Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
TNrQ/view?usp=sharing - https://shells.systems/ocs-inventory-ng-v2-7-remote-command-execution-cve-2020-14947/ - http://packetstormsecurity.com/files/158293/OCS-Inventory-NG-2.7-Remote-Code-Execution.html - https://github.com/OCSInventory-NG/OCSInventory-ocsreports/commit/da72e0fddaeceee44fbbd7241e07e5d53d1eee64
CVE ID: CVE-2020-14950 State: PUBLISHED Published: 2020-06-21T15:58:33 Last Updated: 2024-08-04T13:00:52.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start, stop, or restart) to the setting menu of Sotfware Store. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jenaye/aapanel
CVE ID: CVE-2020-14954 State: PUBLISHED Published: 2020-06-21T16:55:41 Last Updated: 2024-08-04T13:00:52.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection." Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2020/dsa-4707 - http://www.mutt.org/ - https://gitlab.com/muttmua/mutt/-/issues/248 - http://lists.mutt.org/pipermail/mutt-announce/Week-o
tp://www.mutt.org/ - https://gitlab.com/muttmua/mutt/-/issues/248 - http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200615/000023.html - https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4 - https://github.com/neomutt/neomutt/releases/tag/20200619 - https://github.com/neomutt/neomutt/commit/fb013ec666759cb8a9e294347c7b4c1f597639cc - https://www.debian.org/security/2020/dsa-4708 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00039.html - https://lists.debian.org/debian-lts-announce/2020/06
ttps://lists.debian.org/debian-lts-announce/2020/06/msg00039.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00040.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3LXFVPTLK4PNHL6MPKJNJQJ25CH7GLQ/ - https://usn.ubuntu.com/4403-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFMEILCBKMZRRZDMUGWLVN4PQQ4VTAZE/ - https://security.gentoo.org/glsa/202007-57
CVE ID: CVE-2020-14955 State: PUBLISHED Published: 2020-06-26T17:03:23 Last Updated: 2024-08-04T13:00:52.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220440. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/y5s5k5/CVE-2020-14955
CVE ID: CVE-2020-14956 State: PUBLISHED Published: 2020-06-30T14:37:56 Last Updated: 2024-08-04T13:00:52.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x223CCA. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/y5s5k5/CVE-2020-14957-CVE-2020-14956 - http://www.arswp.com/
CVE ID: CVE-2020-14957 State: PUBLISHED Published: 2020-06-30T14:40:17 Last Updated: 2024-08-04T13:00:52.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x223CCD. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/y5s5k5/CVE-2020-14957-CVE-2020-14956 - http://www.arswp.com/
CVE ID: CVE-2020-14958 State: PUBLISHED Published: 2020-06-21T19:57:21 Last Updated: 2024-08-04T13:00:52.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c - https://github.com/gogs/gogs/pull/5988
CVE ID: CVE-2020-14959 State: PUBLISHED Published: 2020-06-21T23:04:49 Last Updated: 2024-08-04T13:00:52.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10223
CVE ID: CVE-2020-14960 State: PUBLISHED Published: 2020-06-21T23:04:40 Last Updated: 2024-08-04T13:00:52.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php-fusion/PHP-Fusion/issues/2327 - https://github.com/php-fusion/PHP-Fusion/commit/b3bde37f60e96f1a8ddd1439658307b28be77db5 - https://www.exploit-db.com/exploits/48487
CVE ID: CVE-2020-14961 State: PUBLISHED Published: 2020-06-21T23:04:30 Last Updated: 2024-08-04T13:00:52.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/concrete5/concrete5/pull/8651 - https://github.com/concrete5/concrete5/releases/tag/8.5.3
CVE ID: CVE-2020-14962 State: PUBLISHED Published: 2020-06-21T23:04:15 Last Updated: 2024-08-04T13:00:52.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10241
CVE ID: CVE-2020-14965 State: PUBLISHED Published: 2020-06-23T13:30:13 Last Updated: 2024-08-04T13:00:51.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also be exploited through a CSRF, requiring no authentication as an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/g-rubert/CVE-2020-14965
CVE ID: CVE-2020-14966 State: PUBLISHED Published: 2020-06-22T11:20:13 Last Updated: 2024-08-04T13:00:52.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature. Additional Analyst Notes: - CVE Program Container: References: - https://kjur.github.io/jsrsasign/ - https://www.npmjs.com/package/jsrsasign - https://
Program Container: References: - https://kjur.github.io/jsrsasign/ - https://www.npmjs.com/package/jsrsasign - https://github.com/kjur/jsrsasign/issues/437 - https://github.com/kjur/jsrsasign/releases/tag/8.0.18 - https://github.com/kjur/jsrsasign/releases/tag/8.0.17 - https://security.netapp.com/advisory/ntap-20200724-0001/
CVE ID: CVE-2020-14967 State: PUBLISHED Published: 2020-06-22T11:19:35 Last Updated: 2024-08-04T13:00:52.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues. Additional Analyst Notes: - CVE Program Container: References: - https://kjur.github.io/jsrsasign/ - https://www.npmjs.com/package/jsrsasign - https://github.com/kjur/jsrsasign/releases/ta
ps://kjur.github.io/jsrsasign/ - https://www.npmjs.com/package/jsrsasign - https://github.com/kjur/jsrsasign/releases/tag/8.0.18 - https://github.com/kjur/jsrsasign/releases/tag/8.0.17 - https://github.com/kjur/jsrsasign/issues/439 - https://security.netapp.com/advisory/ntap-20200724-0001/
CVE ID: CVE-2020-14968 State: PUBLISHED Published: 2020-06-22T11:19:49 Last Updated: 2024-08-04T13:00:52.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues. Additional Analyst Notes: - CVE Program Conta
prepend these bytes with the goal of triggering memory corruption issues. Additional Analyst Notes: - CVE Program Container: References: - https://kjur.github.io/jsrsasign/ - https://www.npmjs.com/package/jsrsasign - https://github.com/kjur/jsrsasign/releases/tag/8.0.18 - https://github.com/kjur/jsrsasign/releases/tag/8.0.17 - https://github.com/kjur/jsrsasign/issues/438 - https://security.netapp.com/advisory/ntap-20200724-0001/
CVE ID: CVE-2020-14969 State: PUBLISHED Published: 2020-06-22T11:48:44 Last Updated: 2024-08-04T13:00:52.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/609bfbd450c933d21c50c9f0161d633c43413eb6
CVE ID: CVE-2020-14971 State: PUBLISHED Published: 2020-06-23T13:41:31 Last Updated: 2024-08-04T13:00:52.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files, and then compresses and uploads these files again. Additional Analyst Notes: - CVE Program Container: References: - https://blog.telspace.co.za/2020/06/pi-
se files again. Additional Analyst Notes: - CVE Program Container: References: - https://blog.telspace.co.za/2020/06/pi-hole-code-injection-cve-2020-14971.html - https://github.com/pi-hole/AdminLTE/pull/1443 - https://github.com/pi-hole/AdminLTE/commit/c949516ee15fa6a9b0c8511cc4c4d6b0893f3e69 - https://github.com/pi-hole/AdminLTE/commit/8f6e1365b6dec0ae1aa0b0b15b102c9133f347e5
CVE ID: CVE-2020-14972 State: PUBLISHED Published: 2020-06-22T17:21:53 Last Updated: 2024-08-04T13:00:52.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - https://www.exploit-db.com/exploits/48439
CVE ID: CVE-2020-14973 State: PUBLISHED Published: 2020-06-22T17:19:01 Last Updated: 2024-08-04T13:00:52.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/webtareas/blog/ - https://packetstormsecurity.com/files/157608/WebTareas-2.0p8-Cross-Site-Scripting.html
CVE ID: CVE-2020-14974 State: PUBLISHED Published: 2020-06-23T19:07:48 Last Updated: 2024-08-04T13:00:52.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running as SYSTEM) that hold a handle, via IOCTL code 0x222124. Additional Analyst Notes: - CVE Program Container: References: - https://www.iobit.com/en/iobit-unlocker.php - https://theevilbit.github.io/posts/
CVE ID: CVE-2020-14975 State: PUBLISHED Published: 2020-06-23T19:06:26 Last Updated: 2024-08-04T13:00:52.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to delete, move, or copy arbitrary files via IOCTL code 0x222124. Additional Analyst Notes: - CVE Program Container: References: - https://www.iobit.com/en/iobit-unlocker.php - https://theevilbit.github.io/posts/
CVE ID: CVE-2020-14976 State: PUBLISHED Published: 2020-06-23T19:04:53 Last Updated: 2024-08-04T13:00:52.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context. Additional Analyst Notes: - CVE Program Container: References: - https://www.gns3.com/ - https://github.com/GNS3/ubridge/commit/2eb0d1dab6a6de76cf3556130a2d52af101077db - https://github.com/GNS3/gns3-server/releases/tag/v2.1.17 - https://theevilbit.github.io/posts/
CVE ID: CVE-2020-14977 State: PUBLISHED Published: 2020-06-23T19:02:30 Last Updated: 2024-08-04T13:00:52.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a PID reuse attack and connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/home/products/safe - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hal
/www.f-secure.com/en/home/products/safe - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://theevilbit.github.io/posts/
CVE ID: CVE-2020-14978 State: PUBLISHED Published: 2020-06-23T19:01:27 Last Updated: 2024-08-04T13:00:52.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/home/products/safe - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://theevilbit.github.io/posts/
CVE ID: CVE-2020-14979 State: PUBLISHED Published: 2020-08-11T17:55:13 Last Updated: 2024-08-04T13:00:52.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write to arbitrary memory locations. This allows any user to gain NT AUTHORITY\SYSTEM privileges by mapping \Device\PhysicalMemory into the calling process. Additional Analyst Notes: - CVE Program Container: References: - https://www.evga.com/precisionx1/ - https://posts.specterops.io/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896
CVE ID: CVE-2020-14980 State: PUBLISHED Published: 2020-06-22T17:39:22 Last Updated: 2024-08-04T13:00:52.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.info-sec.ca/advisories/Sophos-Secure-Email.html - http://packetstormsecurity.com/files/158322/Sophos-Secure-Email-Android-Application-3.9.4-Man-In-The-Middle.html
CVE ID: CVE-2020-14981 State: PUBLISHED Published: 2020-06-22T17:37:58 Last Updated: 2024-08-04T13:00:52.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.info-sec.ca/advisories/Vipre-Password-Vault.html - http://packetstormsecurity.com/files/158323/VIPRE-Password-Vault-1.100.1090-Man-In-The-Middle.html
CVE ID: CVE-2020-14982 State: PUBLISHED Published: 2020-07-15T20:09:33 Last Updated: 2024-08-04T13:00:52.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter) allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.mindpointgroup.com/articles/ - https://www.mindpointgroup.com/blog/webta-sqli-vulnerability/
CVE ID: CVE-2020-14983 State: PUBLISHED Published: 2020-06-22T19:13:34 Last Updated: 2024-08-04T13:00:52.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chocolate-doom/chocolate-doom/issues/1293 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/20
.opensuse.org/opensuse-security-announce/2020-07/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00012.html
CVE ID: CVE-2020-14987 State: PUBLISHED Published: 2021-03-11T17:50:32 Last Updated: 2024-08-04T13:00:52.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST transforming annotation such as @Grab. Additional Analyst Notes: - CVE Program Container: References: - https://tvrbk.github.io/cve/2021/03/09/brXM.html
CVE ID: CVE-2020-14988 State: PUBLISHED Published: 2021-03-11T18:07:20 Last Updated: 2024-08-04T13:00:52.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://tvrbk.github.io/cve/2021/03/09/brXM.html
CVE ID: CVE-2020-14989 State: PUBLISHED Published: 2021-03-11T18:14:00 Last Updated: 2024-08-04T13:00:52.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended. Additional Analyst Notes: - CVE Program Container: References: - https://tvrbk.github.io/cve/2021/03/09/brXM.html
CVE ID: CVE-2020-14990 State: PUBLISHED Published: 2020-06-22T20:53:31 Last Updated: 2024-08-04T13:00:52.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: IOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion by manipulating the Clean & Optimize feature with an NTFS junction and an Object Manager symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://daniels-it-blog.blogspot.com/2020/06/arbitrary-file-deletion-in-iobit.html - https://github.com/Daniel-itsec/AdvancedSystemCare
CVE ID: CVE-2020-14993 State: PUBLISHED Published: 2020-06-23T11:50:58 Last Updated: 2024-08-04T13:00:52.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dexterone/Vigor-poc - https://www.draytek.com/about/security-advisory - https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473
om/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473%29
CVE ID: CVE-2020-14999 State: PUBLISHED Published: 2021-07-27T12:48:07 Last Updated: 2024-08-04T13:00:52.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://www.acronis.com/en-us/support/updates/index.html
CVE ID: CVE-2020-15000 State: PUBLISHED Published: 2020-07-09T17:57:40 Last Updated: 2024-08-04T13:00:52.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin PIN, Reset Code, and User PIN. The Reset Code is used to reset the User PIN, but it is disabled by default. A flaw in the implementation of OpenPGP sets the Reset Code to a known value upon initialization. If the retry counter for the Reset Code is set to non-zero without changing the Reset Code, this known value can be used to reset the User PIN. To set the retry counters, the Admin PIN is required. Addition
Code, this known value can be used to reset the User PIN. To set the retry counters, the Admin PIN is required. Additional Analyst Notes: - CVE Program Container: References: - https://www.yubico.com/support/security-advisories/ysa-2020-05/