Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15050 State: PUBLISHED Published: 2020-07-13T20:16:58 Last Updated: 2024-08-04T13:08:21.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.supremainc.com/en/support/biostar-2-pakage.asp - http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html
CVE ID: CVE-2020-15051 State: PUBLISHED Published: 2020-07-15T20:02:29 Last Updated: 2024-08-04T13:08:21.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Address, Group Name, MYSQL Server, Database, MYSQL Username, Group Name, and Task Description fields. Additional Analyst Notes: - CVE Program Container: References: - http://artica-proxy.com/telechargements/ - https://github.com/pratikshad19/CVE-2020-15051
CVE ID: CVE-2020-15052 State: PUBLISHED Published: 2020-07-20T16:37:56 Last Updated: 2024-08-04T13:08:21.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pratikshad19/CVE-2020-15052
CVE ID: CVE-2020-15053 State: PUBLISHED Published: 2020-07-20T16:38:03 Last Updated: 2024-08-04T13:08:21.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pratikshad19/CVE-2020-15053
CVE ID: CVE-2020-15054 State: PUBLISHED Published: 2020-08-07T21:14:13 Last Updated: 2024-08-04T13:08:21.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15055 State: PUBLISHED Published: 2020-08-07T21:16:57 Last Updated: 2024-08-04T13:08:21.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15056 State: PUBLISHED Published: 2020-08-07T21:18:41 Last Updated: 2024-08-04T13:08:21.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15057 State: PUBLISHED Published: 2020-08-07T21:20:01 Last Updated: 2024-08-04T13:08:21.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to denial-of-service the device via long input values. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15058 State: PUBLISHED Published: 2020-08-07T21:21:06 Last Updated: 2024-08-04T13:08:21.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15059 State: PUBLISHED Published: 2020-08-07T21:22:04 Last Updated: 2024-08-04T13:08:21.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15060 State: PUBLISHED Published: 2020-08-07T21:22:51 Last Updated: 2024-08-04T13:08:21.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15061 State: PUBLISHED Published: 2020-08-07T21:23:37 Last Updated: 2024-08-04T13:08:22.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15062 State: PUBLISHED Published: 2020-08-07T21:24:52 Last Updated: 2024-08-04T13:08:21.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15063 State: PUBLISHED Published: 2020-08-07T21:26:05 Last Updated: 2024-08-04T13:08:22.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15064 State: PUBLISHED Published: 2020-08-07T21:27:00 Last Updated: 2024-08-04T13:08:21.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15065 State: PUBLISHED Published: 2020-08-07T21:27:49 Last Updated: 2024-08-04T13:08:21.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to denial-of-service the device via long input values. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2020/05/critical-vulnerabilites-in-multiple-usb-network-servers/
CVE ID: CVE-2020-15069 State: PUBLISHED Published: 2020-06-29T17:30:18.000Z Last Updated: 2025-10-21T23:35:41.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal
CVE ID: CVE-2020-15070 State: PUBLISHED Published: 2020-08-21T04:28:55 Last Updated: 2024-08-04T13:08:21.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2020/06/26/zulip-server-2-1-7-security-release/
CVE ID: CVE-2020-15071 State: PUBLISHED Published: 2020-08-11T17:24:08 Last Updated: 2024-08-04T13:08:21.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symphonycms/symphonycms/issues/2917
CVE ID: CVE-2020-15072 State: PUBLISHED Published: 2020-07-08T19:24:34 Last Updated: 2024-08-04T13:08:21.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. Additional Analyst Notes: - CVE Program Container: References: - https://www.phplist.org/newslist/phplist-3-5-5-release-notes/ - https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377 - https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html
CVE ID: CVE-2020-15073 State: PUBLISHED Published: 2020-07-08T19:22:07 Last Updated: 2024-08-04T13:08:21.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section. Additional Analyst Notes: - CVE Program Container: References: - https://www.phplist.org/newslist/phplist-3-5-5-release-notes/ - https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377 - https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html
CVE ID: CVE-2020-15074 State: PUBLISHED Published: 2020-07-14T17:27:31 Last Updated: 2024-08-04T13:08:21.889Z Vendors: n/a Products: OpenVPN Access Server Problem Types: CWE-302 Description: OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp. Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-server-resources/release-notes/
CVE ID: CVE-2020-15075 State: PUBLISHED Published: 2021-03-30T13:38:02 Last Updated: 2024-08-04T13:08:21.419Z Vendors: n/a Products: OpenVPN Connect Problem Types: CWE-61 Description: OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp. Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
CVE ID: CVE-2020-15076 State: PUBLISHED Published: 2021-05-26T18:17:57 Last Updated: 2024-08-04T13:08:21.820Z Vendors: n/a Products: Private Tunnel Problem Types: CWE-61 Description: Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp. Additional Analyst Notes: - CVE Program Container: References: - https://swupdate.openvpn.net/downloads/privatetunnel/changelog.txt
CVE ID: CVE-2020-15077 State: PUBLISHED Published: 2021-06-04T10:42:01 Last Updated: 2024-08-04T13:08:21.878Z Vendors: n/a Products: OpenVPN Access Server Problem Types: CWE-305 Description: OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks. Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-server-resources/release-notes/ - https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077/
CVE ID: CVE-2020-15078 State: PUBLISHED Published: 2021-04-26T13:19:45 Last Updated: 2024-08-04T13:08:21.675Z Vendors: n/a Products: OpenVPN Problem Types: CWE-305 Description: OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.or
XEYHUPREEBPX23VPEKMFXUPVO3PMU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/ - https://community.openvpn.net/openvpn/wiki/CVE-2020-15078 - https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/ - https://security.gentoo.org/glsa/202105-25 - https://usn.ubuntu.com/usn/usn-4933-1 - https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
CVE ID: CVE-2020-15079 State: PUBLISHED Published: 2020-07-02T16:45:24 Last Updated: 2024-08-04T13:08:21.404Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-284 Description: In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The problem is fixed in version 1.7.6.6 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xp3x-3h8q-c386 - https://github.com/PrestaShop/PrestaShop/commit/8833d9504cc5d69a2a6d10197f56f0c11443cbfa
CVE ID: CVE-2020-15080 State: PUBLISHED Published: 2020-07-02T16:45:19 Last Updated: 2024-08-04T13:08:21.779Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-200 Description: In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure `composer.json` and `docker-compose.yml` are not accessible on your server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-492w-2
t Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-492w-2pp5-xhvg - https://github.com/PrestaShop/PrestaShop/commit/35ef7e9d892287c302df1fc5aa05ecfc6f15bc76
CVE ID: CVE-2020-15081 State: PUBLISHED Published: 2020-07-02T16:45:13 Last Updated: 2024-08-04T13:08:21.739Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-548 Description: In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-997j-f42g-x57c - https://github.com/PrestaShop/PrestaShop/commit/bac9ea6936b0
taShop/PrestaShop/security/advisories/GHSA-997j-f42g-x57c - https://github.com/PrestaShop/PrestaShop/commit/bac9ea6936b073f84b1abd9864317af3713f1901
CVE ID: CVE-2020-15082 State: PUBLISHED Published: 2020-07-02T16:50:17 Last Updated: 2024-08-04T13:08:21.807Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: PrestaShop Products: PrestaShop Problem Types: https://cwe.mitre.org/data/definitions/15.html Description: In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mc98-xjm3-c4fm - https://github.com/PrestaShop/PrestaShop/commit/0f0d6238169a79d94f5ef28d24e60a9be8902f4b
CVE ID: CVE-2020-15083 State: PUBLISHED Published: 2020-07-02T16:50:12 Last Updated: 2024-08-04T13:08:21.621Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-qgh4-95j7-p3vj - https://github.com/PrestaShop/PrestaShop/commit/bac749bf75a4e0d6312a70b37eb5b0a556f08fbd
CVE ID: CVE-2020-15084 State: PUBLISHED Published: 2020-06-30T16:10:12 Last Updated: 2024-08-04T13:08:21.793Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: auth0 Products: express-jwt Problem Types: CWE-285 Description: In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt confi
wing conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf - https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef
CVE ID: CVE-2020-15085 State: PUBLISHED Published: 2020-06-30T16:25:13 Last Updated: 2024-08-04T13:08:22.044Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: mirumee Products: saleor-storefront Problem Types: CWE-312 Description: In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0 persisted the cache even after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (brow
ven after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (browser's local storage) after logging into Saleor Storefront. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirumee/saleor-storefront/security/advisories/GHSA-4279-h39w-2jqm - https://github.com/mirumee/saleor-storefront/blob/master/CHANGELOG.md#2103 - https://github.com/mirumee/saleor-storefront/commit/7c331e1be805022c9a7be719bd69d050b2577458
CVE ID: CVE-2020-15086 State: PUBLISHED Published: 2020-07-29T16:15:30 Last Updated: 2024-08-04T13:08:21.669Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FriendsOfTYPO3 Products: mediace Problem Types: CWE-20, CWE-325, CWE-502, CWE-200 Description: In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access t
n code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FriendsOfTYPO3/mediace/security/advisories/GHSA-4h44-w6fm-548g - https://github.com/FriendsOfTYPO3/mediace/commit/fa29ffd3e8b275782a8600d2406e1b1e5e16ae75 - https://github.com/FriendsOfTYPO3/mediace/pull/31
CVE ID: CVE-2020-15087 State: PUBLISHED Published: 2020-06-30T16:35:15 Last Updated: 2024-08-04T13:08:21.726Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: prestosql Products: Presto Problem Types: CWE-285 Description: In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure. This only affects Presto server installations. This does NOT affect clients such as the CLI or JDBC d
herently insecure. This only affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver. This vulnerability has been fixed in version 337. Additionally, this issue can be mitigated by blocking network access to internal APIs on the coordinator and workers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96 - https://trino.io/docs/current/release/release-337.html#security-changes
CVE ID: CVE-2020-15091 State: PUBLISHED Published: 2020-07-02T17:05:15 Last Updated: 2024-08-04T13:08:21.884Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tendermint Products: tendermint Problem Types: CWE-347 Description: TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it (**without changing chainID**). A malicious block proposer (even with a minimal amount of stake) can use this vulnerability to completely halt the network. This issue is fixed in Tendermint 0.33.6 which checks all the signatur
his vulnerability to completely halt the network. This issue is fixed in Tendermint 0.33.6 which checks all the signatures are for the block with 2/3+ majority before creating a commit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tendermint/tendermint/security/advisories/GHSA-6jqj-f58p-mrw3 - https://github.com/tendermint/tendermint/issues/4926 - https://github.com/tendermint/tendermint/commit/480b995a31727593f58b361af979054d17d84340