Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8619 State: PUBLISHED Published: 2020-06-17T21:20:13.611975Z Last Updated: 2024-09-17T03:28:34.772Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: The asterisk character ("*") is allowed in DNS zone files, where it is most commonly present as a wildcard at a terminal node of the Domain Name System graph. However, the RFCs do not require and BIND does not enforce that an asterisk character be present only at a terminal node. A problem can occur when an asterisk is present in an empty non-terminal location within the DNS graph. If such a node exists, after a series of queries, named can reach an inconsistent
erminal location within the DNS graph. If such a node exists, after a series of queries, named can reach an inconsistent state that results in the failure of an assertion check in rbtdb.c, followed by the program exiting due to the assertion failure. Versions affected: BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3. Also, versions 9.11.14-S1 -> 9.11.19-S1 of BIND Supported Preview Edition Description: In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non
Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8619 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedo
s: - https://kb.isc.org/docs/cve-2020-8619 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNFTTYJ5JJJJ6QG3AHXJGDIIEYMDFWFW/ - https://security.netapp.com/advisory/ntap-20200625-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIOXMJX4N3LBKC65OXNBE52W4GAS7QEX/ - https://usn.ubuntu.com/4399-1/ - https://www.debian.org/security/2020/dsa-4752 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8620 State: PUBLISHED Published: 2020-08-21T20:50:18.547365Z Last Updated: 2024-09-17T01:40:34.573Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In versions of BIND that use the libuv network manager (9.16.x is the only stable branch affected) an incorrectly specified maximum buffer size allows a specially crafted large TCP payload to trigger an assertion failure when it is received. Affects BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3 Description: In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigg
n attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8620 - https://security.netapp.com/advisory/ntap-20200827-0003/ - https://usn.ubuntu.com/4468-1/ - https://security.gentoo.org/glsa/202008-19 - https://www.synology.com/security/advisory/Synology_SA_20_19 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8621 State: PUBLISHED Published: 2020-08-21T20:50:18.959156Z Last Updated: 2024-09-16T16:18:00.777Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: While query forwarding and QNAME minimization are mutually incompatible, BIND did sometimes allow QNAME minimization when continuing with recursion after 'forward first' did not result in an answer. In these cases the data used by QNAME minimization might be inconsistent, leading to an assertion failure, causing the server to exit. Affects BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3 Description: In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured wit
.14.0 -> 9.16.5, 9.17.0 -> 9.17.3 Description: In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8621 - https://security.netapp.com/advisory/ntap-20200827-0003/ - https://usn.ubuntu.com/4468-1/ - https://security.gentoo.org/glsa/202008-19 - https://www.synology.com/security/advisory/Synology_SA_20_19 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg0
www.synology.com/security/advisory/Synology_SA_20_19 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8622 State: PUBLISHED Published: 2020-08-21T20:50:19.383306Z Last Updated: 2024-09-16T17:14:14.760Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: Attempting to verify a truncated response to a TSIG-signed request leads to an assertion failure. Affects BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition Description: In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating t
21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8622 - https://lists.fedoraproject.org/archives/list/package-announce%40li
eferences: - https://kb.isc.org/docs/cve-2020-8622 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ - https://usn.ubuntu.com/4468-1/ - https://usn.ubuntu.com/4468-2/ - https://www.debian.org/security/2020/dsa-4752 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html - https://security.gentoo.org/glsa/202008-19 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html -
e-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20200827-0003/ - https://www.synology.com/security/advisory/Synology_SA_20_19
CVE ID: CVE-2020-8623 State: PUBLISHED Published: 2020-08-21T20:50:19.797742Z Last Updated: 2024-09-17T03:19:11.433Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: If BIND is built with "--enable-native-pkcs11" then a specially crafted query for a zone signed with RSA can trigger an assertion failure. Affects BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition Description: In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a v
-> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8623 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ - https://security.netapp.com/advisory/ntap-20200827-0003/ - https://
ject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ - https://security.netapp.com/advisory/ntap-20200827-0003/ - https://usn.ubuntu.com/4468-1/ - https://www.debian.org/security/2020/dsa-4752 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html - https://security.gentoo.org/glsa/202008-19 - https://www.synology.com/security/advisory/Synology_SA_20_19 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8624 State: PUBLISHED Published: 2020-08-21T20:50:20.258787Z Last Updated: 2024-09-16T17:52:52.920Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ISC Products: BIND9 Problem Types: Change 4885 inadvertently caused "update-policy" rules of type "subdomain" to be treated as if they were of type "zonesub", allowing updates to all parts of the zone along with the intended subdomain. Affects BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition Description: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.1
.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition Description: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2020-8624 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ - https
raproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/ - https://security.netapp.com/advisory/ntap-20200827-0003/ - https://usn.ubuntu.com/4468-1/ - https://www.debian.org/security/2020/dsa-4752 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/ - https://security.gentoo.org/glsa/202008-19 - https://www.synology.com/security/advisory/Synology_SA_20_19 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2020-8625 State: PUBLISHED Published: 2021-02-17T22:40:16.090944Z Last Updated: 2024-09-16T22:40:02.277Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ISC Products: BIND9 Problem Types: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch:GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between parties on a network. SPNEGO is a negotiation mechanism used by GSSAPI, the app
e authenticity of communications between parties on a network. SPNEGO is a negotiation mechanism used by GSSAPI, the application protocol interface for GSS-TSIG. The SPNEGO implementation used by BIND has been found to be vulnerable to a buffer overflow attack. Description: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is f
ytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development br
-> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2020-8625 - https://www.debian.org/security/2021/dsa-4857 - http://www.openwall.com/lists/oss-security/2021/02/19/1 - https://lists.debian.org/debian-lts-announce/2021/02/msg00029.html - http://www.openwall.com/lists/oss-security/2021/02/20/2 - https://www.zerodayinitiative.com/advisories/ZDI-21-195/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWCMBOSZOJIIET7BWTRYS3HLX5TSDKHX/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/QWCMBOSZOJIIET7BWTRYS3HLX5TSDKHX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYXAF7G45RXDVNUTWWCI2CVTHRZ67LST/ - https://security.netapp.com/advisory/ntap-20210319-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBTPWRQWRQEJNWY4NHO4WLS4KLJ3ERHZ/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-8626 State: REJECTED Published: 2021-04-08T14:15:16 Last Updated: 2021-04-08T14:15:16 Description: No description available.
CVE ID: CVE-2020-8627 State: REJECTED Published: 2021-04-08T14:15:17 Last Updated: 2021-04-08T14:15:17 Description: No description available.
CVE ID: CVE-2020-8628 State: REJECTED Published: 2021-04-08T14:15:17 Last Updated: 2021-04-08T14:15:17 Description: No description available.
CVE ID: CVE-2020-8629 State: REJECTED Published: 2021-04-08T14:15:18 Last Updated: 2021-04-08T14:15:18 Description: No description available.
CVE ID: CVE-2020-8630 State: REJECTED Published: 2021-04-08T14:15:18 Last Updated: 2021-04-08T14:15:18 Description: No description available.
CVE ID: CVE-2020-8631 State: PUBLISHED Published: 2020-02-05T13:39:50 Last Updated: 2024-08-04T10:03:46.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/canonical/cloud-init/pull/204 - https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795 - https://lists.debian.org/debian-lts-announce/2020/02/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html
CVE ID: CVE-2020-8632 State: PUBLISHED Published: 2020-02-05T13:40:05 Last Updated: 2024-08-04T10:03:46.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795 - https://github.com/canonical/cloud-init/pull/189 - https://lists.debian.org/debian-lts-announce/2020/02/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html
CVE ID: CVE-2020-8633 State: PUBLISHED Published: 2020-02-18T21:17:08 Last Updated: 2024-08-04T10:03:46.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7
CVE ID: CVE-2020-8634 State: PUBLISHED Published: 2020-03-06T23:33:20 Last Updated: 2024-08-04T10:03:46.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php
CVE ID: CVE-2020-8635 State: PUBLISHED Published: 2020-03-06T23:33:06 Last Updated: 2024-08-04T10:03:46.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php
CVE ID: CVE-2020-8636 State: PUBLISHED Published: 2020-02-06T16:49:48 Last Updated: 2024-08-04T10:03:46.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution . Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40ph0rensic/three-cves-on-opmon-3ca775a262f5
CVE ID: CVE-2020-8637 State: PUBLISHED Published: 2020-04-03T18:36:38 Last Updated: 2024-08-04T10:03:46.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://ackcent.com/blog/testlink-1.9.20-unrestricted-file-upload-and-sql-injection/ - https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/d99bd8277d384f3417e917ce20bef5d061110343
CVE ID: CVE-2020-8638 State: PUBLISHED Published: 2020-04-03T18:36:41 Last Updated: 2024-08-04T10:03:46.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter. Additional Analyst Notes: - CVE Program Container: References: - https://ackcent.com/blog/testlink-1.9.20-unrestricted-file-upload-and-sql-injection/ - https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/58f3cc03d5f81cd5cc2ad8c7ba645cc486cebc05
CVE ID: CVE-2020-8639 State: PUBLISHED Published: 2020-04-03T18:36:44 Last Updated: 2024-08-04T10:03:46.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This allows an authenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to a publicly accessible directory of the application. Additional Analyst Notes: - CVE Program Container: References: - https://ackcent.com/blog/testlink-1.9.20-unrestricted-file-upload-and-sql-injection/ - https://github.com
References: - https://ackcent.com/blog/testlink-1.9.20-unrestricted-file-upload-and-sql-injection/ - https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/57d81ae350d569c5c95087997fe051c49e14516d - http://packetstormsecurity.com/files/161401/TestLink-1.9.20-Shell-Upload.html
CVE ID: CVE-2020-8641 State: PUBLISHED Published: 2020-02-05T20:12:33 Last Updated: 2024-08-04T10:03:46.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47985
CVE ID: CVE-2020-8644 State: PUBLISHED Published: 2020-02-05T21:03:11.000Z Last Updated: 2025-10-21T23:35:52.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/ - https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704 - https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/ - http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execu
2020-8644/ - http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html
CVE ID: CVE-2020-8645 State: PUBLISHED Published: 2020-02-06T23:50:22 Last Updated: 2024-08-04T10:03:46.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parameter is job_id. The function is getJobApplicationsByJobId(). The file is _lib/class.JobApplication.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/niteosoft/simplejobscript/issues/9
CVE ID: CVE-2020-8647 State: PUBLISHED Published: 2020-02-06T00:06:51 Last Updated: 2024-08-04T10:03:46.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=206359 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - htt
org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698