Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
.com/lists/oss-security/2020/06/08/2 - https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of - https://github.com/yunuscadirci/CallStranger - http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html - https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/ - https://github.com/corelight/callstranger-detector - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3I
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html - https://usn.ubuntu.com/4494-1/ - https://www.debian.org/security/2020/dsa-4806 - https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html - https://www.debian.org/security/2021/dsa-4898
CVE ID: CVE-2020-12696 State: PUBLISHED Published: 2020-05-07T04:39:15 Last Updated: 2024-08-04T12:04:22.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iframe plugin before 4.5 for WordPress does not sanitize a URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/iframe/#developers - https://guilhermerubert.com/blog/cve-2020-12696/
CVE ID: CVE-2020-12697 State: PUBLISHED Published: 2020-05-13T12:40:55 Last Updated: 2024-08-04T12:04:22.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2020-005
CVE ID: CVE-2020-12698 State: PUBLISHED Published: 2020-05-13T12:41:58 Last Updated: 2024-08-04T12:04:22.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2020-005
CVE ID: CVE-2020-12699 State: PUBLISHED Published: 2020-05-13T12:42:29 Last Updated: 2024-08-04T12:04:22.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2020-005
CVE ID: CVE-2020-12700 State: PUBLISHED Published: 2020-05-13T12:43:23 Last Updated: 2024-08-04T12:04:22.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2020-005
CVE ID: CVE-2020-12702 State: PUBLISHED Published: 2021-02-24T13:58:28 Last Updated: 2024-08-04T12:04:22.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US - https://dl.acm.org/doi/abs/10.1145/3411498.3419965 - https://github.com/salgio/
e/apps/details?id=com.coolkit&hl=en_US - https://dl.acm.org/doi/abs/10.1145/3411498.3419965 - https://github.com/salgio/ESPTouchCatcher - https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be
CVE ID: CVE-2020-12703 State: PUBLISHED Published: 2020-05-07T19:10:05 Last Updated: 2024-08-04T12:04:22.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: UliCMS before 2020.2 has XSS during PackageController uninstall. Additional Analyst Notes: - CVE Program Container: References: - https://en.ulicms.de/aktuelles.html?single=xss-security-issue-in-packagecontroller-fixed
CVE ID: CVE-2020-12704 State: PUBLISHED Published: 2020-05-07T19:09:51 Last Updated: 2024-08-04T12:04:22.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: UliCMS before 2020.2 has PageController stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://en.ulicms.de/aktuelles.html?single=stored-xss-security-flaw-in-pagecontroller-fixed
CVE ID: CVE-2020-12705 State: PUBLISHED Published: 2020-05-07T19:09:37 Last Updated: 2024-08-04T12:04:22.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://lepton-cms.org/posts/important-security-update-141.php
CVE ID: CVE-2020-12706 State: PUBLISHED Published: 2020-05-07T19:09:20 Last Updated: 2024-08-04T12:04:22.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php-fusion/PHP-Fusion/issues/2306 - https://github.com/php-fusion/PHP-Fusion/commit/67273e546642d39451858a47296957807c9abd5f - https://www.exploit-db.com/exploits/48404
CVE ID: CVE-2020-12707 State: PUBLISHED Published: 2020-05-07T19:09:00 Last Updated: 2024-08-04T12:04:22.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/lepton-cms/LEPTON/-/commit/52215f708395a329c9e17ea33bfc6762d4efccbb
CVE ID: CVE-2020-12708 State: PUBLISHED Published: 2020-05-07T19:07:58 Last Updated: 2024-08-04T12:04:22.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php-fusion/PHP-Fusion/issues/2310
CVE ID: CVE-2020-12712 State: PUBLISHED Published: 2020-06-11T13:18:17 Last Updated: 2024-08-04T12:04:22.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile. Additional Analyst Notes: - CVE Program Container: References: - https://www.sos-berlin.com/en/news - https://change.sos-berlin.com/browse/JOE-290 - https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+1.13.4 - http://packetstormsecurity.com/files/158112/SOS-JobScheduler-1.13.3-Stored-Password-Decrypt
lnerability+Release+1.13.4 - http://packetstormsecurity.com/files/158112/SOS-JobScheduler-1.13.3-Stored-Password-Decryption.html
CVE ID: CVE-2020-12713 State: PUBLISHED Published: 2020-06-11T01:33:53 Last Updated: 2024-08-04T12:04:22.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have multiple options to escalate their privileges to the Unix root account. Additional Analyst Notes: - CVE Program Container: References: - https://www.ciphermail.com/news.html - https://www.ciphermail.com/gateway.html - https://www.ciphermail.com/secure-webmail.html - http://packetstormsecurity.com/
tps://www.ciphermail.com/gateway.html - https://www.ciphermail.com/secure-webmail.html - http://packetstormsecurity.com/files/158001/CipherMail-Community-Virtual-Appliance-4.6.2-Code-Execution.html - https://www.ciphermail.com/blog/ciphermail-cve-2020-12713_2020-12714.html - https://www.coresecurity.com/core-labs/advisories/ciphermail-multiple-vulnerabilities
CVE ID: CVE-2020-12714 State: PUBLISHED Published: 2020-06-11T01:46:15 Last Updated: 2024-08-04T12:04:22.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow man-in-the-middle compromise of communications between CipherMail products and external SMTP clients. Additional Analyst Notes: - CVE Program Container: References: - https://www.ciphermail.com/news.html - https://www.ciphermail.com/ga
alyst Notes: - CVE Program Container: References: - https://www.ciphermail.com/news.html - https://www.ciphermail.com/gateway.html - https://www.ciphermail.com/secure-webmail.html - https://www.ciphermail.com/blog/ciphermail-cve-2020-12713_2020-12714.html - https://www.coresecurity.com/core-labs/advisories/ciphermail-multiple-vulnerabilities - https://packetstormsecurity.com/files/158001/CipherMail-Community-Virtual-Appliance-4.6.2-Code-Execution.html
CVE ID: CVE-2020-12715 State: PUBLISHED Published: 2020-09-30T20:44:15 Last Updated: 2024-08-04T12:04:22.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://www.pacsone.net/download.htm - https://github.com/bzyo/cve-pocs/tree/master/CVE-2020-12715
CVE ID: CVE-2020-12717 State: PUBLISHED Published: 2020-05-14T04:36:11 Last Updated: 2024-08-04T12:04:22.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-
l Analyst Notes: - CVE Program Container: References: - https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708
CVE ID: CVE-2020-12718 State: PUBLISHED Published: 2020-05-07T23:29:26 Last Updated: 2024-08-04T12:04:22.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php-fusion/PHP-Fusion/issues/2309
CVE ID: CVE-2020-12719 State: PUBLISHED Published: 2020-05-07T23:40:14 Last Updated: 2024-08-04T12:04:22.547Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:N/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2
onal Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665
CVE ID: CVE-2020-12720 State: PUBLISHED Published: 2020-05-07T23:52:32 Last Updated: 2024-08-04T12:04:22.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. Additional Analyst Notes: - CVE Program Container: References: - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4440032-vbulletin-5-6-1-security-patch-level-1 - http://packetstormsecurity.com/files/157716/vBulletin-5.6.1-SQL-Injection.html - http://packetstormsecurity.com/files/157904/vBulletin-5.6.1-SQL-Injection.html - https://attackerkb.com/topics/RSDAFLik92/cve-2020-12720-vbulleti
y.com/files/157904/vBulletin-5.6.1-SQL-Injection.html - https://attackerkb.com/topics/RSDAFLik92/cve-2020-12720-vbulletin-incorrect-access-control
CVE ID: CVE-2020-12723 State: PUBLISHED Published: 2020-06-05T14:20:50 Last Updated: 2024-08-04T12:04:22.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202006-03 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/Per
ecurity-announce/2020-06/msg00044.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3 - https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod - https://security.netapp.com/advisory/ntap-20200611-0001/ - https://github.com/Perl/perl5/issues/16947 - https://github.com/Perl/perl5/issues/17743 - https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.co
le.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-12725 State: PUBLISHED Published: 2020-06-11T18:50:28 Last Updated: 2024-08-04T12:04:22.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding headers, selecting any HTTP verb, etc. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redash.io - https://github.com/getredash/redash/commits/master - https://github.com/getredash/redash/issues/4869
CVE ID: CVE-2020-12729 State: PUBLISHED Published: 2021-07-15T14:55:58 Last Updated: 2024-08-04T12:04:22.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors. Additional Analyst Notes: - CVE Program Container: References: - http://www.magicsmotion.com/p-flamingo.html
CVE ID: CVE-2020-12730 State: PUBLISHED Published: 2021-07-15T14:55:53 Last Updated: 2024-08-04T12:04:22.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery. Additional Analyst Notes: - CVE Program Container: References: - http://www.magicsmotion.com/p-flamingo.html - https://cwe.mitre.org/data/definitions/319.html
CVE ID: CVE-2020-12731 State: PUBLISHED Published: 2021-07-15T14:55:48 Last Updated: 2024-08-04T12:04:22.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other applications. Additional Analyst Notes: - CVE Program Container: References: - http://www.magicsmotion.com/p-flamingo.html
CVE ID: CVE-2020-12732 State: PUBLISHED Published: 2021-07-15T15:04:11 Last Updated: 2024-08-04T12:04:22.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678. Additional Analyst Notes: - CVE Program Container: References: - https://www.depstech.com/mw001-s02-wifi-usb-digital-microscope - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf
CVE ID: CVE-2020-12733 State: PUBLISHED Published: 2021-07-15T15:04:04 Last Updated: 2024-08-04T12:04:22.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the molinkadmin password for the molink account. Additional Analyst Notes: - CVE Program Container: References: - https://www.depstech.com/mw001-s02-wifi-usb-digital-microscope - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf
CVE ID: CVE-2020-12734 State: PUBLISHED Published: 2021-07-15T15:03:56 Last Updated: 2024-08-04T12:04:22.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful device owner, because there is no way to reset to Factory Default settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.depstech.com/mw001-s02-wifi-usb-digital-microscope - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf
CVE ID: CVE-2020-12735 State: PUBLISHED Published: 2020-05-08T04:27:10 Last Updated: 2024-08-04T12:04:22.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/122
CVE ID: CVE-2020-12736 State: PUBLISHED Published: 2020-07-07T19:33:40 Last Updated: 2024-08-04T12:04:22.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection. Additional Analyst Notes: - CVE Program Container: References: - ht
potentially resulting in server-side code injection. Additional Analyst Notes: - CVE Program Container: References: - https://support.code42.com/Release_Notes - https://code42.com/r/support/CVE-2020-12736
CVE ID: CVE-2020-12737 State: PUBLISHED Published: 2020-05-08T15:49:58 Last Updated: 2024-08-04T12:04:22.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.maxum.com/Rumpus/Overview.html - https://gist.github.com/escaped-com/83d89a05067c62e95992d42bbfa58933
CVE ID: CVE-2020-12739 State: PUBLISHED Published: 2020-08-03T16:35:24 Last Updated: 2024-08-04T12:04:22.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause an affected CNC to become inaccessible to other devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.fanuc.co.jp/eindex.html - http://jvn.jp/en/jp/JVN84959128/index.html - https://jvn.jp/en/jp/JVN84959128/index.html - https://jvn.jp/jp/JVN84959128/index.html
CVE ID: CVE-2020-12740 State: PUBLISHED Published: 2020-05-08T17:03:56 Last Updated: 2024-08-04T12:04:22.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/576 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4YAT4AGTHQKB74ETOQPJMV67TSDIAPOC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UOSEIQ3D2O
7TSDIAPOC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UOSEIQ3D2OONCJEVMGC2TYBC2QX4E5EJ/
CVE ID: CVE-2020-12742 State: PUBLISHED Published: 2020-05-13T12:45:45 Last Updated: 2024-08-04T12:04:22.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/iubenda-cookie-law-solution/#developers - https://github.com/iubenda/iubenda-cookie-class/commit/545e0586320ae6f16204ba548cf533ef75dc2fbd
CVE ID: CVE-2020-12743 State: PUBLISHED Published: 2020-05-11T12:32:59 Last Updated: 2024-08-04T12:04:22.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hidden_req POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/gazie/code/3823/
CVE ID: CVE-2020-12744 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T18:07:40.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bwiltse/verint - https://github.com/bwiltse/cve/blob/master/Verint/Verint-CVE-2020-12744.txt
CVE ID: CVE-2020-12745 State: PUBLISHED Published: 2020-05-11T15:05:17 Last Updated: 2024-08-04T12:04:22.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass the locked-state protection mechanism and access clipboard content via USSD. The Samsung ID is SVE-2019-16556 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb