Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12035 State: PUBLISHED Published: 2020-06-29T13:49:50 Last Updated: 2024-08-04T11:48:57.936Z Vendors: n/a Products: Baxter PrismaFlex and PrisMax Problem Types: CWE-287 Description: Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedical information, device settings, calibration settings, and network configuration. This could allow an attacker to modify device settings and calibration. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12036 State: PUBLISHED Published: 2020-06-29T13:49:53 Last Updated: 2024-08-04T11:48:57.981Z Vendors: n/a Products: Baxter PrismaFlex and PrisMax Problem Types: CWE-319 Description: Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when configured to send treatment data to a PDMS (Patient Data Management System) or an EMR (Electronic Medical Record) system. An attacker could observe sensitive data sent from the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12037 State: PUBLISHED Published: 2020-06-29T13:49:46 Last Updated: 2024-08-04T11:48:57.853Z Vendors: n/a Products: Baxter PrismaFlex and PrisMax Problem Types: CWE-259 Description: Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when configured to send treatment data to a PDMS (Patient Data Management System) or an EMR (Electronic Medical Record) system. An attacker could observe sensitive data sent from the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12038 State: PUBLISHED Published: 2020-05-19T21:36:54 Last Updated: 2024-08-04T11:48:58.157Z Vendors: n/a Products: EDS Subsystem, FactoryTalk Linx software (Previously called RSLinx Enterprise), RSLinx Classic, RSNetWorx software, Studio 5000 Logix Designer software Problem Types: CWE-119 Description: Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable. A memory corruption vulnerability exists in the algorithm t
ogix Designer software: Version 32 and prior) is vulnerable. A memory corruption vulnerability exists in the algorithm that matches square brackets in the EDS subsystem. This may allow an attacker to craft specialized EDS files to crash the EDSParser COM object, leading to denial-of-service conditions. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-140-01
CVE ID: CVE-2020-12039 State: PUBLISHED Published: 2020-06-29T13:45:48 Last Updated: 2024-08-04T11:48:58.109Z Vendors: n/a Products: Baxter Sigma Spectrum Infusion Pumps Problem Types: CWE-259 Description: Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE ID: CVE-2020-12040 State: PUBLISHED Published: 2020-06-29T13:45:58 Last Updated: 2024-08-04T11:48:57.530Z Vendors: n/a Products: Baxter Sigma Spectrum Infusion Pumps Problem Types: CWE-319 Description: Sigma Spectrum Infusion System v's6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has circumvented network security measures to view sensitive non-private data or to perform a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.u
or to perform a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE ID: CVE-2020-12041 State: PUBLISHED Published: 2020-06-29T13:43:52 Last Updated: 2024-08-04T11:48:57.710Z Vendors: n/a Products: Baxter Sigma Spectrum Infusion Pumps Problem Types: CWE-732 Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) telnet Command-Line Interface, grants access to sensitive data stored on the WBM that permits temporary configuration changes to network settings of the WBM, and allows the WBM to be rebooted. Temporary configuration changes to network settings are removed upon reboot. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE ID: CVE-2020-12042 State: PUBLISHED Published: 2020-05-14T20:28:03 Last Updated: 2024-08-04T11:48:57.821Z Vendors: n/a Products: Opto 22 SoftPAC Project Problem Types: CWE-347 Description: Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware are not sanitized. As a result, an attacker with user privileges can gain arbitrary file write access with system access. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE ID: CVE-2020-12043 State: PUBLISHED Published: 2020-06-29T13:41:42 Last Updated: 2024-08-04T11:48:57.976Z Vendors: n/a Products: Baxter Sigma Spectrum Infusion Pumps Problem Types: CWE-672 Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE ID: CVE-2020-12045 State: PUBLISHED Published: 2020-06-29T13:43:40 Last Updated: 2024-08-04T11:48:58.009Z Vendors: n/a Products: Baxter Sigma Spectrum Infusion Pumps Problem Types: CWE-259 Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), operates a Telnet service on Port 1023 with hard-coded credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE ID: CVE-2020-12046 State: PUBLISHED Published: 2020-05-14T20:30:55 Last Updated: 2024-08-04T11:48:57.974Z Vendors: n/a Products: Opto 22 SoftPAC Project Problem Types: CWE-347 Description: Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware update. This allows an attacker to replace legitimate firmware files with malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE ID: CVE-2020-12047 State: PUBLISHED Published: 2020-06-29T13:41:37 Last Updated: 2024-08-04T11:48:57.938Z Vendors: n/a Products: Baxter Sigma Spectrum Infusion Pumps Problem Types: CWE-259 Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless configuration enables an FTP service with hard-coded credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE ID: CVE-2020-12048 State: PUBLISHED Published: 2020-06-29T13:48:04 Last Updated: 2024-08-04T11:48:57.931Z Vendors: n/a Products: Baxter Phoenix Hemodialysis Delivery System Problem Types: CWE-319 Description: Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool. Additional Analyst Notes: - CVE Program Container: Ref
ription data sent between the Phoenix system and the Exalis tool. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-03
CVE ID: CVE-2020-12049 State: PUBLISHED Published: 2020-06-08T00:00:00 Last Updated: 2024-08-04T11:48:57.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/dbus/dbus/-/issues
ents. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/dbus/dbus/-/issues/294 - https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.13.16 - http://www.openwall.com/lists/oss-security/2020/06/04/3 - https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.12.18 - https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.10.30 - https://usn.ubuntu.com/4398-1/ - https://usn.ubuntu.com/4398-2/ - https://security.gentoo.org/glsa/202007-46 - https://securitylab.github.com/advisories/GHSL-2020-057-DBus-DoS-file-descriptor-leak - http://packetstormsecurity.com/files/172840/D-Bus-File-Descriptor-Leak-Denial-Of-Service.html
CVE ID: CVE-2020-12050 State: PUBLISHED Published: 2020-04-30T16:09:05 Last Updated: 2024-08-04T11:48:57.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation because any user can replace a /tmp/sqliteodbc$$ file with new contents that cause loading of an arbitrary library. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/ - http://www.ch-werner.de/sqliteodbc/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PR6B33IGBADGYDBTEEU36OGERER2HOGQ/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/PR6B33IGBADGYDBTEEU36OGERER2HOGQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXPHBDVB3LAQUQJCZ4WIS3JWM7JFR56X/ - https://bugzilla.redhat.com/show_bug.cgi?id=1825762 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDS5RK7F47BRXHUYRWGMGLYU2GJEVZQA/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00026.html - https://sysdream.com/news/lab/2020-05-25-cve-2020-12050-fedora-red-hat-centos-local-privilege-escalation-through-a-rac
- https://sysdream.com/news/lab/2020-05-25-cve-2020-12050-fedora-red-hat-centos-local-privilege-escalation-through-a-race-condition-in-the-sqliteodbc-installer-script/
CVE ID: CVE-2020-12051 State: PUBLISHED Published: 2020-04-21T21:24:33 Last Updated: 2024-08-04T11:48:58.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.php?action=query&meta=globaluserinfo&guiuser= request. In other words, the information can be retrieved via the action API even though access would be denied when simply visiting wiki/Special:CentralAuth in a web browser. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T250594 - https://gerrit.wikimedia.org/r/#/q/I3c80641dc1202df7428714f0ca
References: - https://phabricator.wikimedia.org/T250594 - https://gerrit.wikimedia.org/r/#/q/I3c80641dc1202df7428714f0ca44717a51ff6021
CVE ID: CVE-2020-12052 State: PUBLISHED Published: 2020-04-27T12:30:09 Last Updated: 2024-08-04T11:48:57.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana version < 6.7.3 is vulnerable for annotation popup XSS. Additional Analyst Notes: - CVE Program Container: References: - https://community.grafana.com/t/release-notes-v6-7-x/27119 - https://security.netapp.com/advisory/ntap-20200511-0001/
CVE ID: CVE-2020-12053 State: PUBLISHED Published: 2020-06-22T19:53:58 Last Updated: 2024-08-04T11:48:57.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=54
CVE ID: CVE-2020-12054 State: PUBLISHED Published: 2020-04-23T12:39:32 Last Updated: 2024-08-04T11:48:58.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO. Additional Analyst Notes: - CVE Program Container: References: - https://wpv
atch Wedding PRO, and Higher Education PRO. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10184 - https://cxsecurity.com/issue/WLB-2020040144
CVE ID: CVE-2020-12058 State: PUBLISHED Published: 2020-09-03T13:09:48 Last Updated: 2024-08-04T11:48:57.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php. Additional Analyst Notes: - CVE Program Container: Referen
the zpage or spage parameter to catalog/admin/geo_zones.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.oscommerce.com/Us&News=155 - https://github.com/gburton/CE-Phoenix/commit/8d0fb97810bc28880415a3a31607f473bfc5fec8 - https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-cephoenix/
CVE ID: CVE-2020-12059 State: PUBLISHED Published: 2020-04-22T00:00:00 Last Updated: 2024-08-04T11:48:57.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception. Additional Analyst Notes: - CVE Program Container: References: - https://tracker.ceph.com/issues/44967 - https://bugzilla.suse.com/show_bug.cgi?id=1170170 - https://docs.ceph.com/docs/master/releases/mimic/ - https://usn.ubuntu.com/4528-1/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE ID: CVE-2020-12061 State: PUBLISHED Published: 2021-05-21T11:03:45 Last Updated: 2024-08-04T11:48:57.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the secure element transmits credentials in plain. This allows an adversary to eavesdrop the communication and derive the secrets stored in the microcontroller. As a result, the attacker is able to arbitrarily manipulate the firmware of the microcontroller. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/releases - https://github.com/Nitrokey/n
Container: References: - https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/releases - https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/commits/master - https://eprint.iacr.org/2021/640.pdf - https://cwe.mitre.org/data/definitions/523.html
CVE ID: CVE-2020-12062 State: PUBLISHED Published: 2020-06-01T15:28:36 Last Updated: 2024-08-04T11:48:57.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is alread
is crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/05/27/1 - https://www.openssh.com/txt/release-8.3 - https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 - https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894
CVE ID: CVE-2020-12063 State: PUBLISHED Published: 2020-04-24T11:59:03 Last Updated: 2024-08-04T11:48:57.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected: not logged in" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked. NO
n" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked. NOTE: some third parties argue that any missed blocking of spoofed outbound messages - except for exact matches to a sender address in the /etc/postfix/sender_login file - is outside the design goals of Postfix and thus cannot be considered a Postfix vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/04/23/3 - https://www.openwall.com/lists/oss-security/2020/04/23/12
CVE ID: CVE-2020-12066 State: PUBLISHED Published: 2020-04-22T16:20:06 Last Updated: 2024-08-04T11:48:57.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.teeworlds.com/forum/viewtopic.php?id=14785 - https://github.com/teeworlds/teeworlds/commit/c68402fa7e279d42886d5951d1ea8ac2facc1ea5 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00044.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00045.html - https://lists.fedoraproject.org/archives
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVYG7CCPS5F3OPOQMJKVNXTQ7BXSEX2V/ - https://www.debian.org/security/2020/dsa-4763 - https://usn.ubuntu.com/4553-1/
CVE ID: CVE-2020-12067 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:18:59.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2021-061/
CVE ID: CVE-2020-12068 State: PUBLISHED Published: 2020-05-14T20:29:21 Last Updated: 2024-08-04T11:48:57.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.codesys.com - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13136&token=c267875c01ea70bc9613bc39c684eedc17f55420&download=
CVE ID: CVE-2020-12069 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:17:54.368Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CODESYS Products: CODESYS V3 containing the CmpUserMgr Problem Types: CWE-916 Description: In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://customers.codesys.com/index.php?
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download= - https://cert.vde.com/en/advisories/VDE-2021-061/ - https://cert.vde.com/en/advisories/VDE-2022-031/ - https://cert.vde.com/en/advisories/VDE-2022-022/
CVE ID: CVE-2020-12070 State: PUBLISHED Published: 2020-04-24T22:44:20 Last Updated: 2024-08-04T11:48:57.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/1.99/includes/class-aws-search.php#L222 - https://wordpress.org/plugins/advanced-woo-search/#developers - https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/2.00/includes/c
ns/advanced-woo-search/#developers - https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/2.00/includes/class-aws-search.php?rev=2290090#L219
CVE ID: CVE-2020-12071 State: PUBLISHED Published: 2020-04-23T01:03:14 Last Updated: 2024-08-04T11:48:57.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anchor 0.12.7 allows admins to cause XSS via crafted post content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anchorcms/anchor-cms/issues/1333
CVE ID: CVE-2020-12073 State: PUBLISHED Published: 2020-04-23T02:01:02 Last Updated: 2024-08-04T11:48:57.846Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AC:L/AV:N/A:L/C:L/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/03/severe-flaws-patched-in-responsive-ready-sites-importer-plugin/