Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5278 State: PUBLISHED Published: 2020-04-20T16:50:24 Last Updated: 2024-08-04T08:22:09.087Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrpj-67mq-3fr5 - https://github.com/PrestaShop/PrestaShop/commit/ea85210d6e5d81f058b55764bc4608cdb0b36c5d
CVE ID: CVE-2020-5279 State: PUBLISHED Published: 2020-04-20T16:50:18 Last Updated: 2024-08-04T08:22:09.090Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-284 Description: In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index
-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-74vp-ww64-w2gm - https://github.com/PrestaShop/PrestaShop/commit/4444fb85761667a2206874a3112ccc77f657d76a
CVE ID: CVE-2020-5280 State: PUBLISHED Published: 2020-03-25T17:45:17 Last Updated: 2024-08-04T08:22:09.104Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: http4s Products: http4s Problem Types: CWE-23 Description: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in vers
whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6 - https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec - https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca - https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b
CVE ID: CVE-2020-5281 State: PUBLISHED Published: 2020-03-25T18:00:20 Last Updated: 2024-08-04T08:22:09.083Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: CESNET Products: perun Problem Types: CWE-90 Description: In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3 - https://github.com/CESNET/perun/pull/2635 - https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360c
https://github.com/CESNET/perun/pull/2635 - https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039
CVE ID: CVE-2020-5282 State: PUBLISHED Published: 2020-03-25T18:15:14 Last Updated: 2024-08-04T08:22:09.078Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Nick Chan Products: nickchanbot Problem Types: CWE-78 Description: In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Assfugil/nickchanbot/security/advisories/GHSA-8xwp-r7pj-cgw3 - https://github.com/Assfugil/nickchanbot/commit/d7dc87523fc8bb6b
il/nickchanbot/security/advisories/GHSA-8xwp-r7pj-cgw3 - https://github.com/Assfugil/nickchanbot/commit/d7dc87523fc8bb6babbf8d636c339193b236a3ba
CVE ID: CVE-2020-5283 State: PUBLISHED Published: 2020-04-03T00:10:13 Last Updated: 2024-08-04T08:22:09.095Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: viewvc Products: viewvc Problem Types: CWE-80 Description: ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to ru
ck vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/viewvc/viewvc/security/advisories/GHSA-xpxf-fvqv-7mfg - https://github.com/viewvc/viewvc/issues/211 - https://github.com/viewvc/viewvc/commit/ad0f966e9a997b17d853a6972ea283d4dcd70fa8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2Q2STF2MKT24HXZ3YZIU7CN6F6QM67I5/
CVE ID: CVE-2020-5284 State: PUBLISHED Published: 2020-03-30T20:40:11 Last Updated: 2024-08-04T08:22:09.087Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: zeit Products: next.js Problem Types: CWE-23 Description: Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2. Additional Analyst Notes: - CVE Program Container: Ref
ssets under this directory. This issue is fixed in version 9.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj - https://github.com/zeit/next.js/releases/tag/v9.3.2
CVE ID: CVE-2020-5285 State: PUBLISHED Published: 2020-04-20T16:50:13 Last Updated: 2024-08-04T08:22:09.085Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-j3r6-33hf-m8wh - https://github.com/PrestaShop/PrestaShop/commit/b6aea152988d81e1586f1c03f2e72c9ef2fe7df7
CVE ID: CVE-2020-5286 State: PUBLISHED Published: 2020-04-20T16:55:33 Last Updated: 2024-08-04T08:22:09.095Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-98j8-hvjv-x47j - https://github.com/PrestaShop/PrestaShop/commit/fc0625fb0a9aab1835515f1bea52e8e063384da7
CVE ID: CVE-2020-5287 State: PUBLISHED Published: 2020-04-20T16:55:27 Last Updated: 2024-08-04T08:22:09.091Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-284 Description: In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-r6rp-6gv6-r9hq - https://github.com/PrestaShop/PrestaShop/commit/27e49d89808f1d76eb909a595f344a6739bc0b52
CVE ID: CVE-2020-5288 State: PUBLISHED Published: 2020-04-20T16:55:22 Last Updated: 2024-08-04T08:22:09.110Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-284 Description: "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-4wxg-33h3-3w5r - https://github.com/PrestaShop/PrestaShop/commit/fc1d796dda769efdbc4d9e02ea7a11e4167338d0
CVE ID: CVE-2020-5289 State: PUBLISHED Published: 2020-03-30T21:20:14 Last Updated: 2024-08-04T08:22:09.123Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: yahoo Products: elide Problem Types: CWE-285 Description: In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater
returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yahoo/elide/security/advisories/GHSA-2mxr-89gf-rc4v - https://github.com/yahoo/elide/pull/1236 - https://github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dc
CVE ID: CVE-2020-5290 State: PUBLISHED Published: 2020-04-01T19:25:15 Last Updated: 2024-08-04T08:22:09.090Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N) Vendors: redpwn Products: rctf Problem Types: CWE-384 Description: In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify` endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim teams who solve the challenge are unknowingly (and against their will) signed into the attacker team&#39;s account. Then, the attacker can gain points
are unknowingly (and against their will) signed into the attacker team&#39;s account. Then, the attacker can gain points / value off the backs of the victims. This is patched in version 2.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redpwn/rctf/security/advisories/GHSA-p5fh-2vhw-fvpq - https://github.com/redpwn/rctf/issues/147
CVE ID: CVE-2020-5291 State: PUBLISHED Published: 2020-03-31T18:00:18 Last Updated: 2024-08-04T08:22:09.099Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: containers Products: bubblewrap Problem Types: CWE-648 Description: Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) a
combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containers/bu
d users should update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containers/bubblewrap/security/advisories/GHSA-j2qp-rvxj-43vj - https://github.com/containers/bubblewrap/commit/1f7e2ad948c051054b683461885a0215f1806240
CVE ID: CVE-2020-5292 State: PUBLISHED Published: 2020-03-31T18:15:15 Last Updated: 2024-08-04T08:22:09.190Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Leantime Products: Leantime Problem Types: CWE-89 Description: Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and administrators' password hashes, modify data, or drop tables. The unescaped parameter is "searchUsers" when sending a POST request to "/tickets/showKanban
odify data, or drop tables. The unescaped parameter is "searchUsers" when sending a POST request to "/tickets/showKanban" with a valid session. In the code, the parameter is named "users" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp - https://github.com/Leantime/leantime/pull/181 - https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f
CVE ID: CVE-2020-5293 State: PUBLISHED Published: 2020-04-20T16:55:17 Last Updated: 2024-08-04T08:22:09.082Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-284 Description: In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-cvjj-grfv-f56w - https://github.com/PrestaShop/PrestaShop/commit/f9f442c87755908e23a6bcba8c443cdea1d78a7f
CVE ID: CVE-2020-5294 State: PUBLISHED Published: 2020-04-16T21:15:13 Last Updated: 2024-08-04T08:22:09.096Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: ps_socialfollow Problem Types: CWE-79 Description: PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/ps_socialfollow/security/advisories/GHSA-774w-fg8p-7c8w - https://github.com/PrestaShop/ps_socialfollow/commit/c1768bf14c0fcf8311bea15fba4ffdda45522d6b
CVE ID: CVE-2020-5295 State: PUBLISHED Published: 2020-06-03T21:50:12 Last Updated: 2024-08-04T08:22:09.093Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: octobercms Products: october Problem Types: CWE-98 Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/se
66 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-r23f-c2j5-rx2f - https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc - http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html - http://seclists.org/fulldisclosure/2020/Aug/2
CVE ID: CVE-2020-5296 State: PUBLISHED Published: 2020-06-03T21:55:23 Last Updated: 2024-08-04T08:22:09.114Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: octobercms Products: october Problem Types: CWE-73 Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercm
d in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc - https://github.com/octobercms/october/security/advisories/GHSA-jv6v-fvvx-4932 - http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html - http://seclists.org/fulldisclosure/2020/Aug/2
CVE ID: CVE-2020-5297 State: PUBLISHED Published: 2020-06-03T21:55:18 Last Updated: 2024-08-04T08:22:09.103Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: octobercms Products: october Problem Types: CWE-73 Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (
loitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-9722-rr68-rfpg - https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 - http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html - http://seclists.org/fulldisclosure/2020/Aug/2
CVE ID: CVE-2020-5298 State: PUBLISHED Published: 2020-06-03T21:55:12 Last Updated: 2024-08-04T08:22:09.102Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: octobercms Products: october Problem Types: CWE-87 Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: Referenc
in question Issue has been patched in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-gg6x-xx78-448c - https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c - http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html - http://seclists.org/fulldisclosure/2020/Aug/2
CVE ID: CVE-2020-5299 State: PUBLISHED Published: 2020-06-03T22:00:18 Last Updated: 2024-08-04T08:22:09.179Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: octobercms Products: october Problem Types: CWE-77 Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vuln
ious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q - https://github.com/octobercms/library/commit/c84bf03f506052c8
tobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q - https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a - https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 - http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html - http://seclists.org/fulldisclosure/2020/Aug/2
CVE ID: CVE-2020-5300 State: PUBLISHED Published: 2020-04-06T16:30:14 Last Updated: 2024-08-04T08:22:09.093Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: ory Products: hydra Problem Types: CWE-294 Description: In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not chec
ese tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66 - https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3 - https://github.com/ory
A-3p3g-vpw6-4w66 - https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3 - https://github.com/ory/hydra/releases/tag/v1.4.0