Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35339 State: PUBLISHED Published: 2021-02-17T14:32:11 Last Updated: 2024-08-04T17:02:07.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server. Additional Analyst Notes: - CVE Program Container: References: - http://www.74cms.com/download/index.html - https://github.com/BigTiger2020/74cms-rce/blob/main/README.md
CVE ID: CVE-2020-35340 State: PUBLISHED Published: 2021-09-15T11:27:26 Last Updated: 2024-08-04T17:02:07.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the running ExpertPDF process has access to read. Additional Analyst Notes: - CVE Program Container: References: - https://optionalctf.com/cve-2020-35340-local-file-inclusion-in-expertpdf-9-5-0-14-1-0/
CVE ID: CVE-2020-35342 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T19:22:40.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=25319 - https://security.netapp.com/advisory/ntap-20231006-0009/
CVE ID: CVE-2020-35346 State: PUBLISHED Published: 2020-12-26T03:04:32 Last Updated: 2024-08-04T17:02:07.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cbkhwx/cxuucmsv3/issues/4
CVE ID: CVE-2020-35347 State: PUBLISHED Published: 2020-12-26T03:05:36 Last Updated: 2024-08-04T17:02:07.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cbkhwx/cxuucmsv3/issues/5
CVE ID: CVE-2020-35349 State: PUBLISHED Published: 2020-12-26T03:42:23 Last Updated: 2024-08-04T17:02:08.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49196
CVE ID: CVE-2020-35357 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-12-07T21:02:36.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?59624 - https://git.savannah.gnu.org/cgit/gsl.git/commit/?id=989a193268b963aa1047814f7f
- https://savannah.gnu.org/bugs/?59624 - https://git.savannah.gnu.org/cgit/gsl.git/commit/?id=989a193268b963aa1047814f7f1402084fb7d859 - https://lists.debian.org/debian-lts-announce/2023/09/msg00023.html
CVE ID: CVE-2020-35358 State: PUBLISHED Published: 2021-03-15T11:55:53 Last Updated: 2024-08-04T17:02:08.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7
CVE ID: CVE-2020-35359 State: PUBLISHED Published: 2020-12-26T04:30:32 Last Updated: 2024-08-04T17:02:07.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49105
CVE ID: CVE-2020-35362 State: PUBLISHED Published: 2020-12-26T05:19:10 Last Updated: 2024-08-04T17:02:07.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker must provide the correct fileOrgName value). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kbgsft/vuln-dext5upload/wiki/File-Download-Vulnerability-in-DEXT5Upload-2.7.1262310-by-xcuter
CVE ID: CVE-2020-35364 State: PUBLISHED Published: 2020-12-26T18:20:14 Last Updated: 2024-08-04T17:02:07.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yangfan6888/PoC - https://github.com/yangfan6888/PoC/blob/main/PoC.cpp
CVE ID: CVE-2020-35370 State: PUBLISHED Published: 2020-12-23T18:40:49 Last Updated: 2024-08-04T17:02:08.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code execution(RCE) on the hosting server. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49265
CVE ID: CVE-2020-35373 State: PUBLISHED Published: 2021-06-17T15:50:28 Last Updated: 2024-08-04T17:02:07.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack. Additional Analyst Notes: - CVE Program Container: References: - http://loganclaw.com/2020/12/07/fiyo-cms-reflected-xss/
CVE ID: CVE-2020-35376 State: PUBLISHED Published: 2020-12-26T03:30:15 Last Updated: 2024-08-04T17:02:08.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=42066 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZUU5QG6SSVRTKZTR3A72LDRVZETEI63/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLOYVJSM54IL6I5RY4QTJGRS
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLOYVJSM54IL6I5RY4QTJGRS7PIEG44X/
CVE ID: CVE-2020-35378 State: PUBLISHED Published: 2020-12-14T15:44:23 Last Updated: 2024-08-04T17:02:08.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49212
CVE ID: CVE-2020-35380 State: PUBLISHED Published: 2020-12-15T20:12:11 Last Updated: 2024-08-04T17:02:08.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tidwall/gjson/issues/192
CVE ID: CVE-2020-35381 State: PUBLISHED Published: 2020-12-15T20:14:09 Last Updated: 2024-08-04T17:02:08.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/buger/jsonparser/issues/219 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27EA7OGCELV7QFAGVIHODHWKMKGFVIUZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LJO5N7YTDEUSTKYTNA372CE6VHCZJWUG/
CVE ID: CVE-2020-35382 State: PUBLISHED Published: 2020-12-14T15:52:33 Last Updated: 2024-08-04T17:02:08.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craigrodway/classroombookings/issues/27
CVE ID: CVE-2020-35388 State: PUBLISHED Published: 2020-12-26T02:38:32 Last Updated: 2024-08-04T17:02:08.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuechengen/xinhu-oa/blob/main/README.md
CVE ID: CVE-2020-35391 State: PUBLISHED Published: 2021-01-01T00:00:00 Last Updated: 2024-08-04T17:02:08.149Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP
ename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40signalhilltech/tenda-n300-authentication-bypass-via-malformed-http-request-header-5b8744ca685e - http://packetstormsecurity.com/files/171773/Tenda-N300-F3-12.01.01.48-Header-Processing.html
CVE ID: CVE-2020-35395 State: PUBLISHED Published: 2020-12-15T15:38:55 Last Updated: 2024-08-04T17:02:08.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScript code via the 'description' field Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49146 - https://nikhilkumar01.medium.com/cve-2020-35395-cd393ac8371c
CVE ID: CVE-2020-35396 State: PUBLISHED Published: 2020-12-15T15:45:18 Last Updated: 2024-08-04T17:02:08.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanmedia.com/ - https://www.exploit-db.com/exploits/49227 - https://nikhilkumar01.medium.com/cve-2020-35396-f4b5675fb168
CVE ID: CVE-2020-35398 State: PUBLISHED Published: 2021-12-23T21:10:36 Last Updated: 2024-08-04T17:02:08.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.utimutualfunds.utimutualfund&hl=en_IN&gl=US - https://cvewalkthrough.com/cve-2020-35398-uti-mutual-fund-android-application-username-enumeration/
CVE ID: CVE-2020-35416 State: PUBLISHED Published: 2020-12-15T20:50:43 Last Updated: 2024-08-04T17:02:08.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/160502/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html - http://packetstormsecurity.com/files/160600/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html - https://www
http://packetstormsecurity.com/files/160600/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/49281
CVE ID: CVE-2020-35418 State: PUBLISHED Published: 2021-04-14T16:11:16 Last Updated: 2024-08-04T17:02:07.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/12/group-office-crm-stored-xss-via-svg-file.html
CVE ID: CVE-2020-35419 State: PUBLISHED Published: 2021-04-14T16:11:14 Last Updated: 2024-08-04T17:02:08.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.github.io/posts/Group-Office-CRM-Stored-XSS-via-SVG-File/
CVE ID: CVE-2020-35427 State: PUBLISHED Published: 2021-07-20T13:22:44 Last Updated: 2024-08-04T17:02:07.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in PHPGurukul Employee Record Management System 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/ - https://www.exploit-db.com/exploits/49165
CVE ID: CVE-2020-35430 State: PUBLISHED Published: 2021-04-29T16:21:12 Last Updated: 2024-08-04T17:02:08.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsystem. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/inxeduopen/inxedu/issues/I294XL
CVE ID: CVE-2020-35437 State: PUBLISHED Published: 2020-12-26T03:58:04 Last Updated: 2024-08-04T17:02:08.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/880 - http://packetstormsecurity.com/files/160783/Subrion-CMS-4.2.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-35438 State: PUBLISHED Published: 2021-05-11T12:43:19 Last Updated: 2024-08-04T17:02:07.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kamalkhan/kk-star-ratings/blob/master/CHANGELOG.md - https://github.com/kamalkhan/kk-star-ratings/blob/master/CHANGELOG.md#415---2020-12-13
CVE ID: CVE-2020-35441 State: PUBLISHED Published: 2021-06-02T21:40:26 Last Updated: 2024-08-04T17:02:08.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.ttk7.cn/post-141.html
CVE ID: CVE-2020-35442 State: PUBLISHED Published: 2021-06-02T21:40:33 Last Updated: 2024-08-04T17:02:08.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background via Front/lib/Action/FindexAction.class.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.ttk7.cn/post-142.html
CVE ID: CVE-2020-35448 State: PUBLISHED Published: 2020-12-27T03:38:54 Last Updated: 2024-08-04T17:02:08.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=26574 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=8642dafaef21aa6747cec01df1977e9c52eb4679 - https://security.netapp
/sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=8642dafaef21aa6747cec01df1977e9c52eb4679 - https://security.netapp.com/advisory/ntap-20210129-0008/ - https://security.gentoo.org/glsa/202107-24
CVE ID: CVE-2020-35450 State: PUBLISHED Published: 2020-12-26T04:14:05 Last Updated: 2024-08-04T17:02:08.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gobby/gobby/pull/184
CVE ID: CVE-2020-35451 State: PUBLISHED Published: 2021-03-09T15:20:13.000Z Last Updated: 2025-02-13T16:27:42.773Z Vendors: Apache Software Foundation Products: Apache Oozie Problem Types: CWE-377 Description: There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E - https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.
- https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/03/09/2
CVE ID: CVE-2020-35452 State: PUBLISHED Published: 2021-06-10T07:10:21 Last Updated: 2024-08-04T17:02:08.055Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: mod_auth_digest possible stack overflow by one nul byte Description: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow Additional Analyst Note
ed consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow Additional Analyst Notes: - CVE Program Container: References: - http://httpd.apache.org/security/vulnerabilities_24.html - https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E - https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/10/5 - https://lists.debian.org/debian-lts-an
v.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/10/5 - https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html - https://www.debian.org/security/2021/dsa-4937 - https://security.gentoo.org/glsa/202107-38 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210702-0001/
CVE ID: CVE-2020-35453 State: PUBLISHED Published: 2020-12-17T04:22:34 Last Updated: 2024-08-04T17:02:07.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161 - https://discuss.hashicorp.com/t/hcsec-2020-24-vault-enterprise-s-sentinel-egp-policies-may-impact-parent-or-sibling-namespaces/18983
CVE ID: CVE-2020-35454 State: PUBLISHED Published: 2021-03-17T14:58:58 Last Updated: 2024-08-04T17:02:07.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup because of insecure application configuration. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.taidii.diibear&hl=en_US&gl=US - https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/
CVE ID: CVE-2020-35455 State: PUBLISHED Published: 2021-03-17T14:58:14 Last Updated: 2024-08-04T17:02:08.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and the SQLite database because of insecure data storage. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.taidii.diibear&hl=en_US&gl=US - https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/
CVE ID: CVE-2020-35456 State: PUBLISHED Published: 2021-03-17T14:56:44 Last Updated: 2024-08-04T17:02:08.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logcat because of excessive logging. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.taidii.diibear&hl=en_US&gl=US - https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/