Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-17477 State: PUBLISHED Published: 2023-10-26T00:00:00 Last Updated: 2024-09-10T16:32:50.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP password hashes (sambaNTPassword, krb5Key, sambaPasswordHistory, and pwhistory) via LDAP search requests. For example, a teacher can gain administrator access via an NTLM hash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forge.univention.org/bugzilla/show_bug.cgi?id=50669
CVE ID: CVE-2020-17478 State: PUBLISHED Published: 2020-08-10T17:23:36 Last Updated: 2024-08-04T14:00:47.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FGasper/p5-Crypt-Perl/compare/0.32...0.33
CVE ID: CVE-2020-17479 State: PUBLISHED Published: 2020-08-10T19:20:05 Last Updated: 2024-08-04T14:00:47.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/jpv - https://github.com/manvel-khnkoyan/jpv/issues/10 - https://github.com/manvel-khnkoyan/jpv/commit/e3eec1215caa8d5c560f5e88d0943422831927d6 - https://blog.sonatype.com/cve-2020-17479
CVE ID: CVE-2020-17480 State: PUBLISHED Published: 2020-08-10T19:34:35 Last Updated: 2024-08-04T14:00:47.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95 - https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes
CVE ID: CVE-2020-17482 State: PUBLISHED Published: 2020-10-02T08:21:09 Last Updated: 2024-08-04T14:00:47.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PowerDNS/pdns - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html - https://security.gentoo.org/glsa/202012-18
CVE ID: CVE-2020-17483 State: PUBLISHED Published: 2023-12-16T00:00:00 Last Updated: 2024-08-04T14:00:47.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have been deployed. Additional Analyst Notes: - CVE Program Container: References: - https://www.uffizio.com/ - https://www.cisa.gov/news-events/ics-advisories/icsa-21-287-02
CVE ID: CVE-2020-17484 State: PUBLISHED Published: 2023-12-16T00:00:00 Last Updated: 2024-08-04T14:00:47.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain. Additional Analyst Notes: - CVE Program Container: References: - https://www.uffizio.com/ - https://www.cisa.gov/news-events/ics-advisories/icsa-21-287-02
CVE ID: CVE-2020-17485 State: PUBLISHED Published: 2023-12-16T00:00:00 Last Updated: 2024-08-04T14:00:47.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources Additional Analyst Notes: - CVE Program Container: References: - https://www.uffizio.com/ - https://www.cisa.gov/news-events/ics-advisories/icsa-21-287-02
CVE ID: CVE-2020-17487 State: PUBLISHED Published: 2020-08-11T19:43:59 Last Updated: 2024-08-04T14:00:47.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radareorg/radare2/issues/17431 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45SGGCWFIIV7N2X2QZRREHOW7ODT3IH7/ - https://lists.fedoraproject.org/archives/list/package-an
s.fedoraproject.org/message/45SGGCWFIIV7N2X2QZRREHOW7ODT3IH7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJET3RR6W7LAK4H6VPTMAZS24W7XYHRZ/
CVE ID: CVE-2020-17489 State: PUBLISHED Published: 2020-08-11T20:07:26 Last Updated: 2024-08-04T14:00:47.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.) Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gnome-shell/-/i
vealed.) Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2997 - https://usn.ubuntu.com/4464-1/ - https://security.gentoo.org/glsa/202009-08 - https://lists.debian.org/debian-lts-announce/2020/09/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00028.html
CVE ID: CVE-2020-17490 State: PUBLISHED Published: 2020-11-06T07:29:11 Last Updated: 2024-08-04T14:00:47.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release - https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ - http://lists.opensuse.org/opensuse-security-annou
%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html - https://security.gentoo.org/glsa/202011-13 - https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html - https://www.debian.org/security/2021/dsa-4837
CVE ID: CVE-2020-17494 State: PUBLISHED Published: 2020-11-12T20:42:40 Last Updated: 2024-08-04T14:00:47.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untangle Firewall NG before 16.0 uses MD5 for passwords. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/untangle/ngfw_src/blob/1d232efe2c17a8838b59bbbeaf166dafa94676af/uvm/hier/usr/share/untangle/web/auth/index.py#L196-L200 - https://github.com/untangle/ngfw_src/search?q=author%3Abmastbergen+committer-date%3A2020-08-10&type=commits - https://wiki.untangle.com/index.php/16.0.0_-_16.0.1_Changelog - https://pastebin.com/s7UYG3vX
CVE ID: CVE-2020-17495 State: PUBLISHED Published: 2020-08-11T20:54:27 Last Updated: 2024-08-04T14:00:47.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/celery/django-celery-results/issues/142
CVE ID: CVE-2020-17496 State: PUBLISHED Published: 2020-08-12T13:07:58.000Z Last Updated: 2025-10-21T23:35:38.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/78.html - https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/444
ulletin-a-tale-of-patch-fail/ - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch - https://seclists.org/fulldisclosure/2020/Aug/5
CVE ID: CVE-2020-17497 State: PUBLISHED Published: 2020-08-12T15:15:02 Last Updated: 2024-08-04T14:00:48.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4. Additional Analyst Notes: - CVE Program Container: References: - https://lists.01.org/hyperkitty/list/iwd%40lists.01.org/thread/4GUXL4Z6KZWWZINATGHNJVAEUTS3I7PG/
CVE ID: CVE-2020-17498 State: PUBLISHED Published: 2020-08-13T15:55:21 Last Updated: 2024-08-04T14:00:47.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ4 decompression. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16672 - https://www.wireshark.org/security/wnpa-sec-2020-10.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=76afda963de4f0b9be24f2d8e873990a5cbf221b - https://security.gentoo.org/glsa/202008-14 - https://lis
k.git%3Ba=commit%3Bh=76afda963de4f0b9be24f2d8e873990a5cbf221b - https://security.gentoo.org/glsa/202008-14 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7LO7DAPN33FL4JQ7DDPB76SIEFGMZSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AII7UYDPNKYE75AZL45M6HAV2COP7F6S/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html - https://www.oracle.com/security-alerts/cpujan2021.html
CVE ID: CVE-2020-17500 State: PUBLISHED Published: 2021-01-07T20:51:12 Last Updated: 2024-08-04T14:00:47.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result in unauthenticated remote code execution in the username and password fields of the logon prompt. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. Additional Analyst Notes
part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. Additional Analyst Notes: - CVE Program Container: References: - https://www.barco.com/en/support/transform-n-management-server - https://www.barco.com/en/support/cms - https://www.barco.com/en/support/knowledge-base/kb11588
CVE ID: CVE-2020-17502 State: PUBLISHED Published: 2021-01-08T17:15:57 Last Updated: 2024-08-04T14:00:47.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameters xmodules, ymodules and savelocking are not properly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwar
rly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. Additional Analyst Notes: - CVE Program Container: References: - https://www.barco.com/en/support/transform-n-management-server - https://www.barco.com/en/support/cms - https://www.barco.com/en/support/knowledge-base/kb11589
CVE ID: CVE-2020-17503 State: PUBLISHED Published: 2021-01-08T17:17:37 Last Updated: 2024-08-04T14:00:47.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter "locking" is not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards. Additional Analyst Notes: - CVE Program Container: References: - https://www.barco
from TransForm N version 3.8 onwards. Additional Analyst Notes: - CVE Program Container: References: - https://www.barco.com/en/support/transform-n-management-server - https://www.barco.com/en/support/cms - https://www.barco.com/en/support/knowledge-base/kb11589
CVE ID: CVE-2020-17504 State: PUBLISHED Published: 2021-01-08T17:19:24 Last Updated: 2024-08-04T14:00:48.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards. Additional Analyst Notes: - CVE Program Container: References: -
bility is patched from TransForm N version 3.8 onwards. Additional Analyst Notes: - CVE Program Container: References: - https://www.barco.com/en/support/transform-n-management-server - https://www.barco.com/en/support/cms - https://www.barco.com/en/support/knowledge-base/kb11589
CVE ID: CVE-2020-17505 State: PUBLISHED Published: 2020-08-12T16:33:24 Last Updated: 2024-08-04T14:00:48.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via service_cmds_peform. Additional Analyst Notes: - CVE Program Container: References: - https://blog.max0x4141.com/post/artica_proxy/ - http://packetstormsecurity.com/files/159267/Artica-Proxy-4.30.000000-Authentication-Bypass-Command-Injection.html
CVE ID: CVE-2020-17506 State: PUBLISHED Published: 2020-08-12T16:33:10 Last Updated: 2024-08-04T14:00:49.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. Additional Analyst Notes: - CVE Program Container: References: - https://blog.max0x4141.com/post/artica_proxy/ - http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html - http://packetstormsecurity.com/files/159267/Artica-Proxy-4.30.000000-Authentication-Bypass-Command-Injection.html
CVE ID: CVE-2020-17507 State: PUBLISHED Published: 2020-08-12T17:35:20 Last Updated: 2024-08-04T14:00:47.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/308436 - https://codereview.qt-project.org/c/qt/qtbase/+/308495 - https://codereview.qt-project.org/c/qt/qtbase/+/308496 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/426FCC6JNK4JUEX5QHJQDYQ6MUVQ3E6P/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/426FCC6JNK4JUEX5QHJQDYQ6MUVQ3E6P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBPZVZNEYXGATTXM4WOE7OQ55VAKPVD6/ - https://security.gentoo.org/glsa/202009-04 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00024.html - https://lists.debian.org/debian-l
9/msg00090.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00024.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00104.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00105.html
CVE ID: CVE-2020-17508 State: PUBLISHED Published: 2021-01-11T09:40:20 Last Updated: 2024-08-04T14:00:48.638Z Vendors: n/a Products: Apache Traffic Server Problem Types: Information Disclosure Description: The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r65434f7acca3aebf81b0588587149c893fe9f8f9f159eaa7364a70ff%40%3Cannounce.trafficserver.apache.org%3E
CVE ID: CVE-2020-17509 State: PUBLISHED Published: 2021-01-11T09:40:20 Last Updated: 2024-08-04T14:00:48.143Z Vendors: n/a Products: Apache Traffic Server Problem Types: Improper Enforcement of Behavioral Workflow Description: ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/raa9f0589c26c4d146646425e51e2a33e1457492df9f7ea2019daa6d3%40%3Cannounce.trafficserver.apache.org%3E
CVE ID: CVE-2020-17510 State: PUBLISHED Published: 2020-11-05T20:17:36 Last Updated: 2024-08-04T14:00:48.649Z Vendors: n/a Products: Apache Shiro Problem Types: Authentication Bypass Description: Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc2cff2538b683d480426393eecf1ce8dd80e052fbef49303b4f47171%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r95bdf3703858b5f958b5e190d747421771b430d97095880db91980d6%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r70098e336d02047ce
90d747421771b430d97095880db91980d6%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r70098e336d02047ce4d4e69293fe8d558cd68cde06f6430398959bc4%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/rb47d88af224e396ee34ffb88ee99fb6d04510de5722cf14b7137e6bc%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r575301804bfac87a064359cf4b4ae9d514f2d10db7d44120765f4129%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r70b907ccb306e9391145e2b10f56cc6914a245f91720a17a486c020a%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d%40%3Cdev.shiro.apache.org%3E - https
ts.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/re25b8317b00a50272a7252c4552cf1a81a97984cc2111ef7728e48e0%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r852971e28f54cafa7d325bd7033115c67d613b112a2a1076817390ac%40%3Cdev.shiro.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/08/msg00002.html
CVE ID: CVE-2020-17511 State: PUBLISHED Published: 2020-12-14T09:40:15.000Z Last Updated: 2025-02-13T16:27:32.260Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Admin password gets logged in plain text Description: In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E
CVE ID: CVE-2020-17513 State: PUBLISHED Published: 2020-12-14T09:40:15.000Z Last Updated: 2025-02-13T16:27:32.817Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-918 Description: In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E
CVE ID: CVE-2020-17514 State: PUBLISHED Published: 2021-05-27T12:10:10 Last Updated: 2024-08-04T14:00:48.549Z Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: Missing Hostname Verification Description: Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/FINERACT-1211 - https://lists.apache.org/thread.html/rc011b25289c8a6e14f8bc6d07e727382a1df3c8cf2aa5369598bbf64%40%3Cdev.fineract.apache.org%3E - http://www.openwall.com/lists
c011b25289c8a6e14f8bc6d07e727382a1df3c8cf2aa5369598bbf64%40%3Cdev.fineract.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/05/27/2
CVE ID: CVE-2020-17515 State: PUBLISHED Published: 2020-12-11T13:40:12.000Z Last Updated: 2025-02-13T16:27:33.389Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Reflected XSS via Origin Parameter Description: The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%