Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12414 State: PUBLISHED Published: 2020-07-09T14:56:06 Last Updated: 2024-08-04T11:56:51.933Z Vendors: Mozilla Products: Firefox for iOS Problem Types: IndexedDB persists in private browsing mode Description: IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-23/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1646756
CVE ID: CVE-2020-12415 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.740Z Vendors: Mozilla Products: Firefox Problem Types: AppCache manifest poisoning due to url encoded character processing Description: When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1586630
ences: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1586630 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12416 State: PUBLISHED Published: 2020-07-09T14:40:59 Last Updated: 2024-08-04T11:56:52.058Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free in WebRTC VideoBroadcaster Description: A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1639734 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html -
illa.mozilla.org/show_bug.cgi?id=1639734 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12417 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.772Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Memory corruption due to missing sign-extension for ValueTags on ARM64 Description: Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfs
8.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - https://www.mozilla.org/security/advisories/mfsa2020-25/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1640737 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://s
announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12418 State: PUBLISHED Published: 2020-07-09T14:19:50 Last Updated: 2024-08-04T11:56:51.647Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Information disclosure due to manipulated URL object Description: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - https://www.mozilla.org/security/advisori
ries/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - https://www.mozilla.org/security/advisories/mfsa2020-25/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1641303 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12419 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.741Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Use-after-free in nsGlobalWindowInner Description: When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla
s: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - https://www.mozilla.org/security/advisories/mfsa2020-25/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1643874 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://security.gentoo.org/glsa/202007-
- https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12420 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.667Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Use-After-Free when trying to connect to a STUN server Description: When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - h
https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - https://www.mozilla.org/security/advisories/mfsa2020-25/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1643437 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12421 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.888Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Add-On updates did not respect the same certificate trust rules as software updates Description: When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://
8.10, Firefox < 78, and Thunderbird < 68.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://www.mozilla.org/security/advisories/mfsa2020-26/ - https://www.mozilla.org/security/advisories/mfsa2020-25/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1308251 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://securit
//lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://usn.ubuntu.com/4421-1/ - https://security.gentoo.org/glsa/202007-09 - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12422 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.717Z Vendors: Mozilla Products: Firefox Problem Types: Integer overflow in nsJPEGEncoder::emptyOutputBuffer Description: In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1450353 - http://lists.opensuse.org/opensuse-securit
isories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1450353 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12423 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.761Z Vendors: Mozilla Products: Firefox Problem Types: DLL Hijacking due to searching %PATH% for a library Description: When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have loaded the DLL, leading to arbitrary code execution. *Note: This issue only affects the Windows operating system; other operating systems are unaffected.* This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/
ditional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1642400 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html
CVE ID: CVE-2020-12424 State: PUBLISHED Published: 2020-07-09T13:55:56 Last Updated: 2024-08-04T11:56:51.800Z Vendors: Mozilla Products: Firefox Problem Types: WebRTC permission prompt could have been bypassed by a compromised content process Description: When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1562600 - ht
: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1562600 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12425 State: PUBLISHED Published: 2020-07-09T14:39:37 Last Updated: 2024-08-04T11:56:51.782Z Vendors: Mozilla Products: Firefox Problem Types: Out of bound read in Date.parse() Description: Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1634738 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-s
4738 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12426 State: PUBLISHED Published: 2020-07-09T14:39:36 Last Updated: 2024-08-04T11:56:52.069Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 78 Description: Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1608068%2C1609951%2C16311
mozilla.org/security/advisories/mfsa2020-24/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1608068%2C1609951%2C1631187%2C1637682 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html - https://security.gentoo.org/glsa/202007-10
CVE ID: CVE-2020-12427 State: PUBLISHED Published: 2020-05-13T14:28:31 Last Updated: 2024-08-04T11:56:51.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-20004-wd-discovery-cross-site-request-forgery-csrf
CVE ID: CVE-2020-12429 State: PUBLISHED Published: 2020-04-28T19:02:46 Last Updated: 2024-08-04T11:56:51.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass in the login pages: admin/change-password.php, admin/check_availability.php, admin/index.php, change-password.php, check_availability.php, includes/header.php, index.php, and pincode-verification.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48385
CVE ID: CVE-2020-12430 State: PUBLISHED Published: 2020-04-28T00:00:00 Last Updated: 2024-08-04T11:56:52.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=18
service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1804548 - https://bugzilla.redhat.com/show_bug.cgi?id=1828190 - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581 - https://security.netapp.com/advisory/ntap-20200518-0003/ - https://usn.ubuntu.com/4371-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/ - https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
CVE ID: CVE-2020-12431 State: PUBLISHED Published: 2020-05-21T16:16:21 Last Updated: 2024-08-04T11:56:52.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with resultant DLL hijacking. This product is bundled with Splashtop Streamer (before 3.3.8.0) and Splashtop Business (before 3.3.8.0). Additional Analyst Notes: - CVE Program Container: References: - https://support-splashtopbusiness.splasht
ore 3.3.8.0). Additional Analyst Notes: - CVE Program Container: References: - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/360042648231-Splashtop-Streamer-version-3-3-8-0-for-Windows-released-includes-SOS-version-3-3-8-0 - https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer
CVE ID: CVE-2020-12432 State: PUBLISHED Published: 2020-07-21T13:39:27 Last Updated: 2024-08-04T11:56:52.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken. Additional Analyst Notes: - CVE Program C
iated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=_tkRnSr6yc0 - https://github.com/d7x/CVE-2020-12432
CVE ID: CVE-2020-12438 State: PUBLISHED Published: 2020-04-28T20:51:35 Last Updated: 2024-08-04T11:56:51.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8 - https://github.com/php-fusion/PHP-Fusion/issues/2307
CVE ID: CVE-2020-12439 State: PUBLISHED Published: 2020-05-05T21:19:39 Last Updated: 2024-08-04T11:56:52.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mimblewimble/grin/pull/3236 - https://github.com/mimblewimble/grin-security/blob/master/CVEs/CVE-2020-12439.md - https://github.com/mimblewimble/grin/issues/3235
CVE ID: CVE-2020-12440 State: REJECTED Published: 2020-05-14T20:18:10 Last Updated: 2020-05-20T14:26:18 Description: No description available.
CVE ID: CVE-2020-12441 State: PUBLISHED Published: 2020-08-06T18:53:54 Last Updated: 2024-08-04T11:56:52.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1 - https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite/
CVE ID: CVE-2020-12442 State: PUBLISHED Published: 2020-04-28T21:54:06 Last Updated: 2024-08-04T11:56:52.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SQL-Injection-Vulnerability-in-Avalanche
CVE ID: CVE-2020-12443 State: PUBLISHED Published: 2020-04-29T01:48:39 Last Updated: 2024-08-04T11:56:52.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive. Ad
pted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mclab-hbrs/BBB-POC - https://github.com/bigbluebutton/bigbluebutton/pull/9259/commits/b21ca8355a57286a1e6df96984b3a4c57679a463
CVE ID: CVE-2020-12446 State: PUBLISHED Published: 2020-04-29T13:54:28 Last Updated: 2024-08-04T11:56:51.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register (MSR) registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-003.md
CVE ID: CVE-2020-12447 State: PUBLISHED Published: 2020-04-29T02:28:51 Last Updated: 2024-08-04T11:56:52.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spookysec.net/onkyo-lfi/
CVE ID: CVE-2020-12448 State: PUBLISHED Published: 2020-05-07T16:20:49 Last Updated: 2024-08-04T11:56:52.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/