Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-4044 State: PUBLISHED Published: 2020-06-30T15:55:13 Last Updated: 2024-08-04T07:52:20.840Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-121 Description: The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in p
ser credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j9fv-6fwf-p3g4 - https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.13.1 - https://github.com/neutrinolabs/xrdp/commit/0c791d073d0eb344ee7aaafd221513dc9226762c - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00036.html - https://www.debian.org/security/2020/dsa-
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00036.html - https://www.debian.org/security/2020/dsa-4737 - https://lists.debian.org/debian-lts-announce/2020/08/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00037.html
CVE ID: CVE-2020-4045 State: PUBLISHED Published: 2020-06-11T21:15:13 Last Updated: 2024-08-04T07:52:20.737Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ssbc Products: SSB-DB Problem Types: CWE-200 Description: SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known
access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1. Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ssbc/ssb-db/security/advisories/GHSA-mpgr-2cx9-327h - https://github.com/ssbc/ssb-db/commit/43334d0871c9cc6220e0f6d6338499060f7761d4
CVE ID: CVE-2020-4046 State: PUBLISHED Published: 2020-06-12T15:55:12 Last Updated: 2024-08-04T07:52:20.719Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-80 Description: In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.1
atched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rpwf-hrh2-39jf - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7
QHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/ - https://www.debian.org/security/2020/dsa-4709 - https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html
CVE ID: CVE-2020-4047 State: PUBLISHED Published: 2020-06-12T16:00:36 Last Updated: 2024-08-04T07:52:20.835Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-80 Description: In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15,
ersion 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8q2w-5m27-wm27 - https://github.com/WordPress/wordpress-develop/commit/0977c0d6b241479ecedfe19e96be69f727c3f81f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/ - https://www.debian.org/security/2020/dsa-4709 - https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
CVE ID: CVE-2020-4048 State: PUBLISHED Published: 2020-06-12T16:00:30 Last Updated: 2024-08-04T07:52:20.833Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-601 Description: In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). A
.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5 - https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBG
UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/ - https://www.debian.org/security/2020/dsa-4709 - https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
CVE ID: CVE-2020-4049 State: PUBLISHED Published: 2020-06-12T16:00:23 Last Updated: 2024-08-04T07:52:20.760Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-80 Description: In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22,
e previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-87h4-phjv-rm6p - https://github.com/WordPress/wordpress-develop/commit/404f397b4012fd9d382e55bf7d206c1317f01148 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/li
nounce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/ - https://www.debian.org/security/2020/dsa-4709 - https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
CVE ID: CVE-2020-4050 State: PUBLISHED Published: 2020-06-12T16:00:17 Last Updated: 2024-08-04T07:52:20.829Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-288 Description: In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.
g with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqc - https://github.com/WordPress/wordpress-develop/commit/b8dea76b495f0072523106c6ec46b9ea0d2a0920 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.or
st/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/ - https://www.debian.org/security/2020/dsa-4709 - https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
CVE ID: CVE-2020-4051 State: PUBLISHED Published: 2020-06-15T00:00:00 Last Updated: 2024-08-04T07:52:20.806Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Dojo Products: dijit Problem Types: CWE-79 Description: In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.1
ross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6 - https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20201023-0003/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
CVE ID: CVE-2020-4052 State: PUBLISHED Published: 2020-06-16T21:55:15 Last Updated: 2024-08-04T07:52:20.875Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Requarks.io Products: Wiki.js Problem Types: CWE-79 Description: In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other us
ross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj - https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3
CVE ID: CVE-2020-4053 State: PUBLISHED Published: 2020-06-16T22:00:19 Last Updated: 2024-08-04T07:52:20.934Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: The Helm Project Products: Helm Problem Types: CWE-22 Description: In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helm/helm/security/advisories/G
2.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helm/helm/security/advisories/GHSA-qq3j-xp49-j73f - https://github.com/helm/helm/commit/0ad800ef43d3b826f31a5ad8dfbb4fe05d143688 - https://github.com/helm/helm/releases/tag/v3.2.4
CVE ID: CVE-2020-4054 State: PUBLISHED Published: 2020-06-16T22:10:13 Last Updated: 2024-08-04T07:52:20.925Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: rgrove Products: Sanitize Problem Types: CWE-79 Description: In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom co
not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m - https://github.com/rgrove/sanitize/commit/a11498de
/github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m - https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9 - https://github.com/rgrove/sanitize/releases/tag/v5.2.1 - https://www.debian.org/security/2020/dsa-4730 - https://usn.ubuntu.com/4543-1/
CVE ID: CVE-2020-4059 State: PUBLISHED Published: 2020-06-18T19:25:15 Last Updated: 2024-08-04T07:52:20.928Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: mikaelbr Products: mversion Problem Types: CWE-77 Description: In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in npm. As a workaround, make sure to escape git commit messages when using the commitMessage option for the update function. Additional Analyst Notes: - CVE Program Container
messages when using the commitMessage option for the update function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mikaelbr/mversion/security/advisories/GHSA-qjg4-w4c6-f6c6 - https://github.com/mikaelbr/mversion/commit/6c76c9efd27c7ff5a5c6f187e8b7a435c4722338
CVE ID: CVE-2020-4060 State: PUBLISHED Published: 2020-06-22T15:45:15 Last Updated: 2024-08-04T07:52:20.843Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L) Vendors: LoRa Basics Products: LoRa Basics Station Problem Types: CWE-416 Description: In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message (https://doc.sm.tc/station/cupsproto.html#http-post-response) where the signature length is larger than 2 GByte (never happens in practice), or the response is crafted specifically to trigger this issue (i.e. the length signature field
ver happens in practice), or the response is crafted specifically to trigger this issue (i.e. the length signature field indicates a value larger than (2**31)-1 although the signature actually does not contain that much data). In such a scenario, on 32 bit machines, Basic Station would execute a code path, where a piece of memory is accessed after it has been freed, causing the process to crash and restarted again. The CUPS transaction is typically mutually authenticated over TLS. Therefore, in order to trigger this vulnerability, the attacker would have to gain access to the CUPS server first. If the user chose to operate without authentication over TLS but yet is concerned about this vulne
he CUPS server first. If the user chose to operate without authentication over TLS but yet is concerned about this vulnerability, one possible workaround is to enable TLS authentication. This has been fixed in 2.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lorabasics/basicstation/security/advisories/GHSA-v9ph-r496-4m2j
CVE ID: CVE-2020-4061 State: PUBLISHED Published: 2020-07-02T16:55:15 Last Updated: 2024-08-04T07:52:20.851Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: October CMS Products: October Problem Types: CWE-79 Description: In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-3pc2-fm7p-q2vg - https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 - ht
isories/GHSA-3pc2-fm7p-q2vg - https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 - https://research.securitum.com/the-curious-case-of-copy-paste/
CVE ID: CVE-2020-4062 State: PUBLISHED Published: 2020-06-22T15:20:16 Last Updated: 2024-08-04T07:52:20.924Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: CyberArk Products: Conjur OSS Helm Chart Problem Types: CWE-284 Description: In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, including escalating the attacker's privileges to assume full control. A malicious actor who knows the IP address and port number of the Postgres database and has access into the K
l control. A malicious actor who knows the IP address and port number of the Postgres database and has access into the Kubernetes cluster where Conjur runs can gain full read & write access to the Postgres database. This enables the attacker to write a policy that allows full access to retrieve any secret. This Helm chart is a method to install Conjur OSS into a Kubernetes environment. Hence, the systems impacted are only Conjur OSS systems that were deployed using this chart. Other deployments including Docker and the CyberArk Dynamic Access Provider (DAP) are not affected. To remediate this vulnerability, clone the latest Helm Chart and follow the upgrade instructions. If you are not able
. To remediate this vulnerability, clone the latest Helm Chart and follow the upgrade instructions. If you are not able to fully remediate this vulnerability immediately, you can mitigate some of the risk by making sure Conjur OSS is deployed on an isolated Kubernetes cluster or namespace. The term "isolated" refers to: - No other workloads besides Conjur OSS and its backend database are running in that Kubernetes cluster/namespace. - Kubernetes and helm access to the cluster/namespace is limited to security administrators via Role-Based Access Control (RBAC). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cyberark/conjur-oss-helm-chart/security/advisorie
alyst Notes: - CVE Program Container: References: - https://github.com/cyberark/conjur-oss-helm-chart/security/advisories/GHSA-mg2m-623j-wpxw - https://github.com/cyberark/conjur-oss-helm-chart/commit/2dab801ed4ab591c626fc6674f306fcf0d004c1e
CVE ID: CVE-2020-4066 State: PUBLISHED Published: 2020-06-22T15:25:13 Last Updated: 2024-08-04T07:52:20.926Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: erelsgl Products: Limdu Problem Types: CWE-78 Description: In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erelsgl/limdu/security/advisories/GHSA-77qv-gh6f-pgh4
CVE ID: CVE-2020-4067 State: PUBLISHED Published: 2020-06-29T19:55:13 Last Updated: 2024-08-04T07:52:20.848Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: coturn Products: coturn Problem Types: CWE-665 Description: In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3. Additional Analyst Notes: - CVE Program Container: References: - https