Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15001 State: PUBLISHED Published: 2020-07-09T18:05:30 Last Updated: 2024-08-04T13:00:52.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when updating NFC specific components of the OTP configurations. This may allow an attacker to access configured OTPs and passwords stored in slots that were not configured by the user to be read over NFC, despite a user having set an ac
and passwords stored in slots that were not configured by the user to be read over NFC, despite a user having set an access code. (Users who have not set an access code, or who have not configured the OTP slots, are not impacted by this issue.) Additional Analyst Notes: - CVE Program Container: References: - https://www.yubico.com/support/security-advisories/ysa-2020-04/
CVE ID: CVE-2020-15002 State: PUBLISHED Published: 2020-10-23T04:51:42 Last Updated: 2024-08-04T13:00:52.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://seclists.org/fulldisclosure/2020/Oct/20
CVE ID: CVE-2020-15003 State: PUBLISHED Published: 2020-10-23T04:54:27 Last Updated: 2024-08-04T13:00:52.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive access). Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://seclists.org/fulldisclosure/2020/Oct/20
CVE ID: CVE-2020-15004 State: PUBLISHED Published: 2020-10-23T04:55:35 Last Updated: 2024-08-04T13:00:52.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://seclists.org/fulldisclosure/2020/Oct/20
CVE ID: CVE-2020-15005 State: PUBLISHED Published: 2020-06-24T22:07:37 Last Updated: 2024-08-04T13:00:52.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T248947 - https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_34/RELEASE-NOTES
habricator.wikimedia.org/T248947 - https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_34/RELEASE-NOTES-1.34 - https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_33/RELEASE-NOTES-1.33 - https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_31/RELEASE-NOTES-1.31 - https://lists.wikimedia.org/pipermail/wikitech-l/2020-June/093535.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZIMLJMJS72SJXPYL736XMUAVCRQD2H/ - https://www.debian.org/security/2020/dsa-4767 - https://lists.debian.org/debian-lts-announce/2020/12/msg00034.html
CVE ID: CVE-2020-15006 State: PUBLISHED Published: 2020-06-24T10:41:54 Last Updated: 2024-08-04T13:00:52.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1212
CVE ID: CVE-2020-15007 State: PUBLISHED Published: 2020-06-24T10:55:38 Last Updated: 2024-08-04T13:00:52.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/notrevenant/status/1268654123903340544 - https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec
CVE ID: CVE-2020-15008 State: PUBLISHED Published: 2020-07-07T19:39:30 Last Updated: 2024-08-04T13:00:52.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction a
be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12. Additional Analyst Notes: - CVE Program Container: References: - https://slagle.tech/2020/07/06/cve-2020-15008/
CVE ID: CVE-2020-15009 State: PUBLISHED Published: 2020-07-20T12:42:03 Last Updated: 2024-08-04T13:00:52.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (UX450FDX, UX550GDX and UX550GEX) could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/ - https://www.asus.com/support/FAQ/1043674 - https://drive.google.com/fil
Static_WebPage/ASUS-Product-Security-Advisory/ - https://www.asus.com/support/FAQ/1043674 - https://drive.google.com/file/d/1ClzHH5Jw3PgZw74RvKrEP8xU0TUc5Ta0/view?usp=sharing
CVE ID: CVE-2020-15011 State: PUBLISHED Published: 2020-06-24T11:34:56 Last Updated: 2024-08-04T13:00:52.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mailman/+bug/1877379 - https://lists.debian.org/debian-lts-announce/2020/06/msg00036.html - https://usn.ubuntu.com/4406-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/202
opensuse.org/opensuse-security-announce/2020-10/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html - https://www.debian.org/security/2021/dsa-4991
CVE ID: CVE-2020-15012 State: PUBLISHED Published: 2020-10-12T20:35:01 Last Updated: 2024-08-04T13:00:52.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to). Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/360051068253
CVE ID: CVE-2020-15014 State: PUBLISHED Published: 2020-06-24T12:13:49 Last Updated: 2024-08-04T13:00:52.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pramodmahato/BlogCMS/issues/1
CVE ID: CVE-2020-15015 State: PUBLISHED Published: 2020-06-24T14:23:50 Last Updated: 2024-08-04T13:00:52.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/chppppp/9b003d8416e6d3a89d2873a58af2a95f
CVE ID: CVE-2020-15016 State: PUBLISHED Published: 2020-06-26T13:09:28 Last Updated: 2024-08-04T13:00:52.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/PreethamBomma/9c3eb4a6f5188a67c94306dd9c9f23ca
CVE ID: CVE-2020-15017 State: PUBLISHED Published: 2020-06-26T13:08:35 Last Updated: 2024-08-04T13:00:52.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/PreethamBomma/6ceeb4d5c754834697e42f1db8214c69
CVE ID: CVE-2020-15018 State: PUBLISHED Published: 2020-06-24T12:37:43 Last Updated: 2024-08-04T13:00:52.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: playSMS through 1.4.3 is vulnerable to session fixation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/antonraharja/playSMS/issues/605
CVE ID: CVE-2020-15020 State: PUBLISHED Published: 2020-08-31T12:27:55 Last Updated: 2024-08-04T13:00:52.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/elementor/#developers - http://hidden-one.co.in/2020/07/07/cve-2020-1020-stored-xss-on-elementor-wordpress-plugin/
CVE ID: CVE-2020-15023 State: PUBLISHED Published: 2020-12-11T15:23:35 Last Updated: 2024-08-04T13:00:52.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network. Additional Analyst Notes
or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network. Additional Analyst Notes: - CVE Program Container: References: - https://www.askey.com.tw/Products/wifi.html - https://www.askey.com.tw/incident_report_notifications.html - https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d
CVE ID: CVE-2020-15024 State: PUBLISHED Published: 2020-09-10T17:10:42 Last Updated: 2024-08-04T13:00:52.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation. Additional Analyst Notes: - CVE Program Container: References: - http://nestedif.com/avast-antivirus-password-manager-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory/
CVE ID: CVE-2020-15025 State: PUBLISHED Published: 2020-06-24T18:04:39 Last Updated: 2024-08-04T13:00:52.098Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file. Additional Analyst Notes: - CVE Program Container: References: - https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea - https://support.ntp.org/bi
es: - https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea - https://support.ntp.org/bin/view/Main/NtpBug3661 - https://bugs.gentoo.org/729458 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - https://security.gentoo.org/glsa/202007-12 - https://www.oracle.com/security-alerts/cpujan2021.html - https://security.netapp.com/advisory/ntap-20200702-0002/
CVE ID: CVE-2020-15026 State: PUBLISHED Published: 2020-06-24T18:42:51 Last Updated: 2024-08-04T13:00:52.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1214
CVE ID: CVE-2020-15027 State: PUBLISHED Published: 2020-07-16T14:39:04 Last Updated: 2024-08-04T13:00:52.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This was patched in 2020.7 and in a hotfix for 2019.12. Additional Analyst Notes: - CVE Program Container: References: - https://slagle.tech/2020/07/06/cve-2020-15027/
CVE ID: CVE-2020-15028 State: PUBLISHED Published: 2020-07-07T15:37:21 Last Updated: 2024-08-04T13:00:52.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.php xo parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15029 State: PUBLISHED Published: 2020-07-07T15:36:09 Last Updated: 2024-08-04T13:00:52.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15030 State: PUBLISHED Published: 2020-07-07T15:35:14 Last Updated: 2024-08-04T13:00:52.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Routes.php rtr parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15031 State: PUBLISHED Published: 2020-07-07T15:34:16 Last Updated: 2024-08-04T13:00:52.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15032 State: PUBLISHED Published: 2020-07-07T15:33:20 Last Updated: 2024-08-04T13:00:52.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Incidents.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15033 State: PUBLISHED Published: 2020-07-07T15:31:51 Last Updated: 2024-08-04T13:00:52.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the snmpget.php ip parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15034 State: PUBLISHED Published: 2020-07-07T15:29:03 Last Updated: 2024-08-04T13:00:52.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE ID: CVE-2020-15035 State: PUBLISHED Published: 2020-07-07T15:27:23 Last Updated: 2024-08-04T13:00:52.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.php hde parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19
CVE ID: CVE-2020-15036 State: PUBLISHED Published: 2020-07-07T14:04:09 Last Updated: 2024-08-04T13:00:52.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19
CVE ID: CVE-2020-15037 State: PUBLISHED Published: 2020-07-07T14:02:52 Last Updated: 2024-08-04T13:00:52.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st[] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nedi.ch/download/ - https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19
CVE ID: CVE-2020-15038 State: PUBLISHED Published: 2020-06-24T19:58:59 Last Updated: 2024-08-04T13:00:52.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/coming-soon/#developers - https://www.getastra.com/blog/911/plugin-exploit/stored-xss-coming-soon-page-maintenance-mode-plugin/ - https://www.jinsonvarghese.com/stored-xss-coming-soon-maintenance-mode-wordpress-plugin/ - https://wpvulndb.com/vulnerabilities/10283 - http://packetstormsecurity.com/files/158649/WordPress-Maintenance-Mode-By-SeedProd-5.1.1-Cross-Site
nerabilities/10283 - http://packetstormsecurity.com/files/158649/WordPress-Maintenance-Mode-By-SeedProd-5.1.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-15041 State: PUBLISHED Published: 2020-06-24T20:33:34 Last Updated: 2024-08-04T13:00:52.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php-fusion/PHP-Fusion/issues/2330
CVE ID: CVE-2020-15043 State: PUBLISHED Published: 2020-06-29T17:48:37 Last Updated: 2024-08-04T13:00:52.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Saket-taneja/4dda4b2df5aa0973a7160bb6bf8875e0 - https://github.com/Saket-taneja/IballCSRFExploit
CVE ID: CVE-2020-15046 State: PUBLISHED Published: 2020-06-24T22:25:57 Last Updated: 2024-08-04T13:00:52.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88. Additional Analyst Notes: - CVE Program Container: References: - https://www.totalpentest.com/post/supermicro-ipmi-webgui-cross-site-request-forgery - http://packetstormsecurity.com/files/158373/SuperMicro-IPMI-03.40-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-15047 State: PUBLISHED Published: 2020-06-25T10:49:09 Last Updated: 2024-08-04T13:08:21.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSA/SMTP.cpp in Trojita before 0.8 ignores certificate-verification errors, which allows man-in-the-middle attackers to spoof SMTP servers. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.vesnicky.cesnet.cz/r/1035 - https://bugs.kde.org/show_bug.cgi?id=423453
CVE ID: CVE-2020-15049 State: PUBLISHED Published: 2020-06-30T17:55:55 Last Updated: 2024-08-04T13:08:21.396Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v4/changesets/squi
Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v4/changesets/squid-4-ea12a34d338b962707d5078d6d1fc7c6eb119a22.patch - http://www.squid-cache.org/Versions/v5/changesets/squid-5-485c9a7bb1bba88754e07ad0094647ea57a6eb8d.patch - https://github.com/squid-cache/squid/security/advisories/GHSA-qf3v-rc95-96j5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/ - https://www.debian.org/security/2020/dsa-4732 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html - https:
ity-announce/2020-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html - https://usn.ubuntu.com/4551-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html - https://security.netapp.com/advisory/ntap-20210312-0001/