Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7780 State: PUBLISHED Published: 2020-11-27T16:40:10.538198Z Last Updated: 2024-09-17T04:24:28.153Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: com.softwaremill.akka-http-session:core_2.13, com.softwaremill.akka-http-session:core_2.12, com.softwaremill.akka-http-session:core_2.11 Problem Types: Cross-site Request Forgery (CSRF) Description: This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfP
com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1045352 - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046654 - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046655 - https://github.com/softwaremill/akka-http-session/issues/77 - https://github.com/softwaremill/akka-http-session/issues/74 - https://github.com/softwaremill/akka-http-session/commit/57f11663eecb84be03383d16
waremill/akka-http-session/issues/74 - https://github.com/softwaremill/akka-http-session/commit/57f11663eecb84be03383d164f655b9c5f953b41
CVE ID: CVE-2020-7781 State: PUBLISHED Published: 2020-12-16T18:10:17.314611Z Last Updated: 2024-09-16T20:02:55.768Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: connection-tester Problem Types: Command Injection Description: This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability: Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CONNECTIONTESTER-1048337 - https://github.com/skoranga/node-connection-tester/pull/10
CVE ID: CVE-2020-7782 State: PUBLISHED Published: 2021-02-08T18:35:16.305940Z Last Updated: 2024-09-16T17:18:18.398Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: spritesheet-js Problem Types: Command Injection Description: This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SPRITESHEETJS-1048333 - https://www.npmjs.com/package/spritesheet-js - https://github.com/krzysztof-o/spriteshee
SNYK-JS-SPRITESHEETJS-1048333 - https://www.npmjs.com/package/spritesheet-js - https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js%23L32
CVE ID: CVE-2020-7784 State: PUBLISHED Published: 2021-01-08T12:40:14.398059Z Last Updated: 2024-09-17T03:03:31.918Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: ts-process-promises Problem Types: command_injection Description: This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC: Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TSPROCESSPROMISES-1048334
CVE ID: CVE-2020-7785 State: PUBLISHED Published: 2021-02-08T18:25:24.429385Z Last Updated: 2024-09-16T19:05:21.724Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: node-ps Problem Types: Command Injection Description: This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEPS-1048335 - https://www.npmjs.com/package/node-ps - https://github.com/fortruce/node-ps/blob/master/lib/index.js%23L72
CVE ID: CVE-2020-7786 State: PUBLISHED Published: 2021-02-08T18:40:14.535155Z Last Updated: 2024-09-17T02:21:27.787Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: macfromip Problem Types: Command Injection Description: This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MACFROMIP-1048336 - https://www.npmjs.com/package/macfromip
CVE ID: CVE-2020-7787 State: PUBLISHED Published: 2020-12-09T16:45:13.531688Z Last Updated: 2024-09-16T17:37:54.004Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:T/RC:R) Vendors: n/a Products: react-adal Problem Types: Improper Authentication Description: This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key
caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic. Additional Analyst Notes:
s an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-REACTADAL-1018907 - https://github.com/salvoravida/react-adal/pull/115
CVE ID: CVE-2020-7788 State: PUBLISHED Published: 2020-12-11T10:45:14.077606Z Last Updated: 2024-09-16T23:41:44.616Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: ini Problem Types: Prototype Pollution Description: This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-INI-1048974 - https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 - http
s://snyk.io/vuln/SNYK-JS-INI-1048974 - https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 - https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
CVE ID: CVE-2020-7789 State: PUBLISHED Published: 2020-12-11T09:55:13.720901Z Last Updated: 2024-09-16T16:28:29.110Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: node-notifier Problem Types: Command Injection Description: This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371 - https://github.com/mikaelbr/node-notifier/blob/master/lib/util
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371 - https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303
CVE ID: CVE-2020-7790 State: PUBLISHED Published: 2020-12-11T10:50:14.306775Z Last Updated: 2024-09-16T23:11:42.099Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: spatie/browsershot Problem Types: Arbitrary File Read Description: This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-1037064 - https://github.com/spatie/browsershot/issues/441%23issue-735049731
CVE ID: CVE-2020-7791 State: PUBLISHED Published: 2020-12-11T16:55:13.146280Z Last Updated: 2024-09-16T17:14:30.053Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: i18n Problem Types: Denial of Service (DoS) Description: This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-I18N-1050179 - https://github.com/turquoiseowl/i18n/issues/387 - https://github.com/turquoiseowl/i18n/commit/c418e3345313dc896c1951d8c46
ttps://github.com/turquoiseowl/i18n/issues/387 - https://github.com/turquoiseowl/i18n/commit/c418e3345313dc896c1951d8c46ab0b9b12fcbd3 - https://lists.apache.org/thread.html/rc2abba7aa0450198494bbee654fce9b97fad72a4989323e189faede4%40%3Cdev.myfaces.apache.org%3E - https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r9744574911e7e4edf5f4eeae92a4ccc83e3723cec937950062bb8775%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r394b1ae54693609a60ea8aab02ff045dc92f593aa3aebff562e69958%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r2667286c
ea8aab02ff045dc92f593aa3aebff562e69958%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/ra5047392edf1fecba441c9adc8807ed6c5f7d2cc71f2f3bb89f35371%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rc850d0fce066f9eb9e8553172d9207bad7df4d2059d93abc5c7e85c4%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r1573c58dc283b05f7a40a3f5ff0079b5bbde0492d406ee0fe98d40b6%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3Ccommit
ache.org%3E - https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2020-7792 State: PUBLISHED Published: 2020-12-11T11:05:21.289276Z Last Updated: 2024-09-17T02:31:08.431Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: mout Problem Types: Prototype Pollution Description: This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/
leading to a Prototype Pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MOUT-1014544 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050373 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1050374 - https://github.com/mout/mout/blob/master/src/object/deepFillIn.js - https://github.com/mout/mout/blob/master/src/object/deepMixIn.js
CVE ID: CVE-2020-7793 State: PUBLISHED Published: 2020-12-11T13:25:17.521640Z Last Updated: 2024-09-16T22:45:09.822Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: ua-parser-js Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1023599 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050387 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050387 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-1050388 - https://github.com/faisalman/ua-parser-js/commit/6d1f26df051ba681463ef109d36c9cf0f7e32b18 - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
CVE ID: CVE-2020-7794 State: PUBLISHED Published: 2021-01-08T12:25:14.323104Z Last Updated: 2024-09-16T19:47:04.101Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: buns Problem Types: Command Injection Description: This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BUNS-1050389
CVE ID: CVE-2020-7795 State: PUBLISHED Published: 2022-08-02T13:27:05.665994Z Last Updated: 2024-09-16T23:16:27.065Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: get-npm-package-version Problem Types: Command Injection Description: The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-GETNPMPACKAGEVERSION-1050390 - https://www.npmjs.com/package/get-npm-package-version/v/1.0.6 - https://github.com/hoperyy/get-npm-package-version/blob/338a5882298eb2c2194538db41166cae13c39e03/inde
-version/v/1.0.6 - https://github.com/hoperyy/get-npm-package-version/blob/338a5882298eb2c2194538db41166cae13c39e03/index.js%23L17 - https://github.com/hoperyy/get-npm-package-version/commit/40b1cf31a0607ea66f9e30a0c3af1383b52b2dec
CVE ID: CVE-2020-7796 State: PUBLISHED Published: 2020-02-18T21:14:22 Last Updated: 2024-08-04T09:41:01.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7
CVE ID: CVE-2020-7799 State: PUBLISHED Published: 2020-01-28T12:46:52 Last Updated: 2024-08-04T09:41:01.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates. Additional Analyst Notes: - CVE Program Container: References: - https://fusionauth.io/docs/v1/tech/release-notes - https://seclists.org/bugtraq/2020/Jan/39 - http://packetstorm
nces: - https://fusionauth.io/docs/v1/tech/release-notes - https://seclists.org/bugtraq/2020/Jan/39 - http://packetstormsecurity.com/files/156102/FusionAuth-1.10-Remote-Command-Execution.html - https://lab.mediaservice.net/advisory/2020-03-fusionauth.txt
CVE ID: CVE-2020-7800 State: PUBLISHED Published: 2020-04-14T16:39:58 Last Updated: 2024-08-04T09:41:01.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability. The affected product is vulnerable to specially crafted TCP packets, which can cause the device to shut down or reboot and lose configuration settings. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7801, and CVE-2020-7802. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.g
CVE-2020-7801, and CVE-2020-7802. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-042-01
CVE ID: CVE-2020-7801 State: PUBLISHED Published: 2020-04-14T16:40:03 Last Updated: 2024-08-04T09:41:01.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. The affected product is vulnerable to information exposure over the SNMP protocol. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7800, and CVE-2020-7802. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-042-01
CVE ID: CVE-2020-7802 State: PUBLISHED Published: 2020-04-14T16:40:07 Last Updated: 2024-08-04T09:41:01.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-276) vulnerability. The affected product is vulnerable to insufficient default permissions, which could allow an attacker to view network configurations through SNMP communication. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7800, and CVE-2020-7801. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisor
and CVE-2020-7801. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-042-01
CVE ID: CVE-2020-7803 State: PUBLISHED Published: 2020-05-07T17:49:26 Last Updated: 2024-08-04T09:41:01.887Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IMGTech Co,Ltd Products: Zoneplayer Problem Types: CWE-20 Description: IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35346 - http://www.zoneplayer.co.kr/
CVE ID: CVE-2020-7804 State: PUBLISHED Published: 2020-04-29T14:51:24 Last Updated: 2024-08-04T09:41:01.878Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:H) Vendors: HandySoft Products: HandySoft Groupware(HShell.dll) for for Windows 7, 8, 10 Problem Types: CWE-78 Description: ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method. Additional Analyst Notes: - CVE Program Container: References: - http://www.handysoft.co.kr/product/product.html?seq=12 - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35368
CVE ID: CVE-2020-7805 State: PUBLISHED Published: 2020-05-07T17:06:25 Last Updated: 2024-08-04T09:41:01.852Z Vendors: Infomark Products: KT Slim egg IML500, KT Slim egg IML520 Problem Types: CWE-78 Description: An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35362 - http://www.infomark.co.kr/bbs/board.php?bo_table=download&wr_id=57&sfl=wr_subject&stx=520&sop=and
CVE ID: CVE-2020-7806 State: PUBLISHED Published: 2020-05-06T12:50:11 Last Updated: 2024-08-04T09:41:01.865Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Tobesoft Products: Xplatform Problem Types: CWE-494 Description: Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allows attacker to cause remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://support.tobesoft.co.kr/Support/index.html - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35359
CVE ID: CVE-2020-7807 State: PUBLISHED Published: 2020-09-14T11:55:29 Last Updated: 2024-08-04T09:41:01.946Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: LG Electronics Products: (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) Problem Types: CWE-353 Description: A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT____ of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ____ATTACKER/ATTACK____ t
_ of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: LG Electronics; LGPCSuite_Setup : 1.0.0.3 on Windows(x86, x64); IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup : 1.0.0.9 on Windows(x86, x64). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/ - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35587
CVE ID: CVE-2020-7808 State: PUBLISHED Published: 2020-05-21T18:29:07.032513Z Last Updated: 2024-09-17T03:23:55.741Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H) Vendors: RAONWIZ Inc Products: K Upload Problem Types: CWE-353, CWE-88 Description: In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35424
CVE ID: CVE-2020-7809 State: PUBLISHED Published: 2020-05-15T14:44:03 Last Updated: 2024-08-04T09:41:01.930Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: ALSong Products: Estsoft Problem Types: CWE-79 Description: ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Album(sab) file. Additional Analyst Notes: - CVE Program Container: References: - https://www.altools.co.kr/support/Notice_Contents.aspx?idx=1808&page=3&t= - https://www.boho.or.kr/krcert/secNoticeView.do
tps://www.altools.co.kr/support/Notice_Contents.aspx?idx=1808&page=3&t= - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35409
CVE ID: CVE-2020-7810 State: PUBLISHED Published: 2020-08-07T15:21:05.602805Z Last Updated: 2024-09-16T23:15:41.307Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Handysoft, Inc. Products: hslogin2.dll Problem Types: CWE-353 Description: hslogin2.dll ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. This is due to a lack of integrity verification of the policy files referenced in the update process, and a remote attacker could induce a user to crafted web page, causing damage such as malicious code infection. Additional Analyst Notes: - CVE Program