Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12125 State: PUBLISHED Published: 2020-10-02T08:12:23 Last Updated: 2024-08-04T11:48:58.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary machine instructions as root without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.wavlink.com/en_us/product/WL-WN530H4.html - https://cerne.xyz/bugs/CVE-2020-12125
CVE ID: CVE-2020-12126 State: PUBLISHED Published: 2020-10-02T08:12:53 Last Updated: 2024-08-04T11:48:58.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, change configuration variables, and cause denial of service via an unauthenticated endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.wavlink.com/en_us/product/WL-WN530H4.html - https://cerne.xyz/bugs/CVE-2020-12126
CVE ID: CVE-2020-12127 State: PUBLISHED Published: 2020-10-02T08:13:20 Last Updated: 2024-08-04T11:48:58.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.wavlink.com/en_us/product/WL-WN530H4.html - https://cerne.xyz/bugs/CVE-2020-12127
CVE ID: CVE-2020-12128 State: PUBLISHED Published: 2020-04-23T23:05:20 Last Updated: 2024-08-04T11:48:58.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2199
CVE ID: CVE-2020-12129 State: PUBLISHED Published: 2020-04-23T23:05:49 Last Updated: 2024-08-04T11:48:58.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2203
CVE ID: CVE-2020-12130 State: PUBLISHED Published: 2020-04-23T23:05:41 Last Updated: 2024-08-04T11:48:58.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2203
CVE ID: CVE-2020-12131 State: PUBLISHED Published: 2020-04-23T23:05:30 Last Updated: 2024-08-04T11:48:58.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2203
CVE ID: CVE-2020-12132 State: PUBLISHED Published: 2020-04-23T23:50:05 Last Updated: 2024-08-04T11:48:58.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.fifthplay.com/faq/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5561.php
CVE ID: CVE-2020-12133 State: PUBLISHED Published: 2020-04-27T14:25:43 Last Updated: 2024-08-04T11:48:58.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://www.furukawa.co.jp - https://www.tecnoredsa.com.ar - http://packetstormsecurity.com/files/157383/Furukawa-Electric-ConsciusMAP-2.8.1-Java-Deserialization-Remote-Code-Execution.html
CVE ID: CVE-2020-12134 State: PUBLISHED Published: 2020-04-24T00:08:04 Last Updated: 2024-08-04T11:48:58.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5562.php
CVE ID: CVE-2020-12135 State: PUBLISHED Published: 2020-04-24T00:31:51 Last Updated: 2024-08-04T11:48:58.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/whoopsie/+bug/1872560 - https://launchpadlibrarian.net/474887364/bson-fix-overflow.patch - https://github.com/10gen-archive/mongo-c-driver-legacy/commit/1a1f5e26a4309480d88598913f9eebf9e9c
n-fix-overflow.patch - https://github.com/10gen-archive/mongo-c-driver-legacy/commit/1a1f5e26a4309480d88598913f9eebf9e9cba8ca#diff-f7d29a680148f52d6601f59ed787f577 - https://usn.ubuntu.com/4450-1/
CVE ID: CVE-2020-12137 State: PUBLISHED Published: 2020-04-24T12:37:58 Last Updated: 2024-08-04T11:48:58.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/02/24/2 - https://www.openwall.com/li
Program Container: References: - https://www.openwall.com/lists/oss-security/2020/02/24/2 - https://www.openwall.com/lists/oss-security/2020/02/24/3 - http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS - http://www.openwall.com/lists/oss-security/2020/04/24/3 - https://www.debian.org/security/2020/dsa-4664 - https://lists.debian.org/debian-lts-announce/2020/05/msg00002.html - https://usn.ubuntu.com/4348-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4COSBBEMJYLV7WSW5QTUJUOFJFK47KK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF/ -
.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html
CVE ID: CVE-2020-12138 State: PUBLISHED Published: 2020-04-27T14:31:47 Last Updated: 2024-08-04T11:48:58.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages. Additional Analyst Notes: - CVE Program Container: References: - https://eclypsium.com/2019/11/12/mother-of-
ockedPages. Additional Analyst Notes: - CVE Program Container: References: - https://eclypsium.com/2019/11/12/mother-of-all-drivers/ - https://h0mbre.github.io/atillk64_exploit/
CVE ID: CVE-2020-12140 State: PUBLISHED Published: 2021-12-07T18:23:51 Last Updated: 2024-08-04T11:48:58.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP frames. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/ScepticCtf - https://github.com/contiki-ng/contiki-ng/pull/1662
CVE ID: CVE-2020-12141 State: PUBLISHED Published: 2021-10-19T15:23:46 Last Updated: 2024-08-04T11:48:58.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/ScepticCtf - https://github.com/contiki-ng/contiki-ng/commit/12c824386ab60de757de5001974d73b32e19ad71#diff-32367fad664c6118fd5dda77cdf38eedc006cdd7544eca5bbeebe0b99653f8a0 - https://github.com
60de757de5001974d73b32e19ad71#diff-32367fad664c6118fd5dda77cdf38eedc006cdd7544eca5bbeebe0b99653f8a0 - https://github.com/contiki-ng/contiki-ng/pull/1355
CVE ID: CVE-2020-12142 State: PUBLISHED Published: 2020-05-05T19:54:07 Last Updated: 2024-08-04T11:48:58.551Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: Silver Peak Systems, Inc. Products: 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator, 3. EdgeConnect in AWS, Azure, GCP Problem Types: CWE-668 Description: 1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance
-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_ipsec_udp_key_material-cve_2020_12142.pdf
CVE ID: CVE-2020-12143 State: PUBLISHED Published: 2020-05-05T19:53:56 Last Updated: 2024-08-04T11:48:58.488Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator, 3. EdgeConnect in AWS, Azure, GCP Problem Types: CWE-295 Description: The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_rogue
Program Container: References: - https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_rogue_orchestrator-cve_2020_12143.pdf
CVE ID: CVE-2020-12144 State: PUBLISHED Published: 2020-05-05T19:54:00 Last Updated: 2024-08-04T11:48:58.453Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator 3. EdgeConnect in AWS, Azure, GCP Problem Types: CWE-295 Description: The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/sites/default/files/advisory/security_advisory_noti
: - CVE Program Container: References: - https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_rogue_portal-cve_2020_12144.pdf
CVE ID: CVE-2020-12145 State: PUBLISHED Published: 2020-11-05T18:48:31.021390Z Last Updated: 2024-09-16T17:07:58.945Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: Unity Orchestrator Problem Types: CVE-2020-12145, CWE-287 Description: Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability. Addi
stances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/support/user-documentation/security-advisories
CVE ID: CVE-2020-12146 State: PUBLISHED Published: 2020-11-05T18:51:45.101913Z Last Updated: 2024-09-17T00:30:55.637Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: Unity Orchestrator Problem Types: CVE-2020-12147, CWE-22 Description: In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/support/user-documentation/security-advisories
CVE ID: CVE-2020-12147 State: PUBLISHED Published: 2020-11-05T18:50:21.332476Z Last Updated: 2024-09-16T17:58:20.812Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: Unity Orchestrator Problem Types: CVE-2020-12147, CWE-22 Description: In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/support/user-documentation/security-advisories
CVE ID: CVE-2020-12148 State: PUBLISHED Published: 2020-12-11T15:24:23.056324Z Last Updated: 2024-09-16T23:05:48.430Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: ECOS Problem Types: CWE-78 Description: A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allow an attacker to execute arbitrary commands with the privileges of the web server running on the EdgeConnect appliance. An attacker could exploit this vulnerability to establish an interactive channel, effectively taking control of the target system. This vulnerability can be exploited by an attacker wi
eractive channel, effectively taking control of the target system. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to : 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/support/user-documentation/security-advisories
CVE ID: CVE-2020-12149 State: PUBLISHED Published: 2020-12-11T15:23:32.991669Z Last Updated: 2024-09-16T23:26:33.482Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Silver Peak Systems, Inc. Products: ECOS Problem Types: CWE-78 Description: The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects a
ility can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.silver-peak.com/support/user-documentation/security-advisories
CVE ID: CVE-2020-12242 State: PUBLISHED Published: 2020-04-27T14:56:12 Last Updated: 2024-08-04T11:48:58.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a different user account. Additional Analyst Notes: - CVE Program Container: References: - https://0xem.ma/cve/2020/04/28/Source-hl2-relaunch-exec.html
CVE ID: CVE-2020-12243 State: PUBLISHED Published: 2020-04-28T18:07:29 Last Updated: 2024-08-04T11:48:58.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2020/dsa-4666 - https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html - https://usn.ubuntu.com/4352-2/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html - https://usn.ubuntu.com/4352-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html - h
unce/2020-05/msg00016.html - https://usn.ubuntu.com/4352-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugs.openldap.org/show_bug.cgi?id=9202 - https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES - https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 - https://security.netapp.com/advisory/ntap-20200511-0003/ - https://support.apple.com/kb/HT211289 - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-12244 State: PUBLISHED Published: 2020-05-19T13:51:39 Last Updated: 2024-08-04T11:48:58.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation. Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-02.html - http://www.openwall.com/lists/oss-security/2020/05/19/3 - https://www.debian.org/security/2020/dsa-4691 - http://lists.opensuse.org/ope
wall.com/lists/oss-security/2020/05/19/3 - https://www.debian.org/security/2020/dsa-4691 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S/
CVE ID: CVE-2020-12245 State: PUBLISHED Published: 2020-04-24T20:24:48 Last Updated: 2024-08-04T11:48:58.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/blob/master/CHANGELOG.md#673-2020-04-23 - https://community.grafana.com/t/release-notes-v6-7-x/27119 - https://github.com/grafana/grafana/pull/23816 - https://security.netapp.com/advisory/ntap-20200511-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/ms
e.org/opensuse-security-announce/2020-06/msg00060.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html
CVE ID: CVE-2020-12246 State: PUBLISHED Published: 2020-04-29T12:34:24 Last Updated: 2024-08-04T11:48:58.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parameter. Additional Analyst Notes: - CVE Program Container: References: - https://yadi.sk/i/YdfXr-ofAN2ZWA - https://yadi.sk/i/iIUCJVaGEuSaAw - https://yadi.sk/i/jXV87yn4ZJfSHA - https://medium.com/%40Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e
CVE ID: CVE-2020-12247 State: PUBLISHED Published: 2020-09-04T03:32:00 Last Updated: 2024-08-04T11:48:58.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-12248 State: PUBLISHED Published: 2020-09-04T03:32:41 Last Updated: 2024-08-04T11:48:58.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-12251 State: PUBLISHED Published: 2020-04-29T13:02:36 Last Updated: 2024-08-04T11:48:58.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an authenticated user to change the filename value (in the POST method) from the original filename to achieve directory traversal via a ../ sequence and, for example, obtain a complete directory listing of the machine. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Apr/56 - http://packetstormsecurity.com/files/157484/Gigamon-GigaVUE-5.5.01.11-Directory-Traversal-File-Upload.html
CVE ID: CVE-2020-12252 State: PUBLISHED Published: 2020-04-29T13:03:47 Last Updated: 2024-08-04T11:48:58.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an arbitrary file upload for an authenticated user. If an executable file is uploaded into the www-root directory, then it could yield remote code execution via the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Apr/56 - http://packetstormsecurity.com/files/157484/Gigamon-GigaVUE-5.5.01.11-Directory-Traversal-File-Upload.html
CVE ID: CVE-2020-12254 State: PUBLISHED Published: 2020-04-26T14:52:24 Last Updated: 2024-08-04T11:48:58.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink. Additional Analyst Notes: - CVE Program Container: References: - https://support.avira.com/hc/en-us/articles/360000109798-Avira-Antivirus-for-Windows - http://web.archive.org/web/20200429193852/https://support.avira.com/hc/en-us/articles/360000109798-Avira-Antivirus-for-Windows