurity.com/files/160631/Spiceworks-7.5-HTTP-Header-Injection.html - https://frontend.spiceworks.com/topic/2309457-desktop-host-header-injection-vulnerability
CVE ID: CVE-2020-25902 State: PUBLISHED Published: 2021-03-02T12:35:49 Last Updated: 2024-08-04T15:49:05.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-parties dispute the validity of this entry as a possible false positive during research Additional Analyst Notes: - CVE Program Container: References: - https://www.blackboard.com/teaching-learning/collaboration-web-conferencing/blackboard-collaborate - https://github.com/Lawyer-1/Turki/blob/main/CVE-2020-25902.m
ing/collaboration-web-conferencing/blackboard-collaborate - https://github.com/Lawyer-1/Turki/blob/main/CVE-2020-25902.md
CVE ID: CVE-2020-25905 State: PUBLISHED Published: 2022-01-28T00:00:00 Last Updated: 2024-08-04T15:49:06.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) LoginAsAdmin.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/159132/Mobile-Shop-System-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/48916
CVE ID: CVE-2020-25911 State: PUBLISHED Published: 2021-10-31T18:32:50 Last Updated: 2024-08-04T15:49:06.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/issues/15237 - https://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md
CVE ID: CVE-2020-25912 State: PUBLISHED Published: 2021-10-31T18:32:50 Last Updated: 2024-08-04T15:49:06.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - http://symphony.com - https://github.com/symphonycms/symphonycms/issues/2924
CVE ID: CVE-2020-25915 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T19:16:42.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkcmf/thinkcmf/issues/675
CVE ID: CVE-2020-25917 State: PUBLISHED Published: 2020-12-26T01:50:52 Last Updated: 2024-08-04T15:49:06.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser.do page. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/160652/Stratodesk-NoTouch-Center-Privilege-Escalation.html
CVE ID: CVE-2020-25925 State: PUBLISHED Published: 2021-07-07T13:53:07 Last Updated: 2024-08-04T15:49:06.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field. Additional Analyst Notes: - CVE Program Container: References: - https://ashketchum.medium.com/cross-site-scripting-xss-in-webmail-calender-in-icewarp-webclient-cve-2020-25925-67e1cbc40bd9
CVE ID: CVE-2020-25926 State: PUBLISHED Published: 2021-08-18T18:35:28 Last Updated: 2024-08-04T15:49:06.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote). The component is: dns_query_type(). The attack vector is: a specific DNS response packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209 - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-25927 State: PUBLISHED Published: 2021-08-18T18:37:36 Last Updated: 2024-08-04T15:49:06.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service (remote). The component is: DNS response processing in function: dns_upcall(). The attack vector is: a specific DNS response packet. The code does not check whether the number of queries/responses specified in the DNS packet header corresponds to the query/response data available in the DNS packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.iniche.com/source-code/network
e DNS packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.iniche.com/source-code/networking-stack/nichestack.php - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-25928 State: PUBLISHED Published: 2021-08-18T18:41:00 Last Updated: 2024-08-04T15:49:06.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS response processing functions: dns_upcall(), getoffset(), dnc_set_answer(). The attack vector is: a specific DNS response packet. The code does not check the "response data length" field of individual DNS answers, which may cause out-of-bounds read/write operations, leading to Information leak, Denial-or-Service, or Remote Code Execution, depending on the context. Additio
operations, leading to Information leak, Denial-or-Service, or Remote Code Execution, depending on the context. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-25950 State: PUBLISHED Published: 2021-01-08T06:54:23 Last Updated: 2024-08-04T15:49:06.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additional Contact page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49369
CVE ID: CVE-2020-25952 State: PUBLISHED Published: 2020-11-16T15:37:11 Last Updated: 2024-08-04T15:49:06.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/ - https://www.exploit-db.com/exploits/49052 - https://th3cyb3rc0p.medium.com/cve-2020-25952-f60fff8ffac - https://systemweakness.com/cve-2020-25952-f60fff8ffac
CVE ID: CVE-2020-25955 State: PUBLISHED Published: 2020-12-08T13:05:18 Last Updated: 2024-08-04T15:49:06.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS) via the 'add subject' tab. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14443/student-management-system-project-php.html - http://seclists.org/fulldisclosure/2020/Dec/4 - https://seclists.org/fulldisclosure/2020/Dec/4 - http://packetstormsecurity.com/files/160398/Student-Management-System-Project-PHP-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2020-25966 State: PUBLISHED Published: 2020-10-28T17:37:16 Last Updated: 2024-08-04T15:49:06.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured assets without proper authentication. This could be used by unauthorized parties to get configured login credentials of the assets via a modified pAccountID value. NOTE: The vendor has indicated this is not a vulnerability and states "This vulnerability occurred due to wrong configuration of system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sectona.com/pr
system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sectona.com/products/spectra-privileged-access-management/ - https://gitlab.com/Gazzaz/Spectra_API_Issue/
CVE ID: CVE-2020-25967 State: PUBLISHED Published: 2020-12-10T21:07:53 Last Updated: 2024-08-04T15:49:06.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnpanda.net/codeaudit/777.html
CVE ID: CVE-2020-25969 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-11-25T16:05:44.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/gnuplot/bugs/2311/
CVE ID: CVE-2020-25985 State: PUBLISHED Published: 2020-10-07T11:25:26 Last Updated: 2024-08-04T15:49:06.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver (php files can be unlinked and not deleted). Additional Analyst Notes: - CVE Program Container: References: - https://monocms.com/download - https://www.exploit-db.com/exploits/48848
CVE ID: CVE-2020-25986 State: PUBLISHED Published: 2020-10-06T12:51:29 Last Updated: 2024-08-04T15:49:06.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user. Additional Analyst Notes: - CVE Program Container: References: - https://monocms.com/download - http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html
CVE ID: CVE-2020-25987 State: PUBLISHED Published: 2020-10-06T12:51:26 Last Updated: 2024-08-04T15:49:06.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash. Additional Analyst Notes: - CVE Program Container: References: - https://monocms.com/download - http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html
CVE ID: CVE-2020-25988 State: PUBLISHED Published: 2020-11-17T19:43:08 Last Updated: 2024-08-04T15:49:07.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' which leaks the credentials of 'admin', provided that the attacker is network adjacent. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/GOMLavacqSI - https://medium.com/%40niteshsurana/424f0db73129 - https://github.com/ideaengine007/RandomStuffs/blob/main/Version_Vulnerable.PNG - https://www.exploit-db.com/exploits/49075
CVE ID: CVE-2020-25989 State: PUBLISHED Published: 2020-11-19T20:51:35 Last Updated: 2024-08-04T15:49:06.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://vkas-afk.github.io/vuln-disclosures/ - https://github.com/pritunl/pritunl-client-electron/commit/89f8c997c6f93e724f68f76f7f47f8891d9acc2d
CVE ID: CVE-2020-25990 State: PUBLISHED Published: 2020-10-01T13:57:54 Last Updated: 2024-08-04T15:49:06.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Additional Analyst Notes: - CVE Program Container: References: - https://websitebaker.org/pages/en/home.php - https://www.exploit-db.com/exploits/48849
CVE ID: CVE-2020-26006 State: PUBLISHED Published: 2021-05-24T12:41:56 Last Updated: 2024-08-04T15:49:06.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-examination-systen-in-php/archive/master.zip - https://nikhilkumar01.medium.com/cve-2020-26006-31f847e16019
CVE ID: CVE-2020-26007 State: PUBLISHED Published: 2022-03-20T21:12:00 Last Updated: 2024-08-04T15:49:06.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongfuxiang/shopxo/issues/48
CVE ID: CVE-2020-26008 State: PUBLISHED Published: 2022-03-20T21:12:01 Last Updated: 2024-08-04T15:49:06.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongfuxiang/shopxo/issues/47
CVE ID: CVE-2020-26028 State: PUBLISHED Published: 2020-12-28T07:57:44 Last Updated: 2024-08-04T15:49:07.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-19
CVE ID: CVE-2020-26029 State: PUBLISHED Published: 2020-12-28T07:57:36 Last Updated: 2024-08-04T15:49:07.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-20
CVE ID: CVE-2020-26030 State: PUBLISHED Published: 2020-12-28T07:57:23 Last Updated: 2024-08-04T15:49:06.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An attacker can create a valid and authenticated session that can be used to perform any actions in the name of other users. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-18
CVE ID: CVE-2020-26031 State: PUBLISHED Published: 2020-12-28T07:57:06 Last Updated: 2024-08-04T15:49:06.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have insufficient permissions). Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-16