Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10109 State: PUBLISHED Published: 2020-03-12T12:40:05 Last Updated: 2024-08-04T10:50:57.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories - https://know.bishopfox.com/advisories/twisted-version-19.10.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y
ted-version-19.10.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/ - https://usn.ubuntu.com/4308-2/ - https://usn.ubuntu.com/4308-1/ - https://security.gentoo.org/glsa/202007-24 - https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html
CVE ID: CVE-2020-10110 State: PUBLISHED Published: 2020-03-06T20:32:19 Last Updated: 2024-08-04T10:50:57.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vulnerability. There is no sensitive information disclosure through the cache headers on Citrix ADC. The "Via" header lists cache protocols and recipients between the start and end points for a request or a response. The "Age" header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive Additional Analyst Notes: - CISA ADP Vulnric
ders are commonly used for proxy cache and the information is not sensitive Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/search - https://seclists.org/fulldisclosure/2020/Mar/7 - http://packetstormsecurity.com/files/156656/Citrix-Gateway-11.1-12.0-12.1-Information-Disclosure.html
CVE ID: CVE-2020-10111 State: PUBLISHED Published: 2020-03-06T20:33:05 Last Updated: 2024-08-04T10:50:57.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. Citrix ADC only caches HTTP/1.1 traffic for performance optimization Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/search - http://seclists.org/fulldisclosure/2020/Mar/11 - http://packetstormsecurity.com/files/156661/Citrix-Gateway-11.1-12.0-12.1-Cache-Bypass.html
CVE ID: CVE-2020-10112 State: PUBLISHED Published: 2020-03-06T20:33:53 Last Updated: 2024-08-04T10:50:57.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/search - http
hed by default Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/search - http://seclists.org/fulldisclosure/2020/Mar/8 - http://packetstormsecurity.com/files/156660/Citrix-Gateway-11.1-12.0-12.1-Cache-Poisoning.html
CVE ID: CVE-2020-10113 State: PUBLISHED Published: 2020-03-17T14:33:19 Last Updated: 2024-08-04T10:50:57.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10114 State: PUBLISHED Published: 2020-03-17T14:33:55 Last Updated: 2024-08-04T10:50:57.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10115 State: PUBLISHED Published: 2020-03-17T14:35:51 Last Updated: 2024-08-04T10:50:57.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10116 State: PUBLISHED Published: 2020-03-17T14:36:40 Last Updated: 2024-08-04T10:50:57.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10117 State: PUBLISHED Published: 2020-03-17T14:37:23 Last Updated: 2024-08-04T10:50:57.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10118 State: PUBLISHED Published: 2020-03-17T14:38:10 Last Updated: 2024-08-04T10:50:57.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10119 State: PUBLISHED Published: 2020-03-17T14:38:58 Last Updated: 2024-08-04T10:50:57.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10120 State: PUBLISHED Published: 2020-03-17T14:39:50 Last Updated: 2024-08-04T10:50:57.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10121 State: PUBLISHED Published: 2020-03-17T14:40:35 Last Updated: 2024-08-04T10:50:57.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10122 State: PUBLISHED Published: 2020-03-17T14:41:13 Last Updated: 2024-08-04T10:50:57.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/84+Change+Log
CVE ID: CVE-2020-10123 State: PUBLISHED Published: 2020-08-21T20:30:39.511Z Last Updated: 2025-11-04T19:12:01.005Z Vendors: NCR Products: SelfServ ATM Problem Types: CWE-305 Description: The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/116713 - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secu
eferences: - https://kb.cert.org/vuls/id/116713 - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdf - https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdf - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdf
CVE ID: CVE-2020-10124 State: PUBLISHED Published: 2020-08-21T20:30:39.977Z Last Updated: 2025-11-04T19:12:02.183Z Vendors: NCR Products: SelfServ ATM Problem Types: CWE-353, CWE-306, CWE-311 Description: NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/815655 - https://www.ncr.com/content/dam/ncrcom/content-type/documen
ontainer: References: - https://kb.cert.org/vuls/id/815655 - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_
CVE ID: CVE-2020-10125 State: PUBLISHED Published: 2020-08-21T20:30:40.398Z Last Updated: 2025-11-04T19:12:03.905Z Vendors: NCR Products: SelfServ ATM Problem Types: CWE-326 Description: NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https:/
lting in the ability to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/815655 - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_
CVE ID: CVE-2020-10126 State: PUBLISHED Published: 2020-08-21T20:30:40.835Z Last Updated: 2025-11-04T19:12:05.056Z Vendors: NCR Products: SelfServ ATM Problem Types: CWE-305 Description: NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive. Additional Analyst Notes: - CVE Program Container: References: - https:/
st validating the signature of the CAB archive. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/815655 - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_
CVE ID: CVE-2020-10128 State: PUBLISHED Published: 2023-09-05T19:13:50.928Z Last Updated: 2024-09-30T16:53:25.905Z Vendors: SearchBlox Products: SearchBlox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox products multiple parameters are not sanitized/validate properly which allows an attacker to inject malicious JavaScript. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.searchblox.com/v9.2/changelog/version-921
CVE ID: CVE-2020-10129 State: PUBLISHED Published: 2023-09-06T18:44:27.908Z Last Updated: 2024-09-26T17:54:24.228Z Vendors: SearchBlox Products: SearchBlox Problem Types: CWE-266 Incorrect Privilege Assignment Description: SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.searchblox.com/v9.2/changelog/version-91
CVE ID: CVE-2020-10130 State: PUBLISHED Published: 2023-09-06T18:47:21.110Z Last Updated: 2024-09-26T17:52:14.536Z Vendors: SearchBlox Products: SearchBlox Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.searchblox.com/v9.2/changelog/version-91
CVE ID: CVE-2020-10131 State: PUBLISHED Published: 2023-09-06T18:47:31.776Z Last Updated: 2024-09-26T17:49:41.323Z Vendors: SearchBlox Products: SearchBlox Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.searchblox.com/v9.2/changelog/version-921
CVE ID: CVE-2020-10132 State: PUBLISHED Published: 2023-09-06T18:47:39.734Z Last Updated: 2024-09-26T16:05:32.240Z Vendors: SearchBlox Products: SearchBlox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.searchblox.com/v9.2/changelog/version-91
CVE ID: CVE-2020-10134 State: PUBLISHED Published: 2020-05-19T15:50:14.117011Z Last Updated: 2024-09-16T20:01:34.146Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Bluetooth Products: LE Problem Types: CWE-351 Description: Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user erroneously completes both pairing procedures with the MITM using the confirmation number of one peer as the passkey of the other. An adjacent, unauthenticated attacker could be able to in
e confirmation number of one peer as the passkey of the other. An adjacent, unauthenticated attacker could be able to initiate any Bluetooth operation on either attacked device exposed by the enabled Bluetooth profiles. This exposure may be limited when the user must authorize certain access explicitly, but so long as a user assumes that it is the intended remote device requesting permissions, device-local protections may be weakened. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/534195/ - https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/method-vulnerability/
CVE ID: CVE-2020-10135 State: PUBLISHED Published: 2020-05-19T15:50:14Z Last Updated: 2024-09-17T02:57:41.936Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Bluetooth Products: BR/EDR Problem Types: CWE-757 Description: Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link
r with a previously paired remote device to successfully complete the authentication procedure without knowing the link key. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/647177/ - http://seclists.org/fulldisclosure/2020/Jun/5 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html - https://francozappa.github.io/about-bias/ - https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/ - http://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.html
CVE ID: CVE-2020-10136 State: PUBLISHED Published: 2020-06-02T08:35:12.921Z Last Updated: 2025-11-03T20:33:32.981Z Vendors: IETF Products: RFC2003 - IP Encapsulation within IP Problem Types: CWE-290 Description: IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/636397/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-d
kb.cert.org/vuls/id/636397/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4 - https://www.digi.com/resources/security - https://www.kb.cert.org/vuls/id/636397 - https://datatracker.ietf.org/doc/html/rfc6169
CVE ID: CVE-2020-10137 State: PUBLISHED Published: 2022-01-09T04:15:13.118918Z Last Updated: 2024-09-16T18:13:44.506Z Vendors: Silicon Labs Products: UZB-7 Problem Types: CWE-345 Description: Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthenticated attacker to inject a FIND_NODE_IN_RANGE frame with an invalid random payload, denying service by blocking the processing of upcoming events. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https:
ert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109/ACCESS.2021.3138768 - https://www.kb.cert.org/vuls/id/142629
CVE ID: CVE-2020-10138 State: PUBLISHED Published: 2020-10-21T13:40:18 Last Updated: 2024-08-04T10:50:57.887Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Cyber Backup, Cyber Protect Problem Types: CWE-284 Description: Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to a
bdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/114757
CVE ID: CVE-2020-10139 State: PUBLISHED Published: 2020-10-21T13:40:19 Last Updated: 2024-08-04T10:50:57.899Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Acronis Products: True Image 2021 Problem Types: CWE-284 Description: Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privilege
e the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/114757
CVE ID: CVE-2020-10140 State: PUBLISHED Published: 2020-10-21T13:40:19 Last Updated: 2024-08-04T10:50:57.928Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Acronis Products: True Image Problem Types: CWE-732 Description: Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths within C:\ProgramData\Acronis. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/114757
CVE ID: CVE-2020-10143 State: PUBLISHED Published: 2020-12-09T22:35:12 Last Updated: 2024-08-04T10:50:57.907Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Macrium Products: Reflect Problem Types: CWE-284 Description: Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges. Additional Analyst Notes: - CVE Program Cont
penssl.cnf file to achieve arbitrary code execution with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/760767
CVE ID: CVE-2020-10145 State: PUBLISHED Published: 2021-05-27T20:55:10 Last Updated: 2024-08-04T10:50:57.943Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-284 Description: The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/125331
CVE ID: CVE-2020-10146 State: PUBLISHED Published: 2020-12-09T00:30:15.443291Z Last Updated: 2024-09-16T23:01:21.591Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Microsoft Products: Teams Problem Types: CWE-79 Description: The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020. Additional Analyst Notes: - CVE Program Container: References: - https://github
nline service on or around October 2020. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/oskarsve/ms-teams-rce