Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10637 State: PUBLISHED Published: 2020-04-15T16:44:02 Last Updated: 2024-08-04T11:06:10.530Z Vendors: n/a Products: Eaton HMiSoft VU3 (HMIVU3 runtime not impacted) Problem Types: CWE-125 Description: Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted input file could trigger an out-of-bounds read when loaded by the affected product. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-105-01
CVE ID: CVE-2020-10638 State: PUBLISHED Published: 2020-05-08T11:49:32 Last Updated: 2024-08-04T11:06:10.447Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-122 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-599/ - https://www.zerodayinitiative.com/advisories/ZDI-20-593/ - https://www.zerodayinitiative
ve.com/advisories/ZDI-20-599/ - https://www.zerodayinitiative.com/advisories/ZDI-20-593/ - https://www.zerodayinitiative.com/advisories/ZDI-20-600/ - https://www.zerodayinitiative.com/advisories/ZDI-20-603/ - https://www.zerodayinitiative.com/advisories/ZDI-20-616/ - https://www.zerodayinitiative.com/advisories/ZDI-20-621/
CVE ID: CVE-2020-10639 State: PUBLISHED Published: 2020-04-15T16:48:04 Last Updated: 2024-08-04T11:06:10.662Z Vendors: n/a Products: Eaton HMiSoft VU3 (HMIVU3 runtime not impacted) Problem Types: CWE-121 Description: Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted input file could cause a buffer overflow when loaded by the affected product. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-105-01
CVE ID: CVE-2020-10640 State: PUBLISHED Published: 2022-02-24T18:50:15.000Z Last Updated: 2025-04-16T16:44:20.840Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Emerson Products: OpenEnterprise SCADA Software Problem Types: CWE-306 Description: Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02
CVE ID: CVE-2020-10641 State: PUBLISHED Published: 2020-04-28T18:22:57 Last Updated: 2024-08-04T11:06:10.554Z Vendors: n/a Products: Ignition 8 Gateway Problem Types: CWE-284 Description: An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway (versions prior to 8.0.10), causing a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-112-01
CVE ID: CVE-2020-10642 State: PUBLISHED Published: 2020-04-13T18:52:48 Last Updated: 2024-08-04T11:06:10.564Z Vendors: n/a Products: Rockwell Automation RSLinx Classic versions 4.1.00 and prior Problem Types: CWE-732 Description: In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lead to the execution of malicious code using system privileges when opening RSLinx Classic. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-100-01
CVE ID: CVE-2020-10643 State: PUBLISHED Published: 2020-07-27T21:20:54.980119Z Last Updated: 2024-09-16T23:51:08.708Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: OSIsoft Products: PI Vision Problem Types: CWE-79 Description: An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02
CVE ID: CVE-2020-10644 State: PUBLISHED Published: 2020-06-09T17:50:58 Last Updated: 2024-08-04T11:06:10.582Z Vendors: n/a Products: Ignition 8 Gateway Problem Types: CWE-502 Description: The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-147-01 - http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html
CVE ID: CVE-2020-10646 State: PUBLISHED Published: 2020-04-13T18:50:27 Last Updated: 2024-08-04T11:06:10.554Z Vendors: n/a Products: Fuji Electric V-Server Lite all versions prior to 4.0.9.0 Problem Types: CWE-122 Description: Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. The buffer allocated to read data, when parsing VPR files, is too small. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-098-04
CVE ID: CVE-2020-10647 State: REJECTED Published: 2020-04-27T12:25:09 Last Updated: 2020-06-09T17:46:11 Description: No description available.
CVE ID: CVE-2020-10648 State: PUBLISHED Published: 2020-03-19T13:36:55 Last Updated: 2024-08-04T11:06:10.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/u-boot/u-boot/commits/master - http://www.openwall.com/lists/oss-security/2020/03/18/5 - https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html
CVE ID: CVE-2020-10649 State: PUBLISHED Published: 2020-03-25T16:10:27 Last Updated: 2024-08-04T11:06:10.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/ - https://www.asus.com/support/FAQ/1042640/ - https://drive.google.com/file/d/1Ap293b7bZLen6DmheppR1IUFEAsCSORC/view?usp=sharing - https://www.asus.com/Laptop
2640/ - https://drive.google.com/file/d/1Ap293b7bZLen6DmheppR1IUFEAsCSORC/view?usp=sharing - https://www.asus.com/Laptops/ASUS-TUF-Gaming-FX504/HelpDesk_Download/
CVE ID: CVE-2020-10650 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:22:00.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https:/
es: - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujan2021.html - https://github.com/advisories/GHSA-rpr3-cw39-3pxh - https://www.oracle.com/security-alerts/cpuoct2022.html - https://github.com/FasterXML/jackson-databind/issues/2658 - https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef - https://lists.debian.org/debian-lts-announce/2023/04/msg00032.html - https://security.netapp.com/advisory/ntap-20230818-0007/
CVE ID: CVE-2020-10654 State: PUBLISHED Published: 2020-05-13T12:39:30 Last Updated: 2024-08-04T11:06:10.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a Remote Code Execution vector on the authenticating endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/ - https://www.pingidentity.com/en/cloud/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/okt1564020467088.html - https://docs.pingidentity.com/bundle/pingid/page/hmc1587998527490.html
CVE ID: CVE-2020-10655 State: PUBLISHED Published: 2021-01-06T13:32:46 Last Updated: 2024-08-04T11:06:10.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/blog - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0003
CVE ID: CVE-2020-10656 State: PUBLISHED Published: 2021-01-06T13:33:52 Last Updated: 2024-08-04T11:06:10.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/blog - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-000
nces: - https://www.proofpoint.com/us/blog - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0003
CVE ID: CVE-2020-10657 State: PUBLISHED Published: 2021-01-06T13:34:30 Last Updated: 2024-08-04T11:06:10.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules feature. The vulnerability allows a remote attacker (with admin or config-admin privileges in the console) to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/blog - https://www.proofpoint.com/us/security/securit
CVE Program Container: References: - https://www.proofpoint.com/us/blog - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0003
CVE ID: CVE-2020-10658 State: PUBLISHED Published: 2021-01-06T13:35:28 Last Updated: 2024-08-04T11:06:10.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/blog - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0003
CVE ID: CVE-2020-10659 State: PUBLISHED Published: 2020-03-18T01:40:36 Last Updated: 2024-08-04T11:06:11.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for example) a user continues to interact with a web site that has an invalid certificate chain. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/etherpacket/CVD-Applications/blob/master/EDC%20Security%20Bulletin%20E19-001a.pdf - https://github.com/etherpacket/CVD-Applications/blob/master/eespwin_10_10060_readme.pdf
CVE ID: CVE-2020-10660 State: PUBLISHED Published: 2020-03-23T12:55:42 Last Updated: 2024-08-04T11:06:10.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020
CVE ID: CVE-2020-10661 State: PUBLISHED Published: 2020-03-23T12:57:03 Last Updated: 2024-08-04T11:06:10.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020
CVE ID: CVE-2020-10663 State: PUBLISHED Published: 2020-04-28T20:58:30 Last Updated: 2024-08-04T11:06:10.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. Additional Analyst Notes: - CVE Program Container: References: - https://www.ruby-lang.org/en/news/2020
ation-dependent. Additional Analyst Notes: - CVE Program Container: References: - https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ - https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/ - https://www.debian.org/security/2020/dsa-4721 - https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E - http
che.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E - https://support.apple.com/kb/HT211931 - http://seclists.org/fulldisclosure/2020/Dec/32 - https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E - https://security.netapp.com/advisory/ntap-20210129-0003/ - https://lists.apache.org/thread.html/
okeeper.apache.org%3E - https://security.netapp.com/advisory/ntap-20210129-0003/ - https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E
CVE ID: CVE-2020-10664 State: PUBLISHED Published: 2020-04-27T12:21:08 Last Updated: 2024-08-04T11:06:10.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference. Additional Analyst Notes: - CVE Program Container: References: - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-10664
CVE ID: CVE-2020-10665 State: PUBLISHED Published: 2020-03-18T18:45:38 Last Updated: 2024-08-04T11:06:10.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md
s: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-002.md - https://docs.docker.com/release-notes/ - https://github.com/spaceraccoon/CVE-2020-10665
CVE ID: CVE-2020-10666 State: PUBLISHED Published: 2021-05-31T11:40:41 Last Updated: 2024-08-04T11:06:10.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities - https://wiki.freepbx.org/display/FOP/2020-03-12+SECURITY%3A+Potential+Rest+Phone+Apps+RCE
CVE ID: CVE-2020-10667 State: PUBLISHED Published: 2020-03-19T18:07:48 Last Updated: 2024-08-04T11:06:10.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name). NOTE: this is fixed in the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-A
etermines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html - http://seclists.org/fulldisclosure/2020/Mar/24
CVE ID: CVE-2020-10668 State: PUBLISHED Published: 2020-03-19T18:09:59 Last Updated: 2024-08-04T11:06:10.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html - http://seclist
se/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html - http://seclists.org/fulldisclosure/2020/Mar/24
CVE ID: CVE-2020-10669 State: PUBLISHED Published: 2020-03-19T22:29:45 Last Updated: 2024-08-04T11:06:10.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http
hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html - http://seclists.org/fulldisclosure/2020/Mar/24
CVE ID: CVE-2020-10670 State: PUBLISHED Published: 2020-03-19T18:10:42 Last Updated: 2024-08-04T11:06:10.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
CVE ID: CVE-2020-10671 State: PUBLISHED Published: 2020-03-19T18:11:22 Last Updated: 2024-08-04T11:06:10.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833
a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/ - http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
CVE ID: CVE-2020-10672 State: PUBLISHED Published: 2020-03-18T21:17:43 Last Updated: 2024-08-04T11:06:11.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cp