Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ent, they will be able to run arbitrary Java code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md
CVE ID: CVE-2020-9297 State: PUBLISHED Published: 2020-07-14T19:07:54 Last Updated: 2024-08-04T10:26:15.938Z Vendors: n/a Products: Netflix Titus Problem Types: Server-Side Template Injection Description: Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code. Additional Analyst Note
t.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md
CVE ID: CVE-2020-9298 State: PUBLISHED Published: 2020-08-28T14:45:54 Last Updated: 2024-08-04T10:26:16.115Z Vendors: n/a Products: Netflix Orca Spinnaker Problem Types: Server-Side Request Forgery Description: The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md
CVE ID: CVE-2020-9299 State: PUBLISHED Published: 2020-11-09T14:50:18 Last Updated: 2024-08-04T10:26:15.857Z Vendors: n/a Products: Netflix Dispatch Problem Types: Multiple Cross-Site Scripting Vulnerabilities Description: There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/dispatch/releases/tag/v20201106 - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-004.md
CVE ID: CVE-2020-9300 State: PUBLISHED Published: 2020-11-09T14:41:37 Last Updated: 2024-08-04T10:26:15.669Z Vendors: n/a Products: Netflix Dispatch Problem Types: Multiple Multiple Access Control Issues in Dispatch Description: The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - http
is may only be exploited by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-005.md - https://github.com/Netflix/dispatch/releases/tag/v20201106
CVE ID: CVE-2020-9301 State: PUBLISHED Published: 2020-12-11T02:10:32 Last Updated: 2024-08-04T10:26:16.028Z Vendors: n/a Products: Netflix Spinnaker Problem Types: SpEL Template injection Description: Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-006.md
CVE ID: CVE-2020-9306 State: PUBLISHED Published: 2021-02-17T23:11:24 Last Updated: 2024-08-04T10:26:15.879Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account. Additional Analyst Notes: - CVE Program Container: References: - https://www.fireeye.com/blog/threat-research.html - https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html - https://www.fireeye.com/bl
eye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html - https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.html - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0019/FEYE-2020-0019.md
CVE ID: CVE-2020-9307 State: PUBLISHED Published: 2021-02-11T20:32:13 Last Updated: 2024-08-04T10:26:16.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of the HSR ring ports of the device. This effectively breaks the redundancy of the HSR ring. If the attacker can perform the same attack on a second device, the ring is broken into two parts (thus disrupting communication between devices in the different parts). Additional Analyst Notes: - CVE Program Container: References: - https://www.belden.com/dfsmedia/f1e38517e0cd4ca
parts). Additional Analyst Notes: - CVE Program Container: References: - https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/12276-source/options/view - https://www.belden.com/security
CVE ID: CVE-2020-9308 State: PUBLISHED Published: 2020-02-20T06:07:23 Last Updated: 2024-08-04T10:26:16.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/pull/1326 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459 - https://github.com/libarchive/libarchive/pull/1326/commits/94821008d6eea81e315c5881cdf739202961040a - https://security.gentoo.org/g
hub.com/libarchive/libarchive/pull/1326/commits/94821008d6eea81e315c5881cdf739202961040a - https://security.gentoo.org/glsa/202003-28 - https://usn.ubuntu.com/4293-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OTE7GWASH2ZOVG5H3HEN5PR6B3KF7JB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J76F7VU7HC3GBKG5SAKTRBOFOI3RGO6M/
CVE ID: CVE-2020-9309 State: PUBLISHED Published: 2020-07-15T20:57:20 Last Updated: 2024-08-04T10:26:16.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Uploads stored as protected or draft files are allowed by default for authorised users only, but can also be enabled through custom logic as well as modules such as silverstripe/userforms. Sites using the previously optional silverstripe/m
rough custom logic as well as modules such as silverstripe/userforms. Sites using the previously optional silverstripe/mimevalidator module can configure MIME whitelists rather than extension whitelists, and hence prevent this issue. Sites on the Common Web Platform (CWP) use this module by default, and are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/CVE-2020-9309
CVE ID: CVE-2020-9310 State: REJECTED Published: 2020-05-12T13:29:07 Last Updated: 2020-05-12T13:29:07 Description: No description available.
CVE ID: CVE-2020-9311 State: PUBLISHED Published: 2020-07-15T21:00:17 Last Updated: 2024-08-04T10:26:15.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/CVE-2020-9311
CVE ID: CVE-2020-9314 State: PUBLISHED Published: 2020-05-10T22:23:34 Last Updated: 2024-08-04T10:26:16.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/support/lifetime-support/ - https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf
tps://www.oracle.com/support/lifetime-support/ - https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf - https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/ - http://seclists.org/fulldisclosure/2020/May/31
CVE ID: CVE-2020-9315 State: PUBLISHED Published: 2020-05-10T22:23:02 Last Updated: 2024-08-04T10:26:16.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/support/lifetime-support/ - https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf - https://wwws.nig
m/support/lifetime-support/ - https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf - https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/ - http://seclists.org/fulldisclosure/2020/May/31
CVE ID: CVE-2020-9318 State: PUBLISHED Published: 2020-02-20T20:58:19 Last Updated: 2024-08-04T10:26:16.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuring the SNMP alert settings in the UI. This is fixed in 9.2.15. Additional Analyst Notes: - CVE Program Container: References: - https://www.red-gate.com/privacy-and-security/vulnerabilities/2020-02-19-sql-monitor
CVE ID: CVE-2020-9320 State: PUBLISHED Published: 2020-02-20T21:39:43 Last Updated: 2024-08-04T10:26:16.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, Antivirus for Small Business, Exchange Security (Gateway), Internet Security Suite for Windows, Prime, Free Security Suite for Windows, and Cross Platform Anti-malware SDK. NOTE: Vendor asserts that vulnerability does not exist in product Additional Analyst Notes: - CVE Program Container: References: - https://blog.zoller.lu/p/from-low-hanging-fruit-department-avira.html
yst Notes: - CVE Program Container: References: - https://blog.zoller.lu/p/from-low-hanging-fruit-department-avira.html - https://www.zoller.lu/%5BTZO-01-2020%5D%20AVIRA%20Generic%20Bypass%20ISO.pdf - http://packetstormsecurity.com/files/156472/AVIRA-Generic-Malformed-Container-Bypass.html - http://seclists.org/fulldisclosure/2020/Feb/31
CVE ID: CVE-2020-9321 State: PUBLISHED Published: 2020-03-16T18:14:29 Last Updated: 2024-08-04T10:26:16.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containous/traefik/pull/6281 - https://github.com/containous/traefik/releases/tag/v2.1.4
CVE ID: CVE-2020-9322 State: PUBLISHED Published: 2025-08-08T00:00:00.000Z Last Updated: 2025-08-08T14:37:50.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://statamic.com/changelog#2.11.18 - https://gist.github.com/kernelsndrs/86b78e869d481566223914ec7d4fc881 - https://web.archive.org/web/20200304174034/www.statamic.com/changelog#2.11.18
CVE ID: CVE-2020-9323 State: PUBLISHED Published: 2020-03-18T13:11:55 Last Updated: 2024-08-04T10:26:16.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/resources/ - https://www.aquaforest.com/en/release_history.asp - https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest/
CVE ID: CVE-2020-9324 State: PUBLISHED Published: 2020-03-18T13:13:15 Last Updated: 2024-08-04T10:26:16.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/resources/ - https://www.aquaforest.com/en/release_history.asp - https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest/
CVE ID: CVE-2020-9325 State: PUBLISHED Published: 2020-03-18T13:13:56 Last Updated: 2024-08-04T10:26:16.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/resources/ - https://www.aquaforest.com/en/release_history.asp - https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest/
CVE ID: CVE-2020-9326 State: PUBLISHED Published: 2020-03-18T14:18:50 Last Updated: 2024-08-04T10:26:16.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-5-sr1
CVE ID: CVE-2020-9327 State: PUBLISHED Published: 2020-02-21T21:25:14 Last Updated: 2024-08-04T10:26:16.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202003-16 - https://usn.ubuntu.com/4298-1/ - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.sqlite.org/cgi/src/info/9d0d4ab95dc0c56e - https://www.sqlite.org/cgi/src/info/abc473fb8fb99900 - https://www.sqlite.org/cgi/src/info/4374860b29383380 - http
56e - https://www.sqlite.org/cgi/src/info/abc473fb8fb99900 - https://www.sqlite.org/cgi/src/info/4374860b29383380 - https://security.netapp.com/advisory/ntap-20200313-0002/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-9329 State: PUBLISHED Published: 2020-02-21T21:58:23 Last Updated: 2024-08-04T10:26:16.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/issues/5926
CVE ID: CVE-2020-9330 State: PUBLISHED Published: 2020-02-21T22:47:12 Last Updated: 2024-08-04T10:26:16.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP address to a system owned by the actor without knowledge of the LDAP bind credentials. After changing the LDAP connection IP address, subsequent authentication attempts will result in the printer sending plaintext LDAP (Active Direct
nnection IP address, subsequent authentication attempts will result in the printer sending plaintext LDAP (Active Directory) credentials to the actor. Although the credentials may belong to a non-privileged user, organizations frequently use privileged service accounts to bind to Active Directory. The attacker gains a foothold on the Active Directory domain at a minimum, and may use the credentials to take over control of the Active Directory domain. This affects 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**, 72XX*, 72XXi*, 78XX**, 78XXi**, 7970**, 7970i**, EC7836**, and EC7856** devices. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.bus
C7836**, and EC7856** devices. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2020/02/cert_Security_Mini_Bulletin_XRX20D_for_ConnectKey.pdf - https://www.securicon.com/hackers-can-gain-active-directory-privileges-through-new-vulnerability-in-xerox-printers/
CVE ID: CVE-2020-9331 State: PUBLISHED Published: 2020-10-23T04:49:06 Last Updated: 2024-08-04T10:26:16.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChangeNotifyPrivilege right) because user-mode input is mishandled during process creation. An attacker can write arbitrary data to an arbitrary location in the kernel's address space. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=b5vPDmMtzwQ
CVE ID: CVE-2020-9332 State: PUBLISHED Published: 2020-06-17T16:41:03 Last Updated: 2024-08-04T10:26:16.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2020-02-19 allows privilege escalation via crafted IoCtl code related to a USB HID device. Additional Analyst Notes: - CVE Program Container: References: - https://www.fabulatech.com - https://labs.sentinelone.com/click-from-the-backyard-cve-2020-9332/
CVE ID: CVE-2020-9334 State: PUBLISHED Published: 2020-02-25T16:39:08 Last Updated: 2024-08-04T10:26:16.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/envira-gallery-lite/#developers - https://wpvulndb.com/vulnerabilities/10089
CVE ID: CVE-2020-9335 State: PUBLISHED Published: 2020-02-25T16:35:58 Last Updated: 2024-08-04T10:26:16.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/photo-gallery/#developers - https://wpvulndb.com/vulnerabilities/10088
CVE ID: CVE-2020-9336 State: PUBLISHED Published: 2020-02-22T21:38:49 Last Updated: 2024-08-04T10:26:16.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xEmma/CVEs/blob/master/CVEs/eLection-2.0-XSS.md
CVE ID: CVE-2020-9337 State: PUBLISHED Published: 2020-02-26T13:20:29 Last Updated: 2024-08-04T10:26:16.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://help.golfbuddyglobal.com/sList.asp?searchproduct=29&searchcategory=5 - https://github.com/0xEmma/CVEs/blob/master/CVEs/CVE-2020-9337-Golf-Buddy-Insecure-Passwords.md
CVE ID: CVE-2020-9338 State: PUBLISHED Published: 2020-02-22T21:38:40 Last Updated: 2024-08-04T10:26:16.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xEmma/CVEs/blob/master/CVEs/2020-02-14-SoPlanning-Admin-XSS.md
CVE ID: CVE-2020-9339 State: PUBLISHED Published: 2020-02-22T21:38:29 Last Updated: 2024-08-04T10:26:16.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning 1.45 allows XSS via the Name or Comment to status.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xEmma/CVEs/blob/master/CVEs/2020-02-14-SoPlanning-Status-XSS.md
CVE ID: CVE-2020-9340 State: PUBLISHED Published: 2020-02-22T21:50:29 Last Updated: 2024-08-04T10:26:16.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/eLection-TriPath-/blob/master/SQLiIntoRCE.md
CVE ID: CVE-2020-9341 State: PUBLISHED Published: 2020-02-22T21:50:41 Last Updated: 2024-08-04T10:26:16.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/CandidATS/blob/master/AddAdminUserCSRF.md