Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15787 State: PUBLISHED Published: 2020-09-09T18:11:40 Last Updated: 2024-08-04T13:22:30.904Z Vendors: Siemens Products: SIMATIC HMI Unified Comfort Panels Problem Types: CWE-305 Description: A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.si
Server via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf
CVE ID: CVE-2020-15788 State: PUBLISHED Published: 2020-09-09T18:11:42 Last Updated: 2024-08-04T13:22:30.762Z Vendors: Siemens AG Products: Polarion Subversion Webclient Problem Types: CWE-80 Description: A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a way that prevents Cross-Site Scripting. If a user is enticed into passing specially crafted, malicious input to the web client (e.g. by clicking on a malicious URL with embedded JavaScript), then JavaScript code can be returned and may then be executed by the user’s client. Various actions could be triggered by running malicious JavaScr
returned and may then be executed by the user’s client. Various actions could be triggered by running malicious JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf
CVE ID: CVE-2020-15789 State: PUBLISHED Published: 2020-09-09T18:11:44 Last Updated: 2024-08-04T13:22:30.839Z Vendors: Siemens AG Products: Polarion Subversion Webclient Problem Types: CWE-352 Description: A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allo
low an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify contents of the web application. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf
CVE ID: CVE-2020-15790 State: PUBLISHED Published: 2020-09-09T18:12:56 Last Updated: 2024-08-04T13:22:30.867Z Vendors: Siemens AG Products: Spectrum Power 4 Problem Types: CWE-548 Description: A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server might be susceptible to a directory listing attack. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf
CVE ID: CVE-2020-15791 State: PUBLISHED Published: 2020-09-09T18:13:11 Last Updated: 2024-08-04T13:22:30.753Z Vendors: Siemens Products: SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-400 CPU family (incl. SIPLUS variants), SIMATIC WinAC RTX (F) 2010, SINUMERIK 840D sl Problem Types: CWE-522 Description: A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 CPU family (incl. SIPLUS variants) (All versions), SIMATIC WinAC RTX (F) 2010 (All versions), SINUMERIK 840D sl (All versions). The authentication protocol between a client and a PLC via port 102/tcp (ISO-TSAP) in
SINUMERIK 840D sl (All versions). The authentication protocol between a client and a PLC via port 102/tcp (ISO-TSAP) insufficiently protects the transmitted password. This could allow an attacker that is able to intercept the network traffic to obtain valid PLC credentials. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf
CVE ID: CVE-2020-15792 State: PUBLISHED Published: 2020-10-15T18:45:33 Last Updated: 2024-08-04T13:22:30.868Z Vendors: Siemens Products: Desigo Insight Problem Types: CWE-89 Description: A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05
CVE ID: CVE-2020-15793 State: PUBLISHED Published: 2020-10-15T18:45:33 Last Updated: 2024-08-04T13:22:30.858Z Vendors: Siemens Products: Desigo Insight Problem Types: CWE-1021 Description: A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user to click on a website controlled by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf - https://us-cert
- CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05
CVE ID: CVE-2020-15794 State: PUBLISHED Published: 2020-10-15T18:45:34 Last Updated: 2024-08-04T13:30:21.663Z Vendors: Siemens Products: Desigo Insight Problem Types: CWE-200 Description: A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05
CVE ID: CVE-2020-15795 State: PUBLISHED Published: 2021-04-22T20:42:19 Last Updated: 2024-08-04T13:30:21.684Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Nucleus NET, Nucleus Source Code, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-787 Description: A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Et
t (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name label parsing functionality does not properly validate the names in DNS-responses. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or
leged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
CVE ID: CVE-2020-15796 State: PUBLISHED Published: 2020-12-14T21:05:18 Last Updated: 2024-08-04T13:30:21.823Z Vendors: Siemens Products: SIMATIC ET 200SP Open Controller (incl. SIPLUS variants), SIMATIC S7-1500 Software Controller Problem Types: CWE-248 Description: A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software Controller (V20.8). The web server of the affected products contains a vulnerability that could allow a remote attacker to trigger a denial-of-service condition by sending a specially crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/
crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-700697.pdf
CVE ID: CVE-2020-15797 State: PUBLISHED Published: 2020-10-13T15:30:19 Last Updated: 2024-08-04T13:30:21.872Z Vendors: Siemens Products: DCA Vantage Analyzer Problem Types: CWE-269 Description: A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-2020-15797). Improper Access Control could allow an unauthenticated attacker to escape from the restricted environment (“kiosk mode”) and access the underlying operating system. Successful exploitation requires direct physical access to the system. Additional Analyst Notes: - CVE Program Container: Reference
exploitation requires direct physical access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.siemens-healthineers.com/support-documentation/security-advisory
CVE ID: CVE-2020-15798 State: PUBLISHED Published: 2021-02-09T15:38:17 Last Updated: 2024-08-04T13:30:21.706Z Vendors: Siemens Products: SIMATIC HMI Comfort Panels (incl. SIPLUS variants), SIMATIC HMI KTP Mobile Panels, SINAMICS GH150, SINAMICS GL150 (with option X30), SINAMICS GM150 (with option X30), SINAMICS SH150, SINAMICS SL150, SINAMICS SM120, SINAMICS SM150, SINAMICS SM150i Problem Types: CWE-306 Description: A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (
sions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-033-02 - https://cert-portal.sieme
.com/productcert/pdf/ssa-520004.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-033-02 - https://cert-portal.siemens.com/productcert/pdf/ssa-752103.pdf
CVE ID: CVE-2020-15799 State: PUBLISHED Published: 2021-01-12T20:18:33 Last Updated: 2024-08-04T13:30:21.812Z Vendors: Siemens Products: SCALANCE X-200 switch family (incl. SIPLUS NET variants), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) Problem Types: CWE-306 Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products. Additional Analyst Notes: - CVE
the network by using special urls from integrated web server of the affected products. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf
CVE ID: CVE-2020-15800 State: PUBLISHED Published: 2021-01-12T20:18:33 Last Updated: 2024-08-04T13:30:21.877Z Vendors: Siemens Products: SCALANCE X-200 switch family (incl. SIPLUS NET variants), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) Problem Types: CWE-122 Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). The webserver of the affected devices contain
witch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). The webserver of the affected devices contains a vulnerability that may lead to a heap overflow condition. An attacker could cause this condition on the webserver by sending specially crafted requests. This could stop the webserver temporarily. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf
CVE ID: CVE-2020-15801 State: PUBLISHED Published: 2020-07-17T02:15:04 Last Updated: 2024-08-04T13:30:21.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue41304 - https://github.com/python/cpython/pull/21495 - https://security.netapp.com/advisory/ntap-20200731-0003/
CVE ID: CVE-2020-15802 State: PUBLISHED Published: 2020-09-11T13:07:22 Last Updated: 2024-08-04T13:30:21.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less. Additional Analyst Notes: - CVE Program Container: Refer
nticated key, or a key with greater entropy with one with less. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/589825 - https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709 - https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
CVE ID: CVE-2020-15803 State: PUBLISHED Published: 2020-07-17T00:00:00 Last Updated: 2024-08-04T13:30:22.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-18057 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRIMOXH6GSBAANDCB3ANLJK4CRLWRXT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZHHIUYIVA5GZYLKW6A5G6HRELPOBZFE/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZHHIUYIVA5GZYLKW6A5G6HRELPOBZFE/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00007.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
CVE ID: CVE-2020-15806 State: PUBLISHED Published: 2020-07-22T18:14:43 Last Updated: 2024-08-04T13:30:22.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. Additional Analyst Notes: - CVE Program Container: References: - https://www.codesys.com - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download= - https://www.tenable.com/security/research/tra-2020-46
CVE ID: CVE-2020-15807 State: PUBLISHED Published: 2020-07-17T15:35:44 Last Updated: 2024-08-04T13:30:22.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/186 - https://github.com/LibreDWG/libredwg/issues/189 - https://github.com/LibreDWG/libredwg/issues/190
CVE ID: CVE-2020-15809 State: PUBLISHED Published: 2021-03-24T16:54:47 Last Updated: 2024-08-04T13:30:21.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd. Additional Analyst Notes: - CVE Program Container: References: - https://support.spinetix.com/wiki/SpinetiX-SA-20:01 - https://support.spinetix.com/wiki/DSOS_release_notes
CVE ID: CVE-2020-15810 State: PUBLISHED Published: 2020-09-02T16:34:04 Last Updated: 2024-08-04T13:30:21.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a p
arsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m - https://www.debian.org/security/2020/dsa-4751 - https://usn.ubuntu.com/4477-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/ - https://lists.fedoraproject.org/
/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/ - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/ - https://usn.ubuntu.com/4551-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html - https://security.netapp.com/advisory/ntap-20210219-0007/ - https://security.netapp.com/adv
ounce/2020/10/msg00005.html - https://security.netapp.com/advisory/ntap-20210219-0007/ - https://security.netapp.com/advisory/ntap-20210226-0007/ - https://security.netapp.com/advisory/ntap-20210226-0006/
CVE ID: CVE-2020-15811 State: PUBLISHED Published: 2020-09-02T16:35:04 Last Updated: 2024-08-04T13:30:22.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request insi
of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-c7p8-xqhm-49wv - https://www.debian.org/security/2020/dsa-4751 - https://usn.ubuntu.com/4477-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/ - https://li
ject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/ - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/ - https://usn.ubuntu.com/4551-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html - https://security.netapp.com/advisory/ntap-20210219-0007/ - https://s
ian.org/debian-lts-announce/2020/10/msg00005.html - https://security.netapp.com/advisory/ntap-20210219-0007/ - https://security.netapp.com/advisory/ntap-20210226-0007/ - https://security.netapp.com/advisory/ntap-20210226-0006/
CVE ID: CVE-2020-15813 State: PUBLISHED Published: 2020-07-17T18:05:06 Last Updated: 2024-08-04T13:30:21.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code (in all versions that support LDAP) does not implement proper certificate validation (regardless of whether the "Allow self-signed certificates" option is used). Therefore, any attacker with the ability to intercept network traffic between a Graylog server and
tes" option is used). Therefore, any attacker with the ability to intercept network traffic between a Graylog server and an LDAP server is able to redirect traffic to a different LDAP server (unnoticed by the Graylog server due to the lack of certificate validation), effectively bypassing Graylog's authentication mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Graylog2/graylog2-server/issues/5906
CVE ID: CVE-2020-15816 State: PUBLISHED Published: 2020-07-17T19:16:07 Last Updated: 2024-08-04T13:30:22.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability