Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ttps://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P11 - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P4
CVE ID: CVE-2020-13654 State: PUBLISHED Published: 2020-12-31T00:00:00 Last Updated: 2024-08-04T12:25:16.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: XWiki Platform before 12.8 mishandles escaping in the property displayer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/pull/1315 - https://jira.xwiki.org/browse/XWIKI-17374 - https://github.com/xwiki/xwiki-platform/compare/xwiki-platform-12.7.1...xwiki-platform-12.8 - https://cve.nstsec.com/cve-2020-13654
CVE ID: CVE-2020-13655 State: PUBLISHED Published: 2020-08-31T14:19:03 Last Updated: 2024-08-04T12:25:16.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected. Additional Analyst Notes: - CVE Program Container: References: - http://www.collabtive.o-dyn.de/blog/ - https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-collabtive/
CVE ID: CVE-2020-13656 State: PUBLISHED Published: 2020-06-12T22:26:29 Last Updated: 2024-08-04T12:25:16.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write vulnerability that leads to both local and remote code (via RPC) execution. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/oob-to-rce-exploitation-of-the-hobbes-functional-interpreter
CVE ID: CVE-2020-13657 State: PUBLISHED Published: 2020-06-29T17:51:57 Last Updated: 2024-08-04T12:25:16.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard links. The vulnerability allows local users to take control of arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://forum.avast.com/index.php?topic=234638.0 - https://forum.avast.com/index.php?topic=232423.0
CVE ID: CVE-2020-13658 State: PUBLISHED Published: 2020-09-29T18:52:41 Last Updated: 2024-08-04T12:25:16.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.com/us/our-research/?research=Technical+advisories - https://research.nccgroup.com/2020/09/25/technical-advisory-lansweeper-privilege-escalation-via-csrf-using-http-method-interchange/
CVE ID: CVE-2020-13659 State: PUBLISHED Published: 2020-06-02T12:50:44 Last Updated: 2024-08-04T12:25:16.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg07313.html - http://www.openwall.com/lists/oss-security/2020/06/01/3 - https://security.netapp.com/advisory/ntap-20200608-0007/ - https://www.debian.org/security/2020/dsa-4728 - https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/202
://lists.debian.org/debian-lts-announce/2020/07/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html - https://usn.ubuntu.com/4467-1/ - https://security.gentoo.org/glsa/202011-09
CVE ID: CVE-2020-13660 State: PUBLISHED Published: 2020-05-28T18:53:25 Last Updated: 2024-08-04T12:25:16.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12312 - https://www.youtube.com/watch?v=Q6RMhmpScho
CVE ID: CVE-2020-13661 State: PUBLISHED Published: 2020-11-05T18:18:58 Last Updated: 2024-08-04T12:25:16.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by --utility-and-browser --utility-cmd-prefix= and the pathname of a locally installed program. The victim must interactively choose the Open On Browser option. Fixed in version 5.0.20204. Additional Analyst Notes: - CVE Program Container: References: - https://www.telerik.com/support/whats-new/release-history - https://www.nagenrauft-consulting.com/blog/ - https://www.telerik.com/sup
elerik.com/support/whats-new/release-history - https://www.nagenrauft-consulting.com/blog/ - https://www.telerik.com/support/whats-new/fiddler/release-history/fiddler-v5.0.20204
CVE ID: CVE-2020-13662 State: PUBLISHED Published: 2021-05-05T14:32:03 Last Updated: 2024-08-04T12:25:16.464Z Vendors: Drupal Products: Drupal Core Problem Types: Open Redirect Description: Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-003
CVE ID: CVE-2020-13663 State: PUBLISHED Published: 2021-06-11T15:07:25 Last Updated: 2024-08-04T12:25:16.134Z Vendors: Drupal Products: Drupal Core Problem Types: Cross Site Request Forgery Description: Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-004
CVE ID: CVE-2020-13664 State: PUBLISHED Published: 2021-05-05T14:56:39 Last Updated: 2024-08-04T12:25:16.209Z Vendors: Drupal Products: Drupal Core Problem Types: Arbitrary PHP code execution Description: Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1;
ely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-005
CVE ID: CVE-2020-13665 State: PUBLISHED Published: 2021-05-05T14:14:09 Last Updated: 2024-08-04T12:25:16.379Z Vendors: Drupal Products: Drupal Core Problem Types: Access bypass Description: Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-006
CVE ID: CVE-2020-13666 State: PUBLISHED Published: 2021-05-05T13:50:13 Last Updated: 2024-08-04T12:25:16.445Z Vendors: Drupal Products: Drupal Core Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-007
CVE ID: CVE-2020-13667 State: PUBLISHED Published: 2021-05-17T16:52:34 Last Updated: 2024-08-04T12:25:16.398Z Vendors: Drupal Products: Drupal Core Problem Types: Access bypass Description: Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects D
the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-008
CVE ID: CVE-2020-13668 State: PUBLISHED Published: 2022-02-11T15:15:14 Last Updated: 2024-08-04T12:25:16.423Z Vendors: Drupal Products: Core Problem Types: Access Bypass Description: Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-009
CVE ID: CVE-2020-13669 State: PUBLISHED Published: 2022-02-11T15:25:12 Last Updated: 2024-08-04T12:25:16.406Z Vendors: Drupal Products: Core Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-010
CVE ID: CVE-2020-13670 State: PUBLISHED Published: 2022-02-11T15:45:22 Last Updated: 2024-08-04T12:25:16.150Z Vendors: Drupal Products: Core Problem Types: Information Disclosure Description: Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-011
CVE ID: CVE-2020-13671 State: PUBLISHED Published: 2020-11-20T15:40:39.000Z Last Updated: 2025-10-21T23:35:32.528Z Vendors: Drupal Products: Drupal Core Problem Types: Remote code execution Description: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drup
rior to 7.74. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2020-012 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/
CVE ID: CVE-2020-13672 State: PUBLISHED Published: 2022-02-11T15:30:12 Last Updated: 2024-08-04T12:25:16.383Z Vendors: Drupal Products: Core Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2021-002
CVE ID: CVE-2020-13673 State: PUBLISHED Published: 2022-02-11T15:35:11 Last Updated: 2024-08-04T12:25:16.400Z Vendors: Drupal Products: Entity Embed Problem Types: CWE-352 Description: The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-contrib-2021-028
CVE ID: CVE-2020-13674 State: PUBLISHED Published: 2022-02-11T15:45:18 Last Updated: 2024-08-04T12:25:16.213Z Vendors: Drupal Products: Core Problem Types: CWE-352 Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2021-007
CVE ID: CVE-2020-13675 State: PUBLISHED Published: 2022-02-11T15:45:11 Last Updated: 2024-08-04T12:25:16.477Z Vendors: Drupal Products: Core Problem Types: CWE-284 Description: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2021-008
CVE ID: CVE-2020-13676 State: PUBLISHED Published: 2022-02-11T15:50:11 Last Updated: 2024-08-04T12:25:16.422Z Vendors: Drupal Products: Core Problem Types: CWE-284 Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2021-009
CVE ID: CVE-2020-13677 State: PUBLISHED Published: 2022-02-11T15:55:12 Last Updated: 2024-08-04T12:25:16.550Z Vendors: Drupal Products: Core Problem Types: CWE-284 Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2021-010
CVE ID: CVE-2020-13688 State: PUBLISHED Published: 2021-06-11T15:08:56 Last Updated: 2024-08-04T12:25:16.561Z Vendors: Drupal Products: Drupal Core Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2020-009
CVE ID: CVE-2020-13692 State: PUBLISHED Published: 2020-06-04T15:07:37 Last Updated: 2024-08-04T12:25:16.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65 - https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.13 - https://security.netapp.com/advisory/ntap-20200619-0005/ - https://lists.apache.org/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r7f6d019839df17646f
7e17305d8b8e7fb2ae63d2a3cbfb%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e%40%3Ccommits.camel.ap
E - https://lists.apache.org/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f%40%3Cnotifications.netbeans.apache.org%3E - https://lists.apache.org/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977%40%3Cnotifications.netbeans.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC/ - https://www.debian.org/se
es/list/package-announce%40lists.fedoraproject.org/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC/ - https://www.debian.org/security/2022/dsa-5196
CVE ID: CVE-2020-13693 State: PUBLISHED Published: 2020-05-28T23:54:26 Last Updated: 2024-08-04T12:25:16.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://codex.bbpress.org/releases/ - https://wordpress.org/plugins/bbpress/#developers - https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/ - http://packetstormsecurity.com/files/157885/WordPress-BBPress-2.5-Privilege-Escalation.html
CVE ID: CVE-2020-13694 State: PUBLISHED Published: 2020-06-01T15:19:45 Last Updated: 2024-08-04T12:25:16.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option. Additional Analyst Notes: - CVE Program Container: References: - https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
CVE ID: CVE-2020-13695 State: PUBLISHED Published: 2020-06-01T17:45:16 Last Updated: 2024-08-04T12:25:16.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file. Additional Analyst Notes: - CVE Program Container: References: - https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
CVE ID: CVE-2020-13696 State: PUBLISHED Published: 2020-06-08T16:32:54 Last Updated: 2024-08-04T12:25:16.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated by a v4l-conf -c /dev/../root/.bash
this, relative path components need to be added to the device path, as demonstrated by a v4l-conf -c /dev/../root/.bash_history command. Additional Analyst Notes: - CVE Program Container: References: - https://git.linuxtv.org/xawtv3.git/commit/?id=31f31f9cbaee7be806cba38e0ff5431bd44b20a3 - https://git.linuxtv.org/xawtv3.git/commit/?id=36dc44e68e5886339b4a0fbe3f404fb1a4fd2292 - https://git.linuxtv.org/xawtv3.git/commit/?id=8e3feea862db68d3ca0886f46cd99fab45d2db7c - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-13696 - http://www.openwall.com/lists/oss-security/2020/06/04/6 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00009.html - http://lists.opensuse.org/opensuse-s
04/6 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00013.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00018.html - https://usn.ubuntu.com/4518-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELOXU5LXQSQOXX64D4BICZV3TQWOBXHC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7XWAO7W2DGA6M52JGK2TDWUGF62Q2KY/
CVE ID: CVE-2020-13697 State: PUBLISHED Published: 2021-02-23T07:31:19 Last Updated: 2024-08-04T12:25:16.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NanoHttpd/nanohttpd - https://www.vdoo.co
ional Analyst Notes: - CVE Program Container: References: - https://github.com/NanoHttpd/nanohttpd - https://www.vdoo.com/advisories
CVE ID: CVE-2020-13699 State: PUBLISHED Published: 2020-07-29T15:36:06 Last Updated: 2024-08-04T12:25:16.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocal
werapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3. Additional Analyst Notes: - CVE Program Container: References: - https://community.teamviewer.com/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448 - https://jeffs.sh/CVEs/CVE-2020-13699.txt