Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-2035 State: PUBLISHED Published: 2020-08-12T17:05:15.346529Z Last Updated: 2024-09-17T04:10:07.790Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-20 Description: When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication (SNI) field within the TLS Client Hello handshake. This allows a compromised host in a protected network to evade any security policy that uses URL filter
Hello handshake. This allows a compromised host in a protected network to evade any security policy that uses URL filtering on a firewall configured with SSL Decryption in the Forward Proxy mode. A malicious actor can then use this technique to evade detection of communication on the TLS handshake phase between a compromised host and a remote malicious server. This technique does not increase the risk of a host being compromised in the network. It does not impact the confidentiality or availability of a firewall. This is considered to have a low impact on the integrity of the firewall because the firewall fails to enforce a policy on certain traffic that should have been blocked. This issue
he firewall because the firewall fails to enforce a policy on certain traffic that should have been blocked. This issue does not impact the URL filtering policy enforcement on clear text or encrypted web transactions. This technique can be used only after a malicious actor has compromised a host in the protected network and the TLS/SSL Decryption feature is enabled for the traffic that the attacker controls. Palo Alto Networks is not aware of any malware that uses this technique to exfiltrate data. This issue is applicable to all current versions of PAN-OS. This issue does not impact Panorama or WF-500 appliances. Additional Analyst Notes: - CVE Program Container: References: - https://secur
not impact Panorama or WF-500 appliances. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2035 - https://www.mnemonic.no/blog/introducing-snicat/
CVE ID: CVE-2020-2036 State: PUBLISHED Published: 2020-09-09T16:45:25.685699Z Last Updated: 2024-09-16T21:07:51.047Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS
arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2036
CVE ID: CVE-2020-2037 State: PUBLISHED Published: 2020-09-09T16:45:26.132965Z Last Updated: 2024-09-16T19:15:01.275Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.c
than PAN-OS 9.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2037
CVE ID: CVE-2020-2038 State: PUBLISHED Published: 2020-09-09T16:45:26.588785Z Last Updated: 2024-09-16T16:47:58.614Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2038 - h
Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2038 - http://packetstormsecurity.com/files/168008/PAN-OS-10.0-Remote-Code-Execution.html - http://packetstormsecurity.com/files/168408/Palo-Alto-Networks-Authenticated-Remote-Code-Execution.html
CVE ID: CVE-2020-2039 State: PUBLISHED Published: 2020-09-09T16:45:27.091779Z Last Updated: 2024-09-16T17:54:09.808Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-400 Description: An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PA
e management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2039
CVE ID: CVE-2020-2040 State: PUBLISHED Published: 2020-09-09T16:45:27.805152Z Last Updated: 2024-09-16T22:40:15.121Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-120 Description: A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earl
PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2040
CVE ID: CVE-2020-2041 State: PUBLISHED Published: 2020-09-09T16:45:28.345901Z Last Updated: 2024-09-16T19:47:23.091Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-16 Description: An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts all versions of PAN-OS 8.0, and PAN-OS 8.1 versio
ng the device and putting it into maintenance mode. This issue impacts all versions of PAN-OS 8.0, and PAN-OS 8.1 versions earlier than 8.1.16. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2041
CVE ID: CVE-2020-2042 State: PUBLISHED Published: 2020-09-09T16:45:28.844038Z Last Updated: 2024-09-17T00:56:17.352Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-121 Description: A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2042
CVE ID: CVE-2020-2043 State: PUBLISHED Published: 2020-09-09T16:45:29.552659Z Last Updated: 2024-09-16T22:08:43.659Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-532 Description: An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple times in one log entry. The first instance of the sensitive field is masked but subsequent instances are left in clear text. This issue im
ntry. The first instance of the sensitive field is masked but subsequent instances are left in clear text. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2043
CVE ID: CVE-2020-2044 State: PUBLISHED Published: 2020-09-09T16:45:30.321750Z Last Updated: 2024-09-16T18:09:13.065Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-532 Description: An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and later PAN-OS versions. Command usage i
all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and later PAN-OS versions. Command usage is recorded, instead, in the req_stats.log file in PAN-OS 9.1 and later PAN-OS versions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2044
CVE ID: CVE-2020-2045 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2046 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2047 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2048 State: PUBLISHED Published: 2020-11-12T00:05:22.235844Z Last Updated: 2024-09-17T01:26:02.418Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-532 Description: An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2. Additional Analyst Notes: - CVE Progra
rsions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2048
CVE ID: CVE-2020-2049 State: PUBLISHED Published: 2020-12-09T18:00:14.602237Z Last Updated: 2024-09-17T02:53:03.084Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Cortex XDR Agent Problem Types: CWE-427 Description: A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Corte
issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2049
CVE ID: CVE-2020-2050 State: PUBLISHED Published: 2020-11-12T00:05:22.986621Z Last Updated: 2024-09-17T00:11:04.982Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-285 Description: An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted
etwork resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate verification is used in conjunction with other authentication methods, the protections added by the certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Additional Analyst Notes:
AN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2050
CVE ID: CVE-2020-2051 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2052 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2053 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2054 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2056 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2057 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2058 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2059 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2061 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2062 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2064 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2065 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2067 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2068 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2069 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2071 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2072 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2073 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2074 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2020-2075 State: PUBLISHED Published: 2020-08-31T17:09:07 Last Updated: 2024-08-04T06:54:00.593Z Vendors: n/a Products: Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3; LMS10x, LMS11x, LMS15x; LMS12x, LMS13x, LMS14x; LMS5xx, LMS53x; MSC800; RFH Problem Types: CWE-703 Description: Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH. Additional Analyst Notes: - CVE Program Container: References: - https://www.sick.com/de/en/service-and-support/the-sick-product-security-incide
: - CVE Program Container: References: - https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE ID: CVE-2020-2076 State: PUBLISHED Published: 2020-07-29T13:18:55 Last Updated: 2024-08-04T06:54:00.613Z Vendors: n/a Products: SICK Package Analytics Problem Types: Authentication Bypass Using an Alternate Path or Channel Description: SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write files without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.sick.com/de/en/service-and-support/the-sick-product-securit
st Notes: - CVE Program Container: References: - https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE ID: CVE-2020-2077 State: PUBLISHED Published: 2020-07-29T13:18:59 Last Updated: 2024-08-04T06:54:00.702Z Vendors: n/a Products: SICK Package Analytics Problem Types: Incorrect Default Permissions Description: SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly. Additional Analyst Notes: - CVE Program Container: References: - https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE ID: CVE-2020-2078 State: PUBLISHED Published: 2020-07-29T13:19:01 Last Updated: 2024-08-04T06:54:00.579Z Vendors: n/a Products: SICK Package Analytics Problem Types: Cleartext Storage of Sensitive Information Description: Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.sick.
ation or other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE ID: CVE-2020-2079 State: REJECTED Published: 2020-12-15T17:23:20 Last Updated: 2020-12-15T17:23:20 Description: No description available.
CVE ID: CVE-2020-2080 State: REJECTED Published: 2020-12-15T17:23:47 Last Updated: 2020-12-15T17:23:47 Description: No description available.
CVE ID: CVE-2020-2081 State: REJECTED Published: 2020-12-15T17:24:29 Last Updated: 2020-12-15T17:24:29 Description: No description available.
CVE ID: CVE-2020-2082 State: REJECTED Published: 2020-12-15T17:24:52 Last Updated: 2020-12-15T17:24:52 Description: No description available.
CVE ID: CVE-2020-2083 State: REJECTED Published: 2020-12-15T17:25:25 Last Updated: 2020-12-15T17:25:25 Description: No description available.
CVE ID: CVE-2020-2084 State: REJECTED Published: 2020-12-15T17:26:06 Last Updated: 2020-12-15T17:26:06 Description: No description available.
CVE ID: CVE-2020-2085 State: REJECTED Published: 2020-12-15T17:26:52 Last Updated: 2020-12-15T17:26:52 Description: No description available.
CVE ID: CVE-2020-2086 State: REJECTED Published: 2020-12-15T17:27:22 Last Updated: 2020-12-15T17:27:22 Description: No description available.
CVE ID: CVE-2020-2087 State: REJECTED Published: 2020-12-15T17:27:50 Last Updated: 2020-12-15T17:27:50 Description: No description available.
CVE ID: CVE-2020-2088 State: REJECTED Published: 2020-12-15T17:28:37 Last Updated: 2020-12-15T17:28:37 Description: No description available.
CVE ID: CVE-2020-2089 State: REJECTED Published: 2020-12-15T17:28:58 Last Updated: 2020-12-15T17:28:58 Description: No description available.
CVE ID: CVE-2020-2090 State: PUBLISHED Published: 2020-01-15T15:15:23 Last Updated: 2024-08-04T06:54:00.607Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1004
CVE ID: CVE-2020-2091 State: PUBLISHED Published: 2020-01-15T00:00:00 Last Updated: 2024-08-04T06:54:00.589Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1004
CVE ID: CVE-2020-2092 State: PUBLISHED Published: 2020-01-15T15:15:24 Last Updated: 2024-08-04T06:54:00.596Z Vendors: Jenkins project Products: Jenkins Robot Framework Plugin Description: Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1698