Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8559 State: PUBLISHED Published: 2020-07-22T13:47:08.684571Z Last Updated: 2024-09-16T17:58:15.587Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-601 Description: The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ -
Program Container: References: - https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ - https://github.com/kubernetes/kubernetes/issues/92914 - https://security.netapp.com/advisory/ntap-20200810-0004/
CVE ID: CVE-2020-8561 State: PUBLISHED Published: 2021-09-20T17:05:16.328714Z Last Updated: 2024-09-16T22:29:49.855Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-441 Description: A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs. Additional Analyst Notes: - CVE Program Container:
o 10, they can view the redirected responses and headers in the logs. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY - https://github.com/kubernetes/kubernetes/issues/104720 - https://security.netapp.com/advisory/ntap-20211014-0002/
CVE ID: CVE-2020-8562 State: PUBLISHED Published: 2022-02-01T10:33:00.317144Z Last Updated: 2024-09-16T17:08:37.065Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-367 Description: As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kube
check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/101493 - https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY - https://security.netapp.com/advisory/ntap-20220225-0002/
CVE ID: CVE-2020-8563 State: PUBLISHED Published: 2020-12-07T22:00:25.689659Z Last Updated: 2024-09-16T17:18:26.773Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-532 Description: In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/95621 - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - https://security.netapp
s/95621 - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - https://security.netapp.com/advisory/ntap-20210122-0006/
CVE ID: CVE-2020-8564 State: PUBLISHED Published: 2020-12-07T22:00:22.445619Z Last Updated: 2024-09-16T17:32:40.199Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-532 Description: In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - h
rogram Container: References: - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - https://github.com/kubernetes/kubernetes/issues/95622 - https://security.netapp.com/advisory/ntap-20210122-0006/
CVE ID: CVE-2020-8565 State: PUBLISHED Published: 2020-12-07T22:00:19.374983Z Last Updated: 2024-09-17T00:05:58.669Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-532 Description: In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - https://github.c
r: References: - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - https://github.com/kubernetes/kubernetes/issues/95623
CVE ID: CVE-2020-8566 State: PUBLISHED Published: 2020-12-07T22:00:16.139583Z Last Updated: 2024-09-16T20:17:09.853Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-532 Description: In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxA
s: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ - https://github.com/kubernetes/kubernetes/issues/95624 - https://security.netapp.com/advisory/ntap-20210122-0006/
CVE ID: CVE-2020-8567 State: PUBLISHED Published: 2021-01-21T17:09:21.322492Z Last Updated: 2024-09-16T18:23:40.732Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Kubernetes Products: Kubernetes Secrets Store CSI Driver Problem Types: CWE-24 Description: Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-secrets-
t/pods. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY - https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
CVE ID: CVE-2020-8568 State: PUBLISHED Published: 2021-01-21T17:09:21.450754Z Last Updated: 2024-09-17T03:28:40.493Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Secrets Store CSI Driver Problem Types: CWE-24, CWE-20 Description: Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets. Additional Analyst Notes: - CVE Program Container: References: - https:/
let/pods that contain other Kubernetes Secrets. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4 - https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378
CVE ID: CVE-2020-8569 State: PUBLISHED Published: 2021-01-21T17:09:21.567240Z Last Updated: 2024-09-17T01:47:07.863Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Kubernetes Products: CSI Snapshotter Problem Types: CWE-476 Description: Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an en
tically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/1EzCr1qUxxU - https://github.com/kubernetes-csi/external-snapshotter/issues/380
CVE ID: CVE-2020-8570 State: PUBLISHED Published: 2021-01-21T17:09:21.689060Z Last Updated: 2024-09-16T22:01:55.884Z Vendors: Kubernetes Products: Kubernetes Java Client Problem Types: CWE-23 Description: Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrg - https://github.com/kubernetes-client/
rences: - https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrg - https://github.com/kubernetes-client/java/issues/1491 - https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2020-8571 State: PUBLISHED Published: 2020-03-13T15:10:08 Last Updated: 2024-08-04T10:03:46.377Z Vendors: NetApp Products: StorageGRID (formerly StorageGRID Webscale) Problem Types: Privilege Escalation Description: StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20200313-0005/
CVE ID: CVE-2020-8572 State: PUBLISHED Published: 2020-05-21T14:23:00 Last Updated: 2024-08-04T10:03:45.956Z Vendors: n/a Products: Sensitive Information Disclosure Vulnerability in Element OS and Element HealthTools Problem Types: Information Disclosure Description: Element OS prior to version 12.0 and Element HealthTools prior to version 2020.04.01.04 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20200520-0001/
CVE ID: CVE-2020-8573 State: PUBLISHED Published: 2020-06-29T14:00:38 Last Updated: 2024-08-04T10:03:45.787Z Vendors: NetApp Products: NetApp HCI Baseboard Management Controller (BMC) HCI H610C, NetApp HCI Baseboard Management Controller (BMC) HCI H615C, NetApp HCI Baseboard Management Controller (BMC) HCI H610S Problem Types: Default Credential Description: The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is r
.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20200626-0001/
CVE ID: CVE-2020-8574 State: PUBLISHED Published: 2020-08-03T16:56:55 Last Updated: 2024-08-04T10:03:46.227Z Vendors: n/a Products: Active IQ Unified Manager for Linux 7.3 and above Problem Types: Unauthorized Code Execution Description: Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service enabled allowing unauthorized code execution to local users. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20200803-0001/
CVE ID: CVE-2020-8575 State: PUBLISHED Published: 2020-08-03T16:55:52 Last Updated: 2024-08-04T10:03:45.981Z Vendors: n/a Products: Active IQ Unified Manager for VMware vSphere and Windows 7.3 and above Problem Types: Denial of Service (DoS) Description: Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20200803-0002/
CVE ID: CVE-2020-8576 State: PUBLISHED Published: 2020-09-02T19:15:35 Last Updated: 2024-08-04T10:03:46.177Z Vendors: n/a Products: Clustered Data ONTAP Problem Types: Sensitive Information Disclosure Description: Clustered Data ONTAP versions prior to 9.3P19, 9.5P14, 9.6P9 and 9.7 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20200902-0001/
CVE ID: CVE-2020-8577 State: PUBLISHED Published: 2020-11-06T16:03:21 Last Updated: 2024-08-04T10:03:46.228Z Vendors: n/a Products: E-Series SANtricity OS Controller Software Problem Types: Sensitive Information Disclosure Description: SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20201105-0001/
CVE ID: CVE-2020-8578 State: PUBLISHED Published: 2021-02-08T21:38:38 Last Updated: 2024-08-04T10:03:46.203Z Vendors: n/a Products: Clustered Data ONTAP Problem Types: Disclosure of sensitive information Description: Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles even when the –remove-private-data parameter is set to true. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20210208-0002/
CVE ID: CVE-2020-8579 State: PUBLISHED Published: 2020-10-27T13:47:21 Last Updated: 2024-08-04T10:03:46.266Z Vendors: n/a Products: clustered Data ONTAP Problem Types: Denial of Service Description: Clustered Data ONTAP versions 9.7 through 9.7P7 are susceptible to a vulnerability which allows an attacker with access to an intercluster LIF to cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20201026-0001
CVE ID: CVE-2020-8580 State: PUBLISHED Published: 2020-11-06T15:58:43 Last Updated: 2024-08-04T10:03:46.376Z Vendors: n/a Products: E-Series SANtricity OS Controller Software Problem Types: Denial of Service Description: SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with access to the system to cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20201105-0002/
CVE ID: CVE-2020-8581 State: PUBLISHED Published: 2021-01-19T17:04:11 Last Updated: 2024-08-04T10:03:46.240Z Vendors: n/a Products: Clustered Data ONTAP Problem Types: Unauthorized Modification Description: Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorized attacker to overwrite arbitrary data when VMware vStorage support is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20210119-0001/
CVE ID: CVE-2020-8582 State: PUBLISHED Published: 2020-11-13T15:16:24 Last Updated: 2024-08-04T10:03:46.215Z Vendors: n/a Products: NetApp SolidFire & HCI Storage Node (Element Software) Problem Types: Disclosure Of Sensitive Information Description: Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20201113-0007/
CVE ID: CVE-2020-8583 State: PUBLISHED Published: 2020-11-13T15:14:36 Last Updated: 2024-08-04T10:03:46.248Z Vendors: n/a Products: NetApp SolidFire & HCI Storage Node (Element Software) ) Problem Types: Disclosure Of Sensitive Information Description: Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20201113-0008/
CVE ID: CVE-2020-8584 State: PUBLISHED Published: 2021-01-08T15:19:37 Last Updated: 2024-08-04T10:03:46.231Z Vendors: n/a Products: Element OS Problem Types: Arbitrary Code Execution Description: Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perform arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20210108-0008/
CVE ID: CVE-2020-8585 State: PUBLISHED Published: 2021-01-28T21:00:20 Last Updated: 2024-08-04T10:03:46.181Z Vendors: n/a Products: OnCommand Unified Manager for 7-Mode (core package) Problem Types: Information Disclosure Description: OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plink). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20210128-0001/ - https://security.netapp.com/advisory/NTAP-20210128-0001
CVE ID: CVE-2020-8586 State: REJECTED Published: 2022-09-06T17:19:09 Last Updated: 2022-09-06T17:19:09 Description: No description available.
CVE ID: CVE-2020-8587 State: PUBLISHED Published: 2021-02-08T21:36:20 Last Updated: 2024-08-04T10:03:46.079Z Vendors: n/a Products: OnCommand System Manager 9.x Problem Types: Disclosure of sensitive information Description: OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache sensitive responses making them accessible to an attacker who has access to the system where the client runs. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20210208-0001/
CVE ID: CVE-2020-8588 State: PUBLISHED Published: 2021-02-03T17:33:11 Last Updated: 2024-08-04T10:03:45.933Z Vendors: n/a Products: Clustered Data ONTAP Problem Types: Disclosure of sensitive information Description: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the existence of data on other Storage Virtual Machines (SVMs). Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20210201-0001/
CVE ID: CVE-2020-8589 State: PUBLISHED Published: 2021-02-03T17:35:47 Last Updated: 2024-08-04T10:03:46.121Z Vendors: n/a Products: Clustered Data ONTAP Problem Types: Disclosure of sensitive information Description: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the names of other Storage Virtual Machines (SVMs) and filenames on those SVMs. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20210201-0002/
CVE ID: CVE-2020-8590 State: PUBLISHED Published: 2021-02-08T21:40:43 Last Updated: 2024-08-04T10:03:46.214Z Vendors: n/a Products: Clustered Data ONTAP Problem Types: Disclosure of sensitive information Description: Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles even when the –remove-private-data parameter is set to true. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20210208-0003/
CVE ID: CVE-2020-8591 State: PUBLISHED Published: 2020-02-03T20:05:55 Last Updated: 2024-08-04T10:03:46.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request. Additional Analyst Notes: - CVE Program Container: References: - https://pyaefromucsp.blogspot.com/2020/02/eg-manager-v712improper-access-control_3.html
CVE ID: CVE-2020-8592 State: PUBLISHED Published: 2020-02-03T20:05:40 Last Updated: 2024-08-04T10:03:46.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature). Additional Analyst Notes: - CVE Program Container: References: - https://pyaefromucsp.blogspot.com/2020/02/eg-manager-v712-sql-injection-lead-to_56.html
CVE ID: CVE-2020-8594 State: PUBLISHED Published: 2020-02-14T19:01:36 Last Updated: 2024-08-04T10:03:46.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format]. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/#developers - https://spider-security.co.uk/blog-cve-cve-2020-8594 - https://wpvulndb.com/vulnerabilities/10070