Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-1931 State: PUBLISHED Published: 2020-01-30T17:38:42 Last Updated: 2024-08-04T06:53:59.924Z Vendors: Apache Software Foundation Products: Apache SpamAssassin Problem Types: Local & Remote Command Execution Description: A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficul
hically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. Additional Analyst Notes: - CVE Program Container: References: - https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784 - https://www.debian.org/security/2020/dsa-4615 - https://seclists.org/bugtraq/2020/Feb/1 - https://usn.ubuntu.com/4265-1/ - https://usn.ubuntu.com/4265-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/ - https://lists.fedorap
chives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/ - https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html
CVE ID: CVE-2020-1932 State: PUBLISHED Published: 2020-01-28T00:38:15 Last Updated: 2024-08-04T06:54:00.326Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: Information Disclosure Description: An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r4e5323c3bc786005495311a6ff53ac6d990b2c7eb52941a1a13ce227%40%3Cdev.superset.apache.org%3E
CVE ID: CVE-2020-1933 State: PUBLISHED Published: 2020-01-28T00:33:32 Last Updated: 2024-08-04T06:54:00.368Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: XSS Attack Description: A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2020-1933
CVE ID: CVE-2020-1934 State: PUBLISHED Published: 2020-04-01T19:22:23 Last Updated: 2024-08-04T06:54:00.049Z Vendors: Apache Products: Apache HTTP Server Problem Types: mod_proxy_ftp use of uninitialized value Description: In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/
75306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210%40%3Ccvs.httpd.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20200413-0002/ - https://usn.ubuntu.com/4458-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/ - https://www.debian.org/security/2020/dsa-4757 - https://lists.fedoraproj
org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/ - https://www.debian.org/security/2020/dsa-4757 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/ - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0
Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r26706
6d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
CVE ID: CVE-2020-1935 State: PUBLISHED Published: 2020-02-24T21:11:38 Last Updated: 2024-08-04T06:53:59.921Z Vendors: Apache Products: Apache Tomcat Problem Types: HTTP Request Smuggling Description: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. Additional Analyst Notes: - CVE Program Container: References: - htt
anner. Such a reverse proxy is considered unlikely. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html - https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E - https://www.debian.org/security/2020/dsa-4673
d94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E - https://www.debian.org/security/2020/dsa-4673 - https://www.debian.org/security/2020/dsa-4680 - https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200327-0005/ - https://lists.apache.org/thread.html/r441c1f30a252bf14b07396286f6abd8089ce4240e91323211f1a2d75%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r660cd379afe346f10d72c0eaa8459ccc95d83aff181671b7e9076919%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rd547be0c9d821b4b1000a694b8e58ef9f5e2d66db03a31df
40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rd547be0c9d821b4b1000a694b8e58ef9f5e2d66db03a31dfe77c4b18%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/ra5dee390ad2d60307b8362505c059cd6a726de4d146d63dfce1e05e7%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r80e9c8417c77d52c62809168b96912bda70ddf7748f19f8210f745b1%40%3Cusers.tomcat.apache.org%3E - https://usn.ubuntu.com/4448-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/r9ce7918faf347e7aac32be930bf26c233b0b140fe37af0bb294158b6%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2020-1936 State: PUBLISHED Published: 2021-03-02T09:00:22.000Z Last Updated: 2025-02-13T16:27:39.386Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: CWE-79 Description: A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/946a9d72e664ad8bc592168d9a2fed88100c6e9f1bdfea08e91a3184%40%3Cuser.ambari.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/03/02/1
CVE ID: CVE-2020-1937 State: PUBLISHED Published: 2020-02-24T20:57:52 Last Updated: 2024-08-04T06:53:59.800Z Vendors: Apache Products: Apache Kylin Problem Types: SQL injection Description: Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E - https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E - https://lists.apache.org/thread.html/r021
8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
CVE ID: CVE-2020-1938 State: PUBLISHED Published: 2020-02-24T21:19:18.000Z Last Updated: 2025-10-21T23:35:50.835Z Vendors: Apache Products: Apache Tomcat Problem Types: AJP Request Injection leading to possible Remote Code Execution Description: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default tha
t 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a fi
ble to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to t
figuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600f
152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.t
che.org%3E - https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r7723
8e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html - https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r61f
387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tome
he.org%3E - https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html - https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E - https://security.gentoo.org/glsa/202003-43 - https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf992c5adf376294af31
04750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSH
YD53B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/ - https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html - https://www.debian.org/security/2020/dsa-4673 - https://www.debian.org/security/2020/dsa-4680 - https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html - https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0
08022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200226-0002/ - http://support.blackberry.com/kb/articleDetail?articleNumber=000062739 - https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f0
edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E - htt
lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
CVE ID: CVE-2020-1939 State: PUBLISHED Published: 2020-05-12T14:57:55 Last Updated: 2024-08-04T06:54:00.344Z Vendors: n/a Products: Apache NuttX (incubating) Problem Types: NULL Pointer Dereference Description: The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re3adc65ff4d8d9c34e5bcc
ional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re3adc65ff4d8d9c34e5bccba3941a28cbb0a47191c150df2727e101d%40%3Cdev.nuttx.apache.org%3E
CVE ID: CVE-2020-1940 State: PUBLISHED Published: 2020-01-28T16:51:10 Last Updated: 2024-08-04T06:53:59.869Z Vendors: Apache Software Foundation Products: Apache Jackrabbit Oak Problem Types: Information Disclosure Description: The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new pass
the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rccc0ed467faa35734ea16b8f5de5603e708936c41a4eddd90fddeaf0%40%3Cusers.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rccc0ed467faa35734ea16b8f5de5603e708936c41a4eddd90fddeaf0%40%3Cannounce.jackrabbit.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/01/28/1 - https://lists.apache.org/thread.html/r45b0e2fb6ac51c5a03952b08b5e0efde1249ecb809884cc87eb0bd99%40%3Ccommits.jackrabbit.apache.org%3E - https://lists.apache.org/thread
6ac51c5a03952b08b5e0efde1249ecb809884cc87eb0bd99%40%3Ccommits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rb3023cfd45441b570c1abaa347d0cac78df97b5d3f27d674d01b3d2a%40%3Ccommits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/ra6b3e78f5ed545c1d859d664f66c6d3fc5d731d9b1d842349654e4f0%40%3Ccommits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/ra295f919586b19def7cc7713d9d78595507d5f703362fccb779eeeb9%40%3Coak-commits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/r601637e38ee743e845856a4e24915cb8db26ae80ca782bef91989cbc%40%3Coak-commits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rc35a57ecdeae342d46f729d6b
2bef91989cbc%40%3Coak-commits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rc35a57ecdeae342d46f729d6bc9750ba860c101f450cc171798dba28%40%3Coak-commits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rbef4701b5ce4d827182e70ad7b4d987a9157682ba3643e05a9ef5a7b%40%3Ccommits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/r3da8e2fd253ecd4d3a0de71ce255631148b54be8500225b5812f7737%40%3Coak-commits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rba884dbe733781cbaaffa28b77bc37a6a9f948b3a72a1bdad5e1587c%40%3Ccommits.jackrabbit.apache.org%3E
CVE ID: CVE-2020-1941 State: PUBLISHED Published: 2020-05-14T16:29:26 Last Updated: 2024-08-04T06:54:00.336Z Vendors: n/a Products: Apache ActiveMQ Problem Types: XSS Description: In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2020.html - http://activemq.apache.org/security-advisories.data/CVE-2020-1941-announcement.txt - https://lists.apache.org/thread.html/re4672802b0e5ed67c08c9e77057d52138e062f77cc09581b723cf95a%40%3Ccommits.activemq.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html