Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25711 State: PUBLISHED Published: 2020-12-03T00:00:00 Last Updated: 2024-08-04T15:40:36.665Z Vendors: n/a Products: infinispan Problem Types: CWE-862 Description: A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1897618 - https://security.netapp.com/advisory/ntap-20220210-0023/
CVE ID: CVE-2020-25712 State: PUBLISHED Published: 2020-12-15T16:52:38 Last Updated: 2024-08-04T15:40:36.621Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-122 Description: A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1887276 - https://lists.x.org/archives/xorg-announce/2020-December/003066.html
CVE ID: CVE-2020-25713 State: PUBLISHED Published: 2021-05-13T14:27:52 Last Updated: 2024-08-04T15:40:36.659Z Vendors: n/a Products: raptor2 Problem Types: CWE-20 Description: A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2020/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27EQ2JCVMKG3EYTBYO4642P773I2NYUV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUIND56AOKEHHBE4OYV57M73LLOLJRLV/ - https://b
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUIND56AOKEHHBE4OYV57M73LLOLJRLV/ - https://bugzilla.redhat.com/show_bug.cgi?id=1900685 - https://bugs.librdf.org/mantis/view.php?id=650 - https://lists.debian.org/debian-lts-announce/2021/12/msg00009.html
CVE ID: CVE-2020-25714 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-25715 State: PUBLISHED Published: 2021-05-28T10:20:26 Last Updated: 2024-08-04T15:40:36.827Z Vendors: n/a Products: pki-core Problem Types: CWE-79 Description: A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1891016
CVE ID: CVE-2020-25716 State: PUBLISHED Published: 2021-06-07T20:27:15 Last Updated: 2024-08-04T15:40:36.658Z Vendors: n/a Products: Cloudforms Problem Types: CWE-285 Description: A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before cfme 5.11.10.1 are affected Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi
1 are affected Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1898525
CVE ID: CVE-2020-25717 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-04T15:40:36.637Z Vendors: n/a Products: samba Problem Types: CWE-20 Description: A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019672 - https://www.samba.org/samba/security/CVE-2020-25717.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2020-25718 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-04T15:40:36.803Z Vendors: n/a Products: samba Problem Types: CWE-862 Description: A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019726 - https://www.samba.org/samba/security/CVE-2020-25718.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2020-25719 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-04T15:40:36.654Z Vendors: n/a Products: samba Problem Types: CWE-287 Description: A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019732 - https://www.samba.org/samba/security/CVE-2020-25719.html - https://securi
/bugzilla.redhat.com/show_bug.cgi?id=2019732 - https://www.samba.org/samba/security/CVE-2020-25719.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2020-25720 State: PUBLISHED Published: 2024-11-17T10:17:07.511Z Last Updated: 2025-11-20T14:32:59.430Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Storage 3 Problem Types: CWE-264 Description: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation.
o all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2020-25720 - https://bugzilla.redhat.com/show_bug.cgi?id=2305954
CVE ID: CVE-2020-25721 State: PUBLISHED Published: 2022-03-16T00:00:00 Last Updated: 2024-08-04T15:40:36.797Z Vendors: n/a Products: samba Problem Types: CWE-20 Description: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2020-25721.html - https://bugzilla.samba.org/show_bug.cgi?id=14725 - https://bugzilla.redhat.com/show_bug.cgi?id=2021728 - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2020-25722 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-04T15:40:36.640Z Vendors: n/a Products: samba Problem Types: CWE-863 Description: Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019764 - https://www.samba.org/samba/security/CVE-2020-25722.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2020-25723 State: PUBLISHED Published: 2020-12-02T00:52:10 Last Updated: 2024-08-04T15:40:36.594Z Vendors: n/a Products: QEMU Problem Types: CWE-617 Description: A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1898579 - https://security.netapp.com/advisory/ntap-20201218-0004/ - http://w
ttps://bugzilla.redhat.com/show_bug.cgi?id=1898579 - https://security.netapp.com/advisory/ntap-20201218-0004/ - http://www.openwall.com/lists/oss-security/2020/12/22/1 - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-25724 State: PUBLISHED Published: 2021-05-26T20:52:06 Last Updated: 2024-08-04T15:40:36.746Z Vendors: n/a Products: resteasy Problem Types: CWE-567 Description: A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1899354 - https://security.netapp.com/advisory/ntap-20210702-0003/
CVE ID: CVE-2020-25725 State: PUBLISHED Published: 2020-11-21T05:29:54 Last Updated: 2024-08-04T15:40:36.653Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Glyph & Cog Products: xpdf Problem Types: CWE-416 Description: In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic
ame Type 3 font. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41915 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25725 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZUU5QG6SSVRTKZTR3A72LDRVZETEI63/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLOYVJSM54IL6I5RY4QTJGRS7PIEG44X/
CVE ID: CVE-2020-25726 State: REJECTED Published: 2020-09-25T03:56:49 Last Updated: 2020-09-30T19:35:33 Description: No description available.
CVE ID: CVE-2020-25727 State: PUBLISHED Published: 2020-09-17T16:35:04 Last Updated: 2024-08-04T15:40:36.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field. Additional Analyst Notes: - CVE Program Container: References: - https://amriunix.com/post/alfresco-reset-password-add-on-0-day-vulnerabilities/
CVE ID: CVE-2020-25728 State: PUBLISHED Published: 2020-09-17T16:34:45 Last Updated: 2024-08-04T15:40:36.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account. Additional Analyst Notes: - CVE Program Container: References: - https://amriunix.com/post/alfresco-reset-password-add-on-0-day-vulnerabilities/
CVE ID: CVE-2020-25729 State: PUBLISHED Published: 2020-09-17T17:14:54 Last Updated: 2024-08-04T15:40:36.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZoneMinder/zoneminder/commit/9268db14a79c4ccd444c2bf8d24e62b13207b413 - https://forums.zoneminder.com/viewforum.php?f=1 - https://github.com/ZoneMinder/zoneminder/releases/tag/1.34.21
CVE ID: CVE-2020-25730 State: PUBLISHED Published: 2024-04-04T00:00:00 Last Updated: 2024-11-04T18:42:35.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHP_SELF component in classic/views/download.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ZoneMinder/zoneminder/commit/9268db14a79c4ccd444c2bf8d24e62b13207b413
CVE ID: CVE-2020-25733 State: PUBLISHED Published: 2020-09-18T01:45:53 Last Updated: 2024-08-04T15:40:36.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40tehwinsam/webtareas-2-1-c8b406c68c2a - https://sourceforge.net/projects/webtareas/files/ - https://sourceforge.net/p/webtareas/tickets/40/
CVE ID: CVE-2020-25734 State: PUBLISHED Published: 2020-09-18T01:46:28 Last Updated: 2024-08-04T15:40:36.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: webTareas through 2.1 allows files/Default/ Directory Listing. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40tehwinsam/webtareas-2-1-c8b406c68c2a - https://sourceforge.net/projects/webtareas/files/ - https://sourceforge.net/p/webtareas/tickets/40/
CVE ID: CVE-2020-25735 State: PUBLISHED Published: 2020-09-18T01:47:00 Last Updated: 2024-08-04T15:40:36.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40tehwinsam/webtareas-2-1-c8b406c68c2a - https://sourceforge.net/projects/webtareas/files/ - https://sourceforge.net/p/webtareas/tickets/40/
CVE ID: CVE-2020-25736 State: PUBLISHED Published: 2021-07-15T00:00:00 Last Updated: 2024-08-04T15:40:36.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.acronis.com/en-us/blog/ - https://kb.acronis.com/content/68061 - http://packetstormsecurity.com/files/170246/Acronis-TrueImage-XPC-Privilege-Escalation.html
CVE ID: CVE-2020-25737 State: PUBLISHED Published: 2021-01-25T18:15:43 Last Updated: 2024-08-04T15:40:36.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: An elevation of privilege vulnerability exists in Hackolade versions prior 4.2.0 on Windows has an issue in specific deployment scenarios that could allow local users to gain elevated privileges during an uninstall of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bwiltse/cve/blob/master/Hackolade/Hackolade-CVE-2020-25737.txt
CVE ID: CVE-2020-25738 State: PUBLISHED Published: 2020-11-27T05:50:03 Last Updated: 2024-08-04T15:40:36.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that normally has credential access, such as a Chrome process that reads credentials from a SQLite database. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyberark.com/resources/blog/introducing-cyberark-endpoint-privilege-manager - https://gist.github.com/inc0d3/47294c1e73ef8cbdc098e739d086efbc
CVE ID: CVE-2020-25739 State: PUBLISHED Published: 2020-09-23T13:53:14 Last Updated: 2024-08-04T15:40:36.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gazay/gon/commit/fe3c7b2191a992386dc9edd37de5447a4e809bc7 - https://lists.debian.org/debian-lts-announce/2020/09/msg00018.html - https://usn.ubuntu.com/4560-1/
CVE ID: CVE-2020-25741 State: PUBLISHED Published: 2020-10-02T08:26:36 Last Updated: 2024-08-04T15:40:36.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05295.html - https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Ffdc_nullptr1 - http://www.openwall.com/lists/oss-security/2020/09/29/1 - https://security.netapp.com/advisory/ntap-20201009-0005/
CVE ID: CVE-2020-25742 State: PUBLISHED Published: 2020-10-06T14:18:07 Last Updated: 2024-08-04T15:40:36.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html - https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1 - http://www.openwall.com/lists/oss-security/2020/09/29/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1883178
CVE ID: CVE-2020-25743 State: PUBLISHED Published: 2020-10-06T14:15:23 Last Updated: 2024-08-04T15:40:36.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05967.html - https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1b - http://www.openwall.com/lists/oss-security/2020/09/29/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1881409
CVE ID: CVE-2020-25744 State: PUBLISHED Published: 2020-09-18T01:57:05 Last Updated: 2024-08-04T15:40:36.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: SaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite arbitrary files, which could cause a denial of service (DoS) condition, because a symlink from %LOCALAPPDATA%\SaferVPN\Log is followed. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40thebinary0x1/safervpn-for-windows-arbitrary-file-overwrite-dos-bdc88fdb5ead - https://www.youtube.com/watch?v=0QdRJdA_aos
CVE ID: CVE-2020-25746 State: PUBLISHED Published: 2020-11-17T13:20:11 Last Updated: 2024-08-04T15:40:36.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility. Additional Analyst Notes: - CVE Program Container: References: - https://www.resourcexpress.com/meeting-room-booking-systems/hardware/qubi3/ - https://resourcexpress.atlassian.net/wiki/spaces/RSG/pages/878641153/v1.40.9
CVE ID: CVE-2020-25747 State: PUBLISHED Published: 2020-09-25T03:15:59 Last Updated: 2024-08-04T15:40:36.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain access to RTSP and ONFIV services without authentication. Thus, the attacker can watch live streams from the camera, rotate the camera, change some settings (brightness, clarity, time), restart the camera, or reset it to factory settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jet-pentest/CVE-2020-25747
CVE ID: CVE-2020-25748 State: PUBLISHED Published: 2020-09-25T03:17:31 Last Updated: 2024-08-04T15:40:36.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can intercept and modify the video data from the camera, which is transmitted in an unencrypted form. One can also modify responses from NTP and RTSP servers and force the camera to use the changed values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jet-pentest/CVE-2020-25748
CVE ID: CVE-2020-25749 State: PUBLISHED Published: 2020-09-25T03:18:28 Last Updated: 2024-08-04T15:40:36.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telnet service cannot be disabled and this password cannot be changed via standard functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jet-pentest/CVE-2020-25749
CVE ID: CVE-2020-25750 State: PUBLISHED Published: 2020-09-18T03:25:50 Last Updated: 2024-08-04T15:40:36.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DevGroup-ru/dotplant2/issues/400
CVE ID: CVE-2020-25751 State: PUBLISHED Published: 2020-09-18T04:01:44 Last Updated: 2024-08-04T15:40:36.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=com_pago&view=comments filter_published parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48811 - https://geekwire.eu/2020/09/14/joomla-pago-commerce-2-5-9-0-sql-injection-authenticated/
CVE ID: CVE-2020-25752 State: PUBLISHED Published: 2021-06-16T18:23:18 Last Updated: 2024-08-04T15:40:36.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords. Additional Analyst Notes: - CVE Program Container: Referen