Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
use connections to Automation Builder. The execution of the PLC application is not affected by this vulnerability. This issue affects ABB AC500 V2 products with onboard Ethernet. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010645&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24692 State: PUBLISHED Published: 2020-09-25T03:43:12 Last Updated: 2024-08-04T15:19:09.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0011
CVE ID: CVE-2020-24693 State: PUBLISHED Published: 2020-12-18T07:08:35 Last Updated: 2024-08-04T15:19:09.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories
CVE ID: CVE-2020-24696 State: PUBLISHED Published: 2020-10-02T08:21:46 Last Updated: 2024-08-04T15:19:09.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature. Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html
CVE ID: CVE-2020-24697 State: PUBLISHED Published: 2020-10-02T08:23:11 Last Updated: 2024-08-04T15:19:09.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries with a GSS-TSIG signature. Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html
CVE ID: CVE-2020-24698 State: PUBLISHED Published: 2020-10-02T08:23:44 Last Updated: 2024-08-04T15:19:09.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature. Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html
CVE ID: CVE-2020-24699 State: PUBLISHED Published: 2020-08-31T15:29:07 Last Updated: 2024-08-04T15:19:09.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/chamber-dashboard-business-directory/#developers - https://l0l.xyz/sec/2020/08/31/1-wordpress-crm-xss.html
CVE ID: CVE-2020-24700 State: PUBLISHED Published: 2021-01-12T07:42:56 Last Updated: 2024-08-04T15:19:09.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html - http://seclists.org/fulldisclosure/2021/Jul/33 - http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
CVE ID: CVE-2020-24701 State: PUBLISHED Published: 2021-01-12T07:58:16 Last Updated: 2024-08-04T15:19:09.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html - http://seclists.org/fulldisclosure/2021/Jul/33 - http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
CVE ID: CVE-2020-24703 State: PUBLISHED Published: 2020-08-27T00:00:00 Last Updated: 2024-08-04T15:19:09.336Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and
Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0687/
CVE ID: CVE-2020-24704 State: PUBLISHED Published: 2020-08-27T00:00:00 Last Updated: 2024-08-04T15:19:09.324Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/
Server 3.3.0 and 3.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/
CVE ID: CVE-2020-24705 State: PUBLISHED Published: 2020-08-27T00:00:00 Last Updated: 2024-08-04T15:19:09.326Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0. Additional Analyst Notes: - CVE Program Contain
h 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/
CVE ID: CVE-2020-24706 State: PUBLISHED Published: 2020-08-27T00:00:00 Last Updated: 2024-08-04T15:19:09.362Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718 - https://security.docs.wso2.com/en
eferences: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718 - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/
CVE ID: CVE-2020-24707 State: PUBLISHED Published: 2020-10-28T19:35:21 Last Updated: 2024-08-04T15:19:09.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2020-0052/ - https://github.com/gophish/gophish/releases/tag/v0.11.0 - https://github.com/gophish/gophish/commit/b25f5ac5e468f6730e377f43c7995e18f8fccc2b
CVE ID: CVE-2020-24708 State: PUBLISHED Published: 2020-10-28T19:32:46 Last Updated: 2024-08-04T15:19:09.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2020-0048/ - https://github.com/gophish/gophish/commit/90fed5a575628b89eaf941e1627b49e0f3693812
CVE ID: CVE-2020-24709 State: PUBLISHED Published: 2020-10-28T19:33:01 Last Updated: 2024-08-04T15:19:09.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2020-0049/
CVE ID: CVE-2020-24710 State: PUBLISHED Published: 2020-10-28T19:33:16 Last Updated: 2024-08-04T15:19:09.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gophish before 0.11.0 allows SSRF attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gophish/gophish/commit/e3352f481e94054ffe08494c9225d3878347b005 - https://herolab.usd.de/security-advisories/usd-2020-0054/ - https://github.com/gophish/gophish/releases/tag/v0.11.0
CVE ID: CVE-2020-24711 State: PUBLISHED Published: 2020-10-28T19:33:23 Last Updated: 2024-08-04T15:19:09.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gophish/gophish/commit/6df62e85fd60f0931d3c8bfdb13b436a961bc9b6 - https://herolab.usd.de/security-advisories/usd-2020-0051/ - https://github.com/gophish/gophish/releases/tag/v0.11.0
CVE ID: CVE-2020-24712 State: PUBLISHED Published: 2020-10-28T19:33:10 Last Updated: 2024-08-04T15:19:09.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2020-0050/ - https://github.com/gophish/gophish/commit/4e9b94b641755f359542b246cc0c555fa3bc6715 - https://github.com/gophish/gophish/releases/tag/v0.11.0
CVE ID: CVE-2020-24713 State: PUBLISHED Published: 2020-10-28T19:33:31 Last Updated: 2024-08-04T15:19:09.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2020-0053/
CVE ID: CVE-2020-24714 State: PUBLISHED Published: 2020-08-27T21:52:29 Last Updated: 2024-08-04T15:19:09.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname option. Additional Analyst Notes: - CVE Program Container: References: - https://scalyr-static.s3.amazonaws.com/technical-details/index.html
CVE ID: CVE-2020-24715 State: PUBLISHED Published: 2020-08-27T21:52:44 Last Updated: 2024-08-04T15:19:09.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName. Additional Analyst Notes: - CVE Program Container: References: - https://scalyr-static.s3.amazonaws.com/technical-details/index.html
CVE ID: CVE-2020-24716 State: PUBLISHED Published: 2020-08-27T18:03:32 Last Updated: 2024-08-04T15:19:09.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. Additional Analyst Notes: - CVE Program Container: References: - https://jira.ixsystems.com/browse/NAS-107270 - https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f - https://reviews.freebsd.org/D26107 - https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1
CVE ID: CVE-2020-24717 State: PUBLISHED Published: 2020-08-27T18:03:21 Last Updated: 2024-08-04T15:19:09.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777. Additional Analyst Notes: - CVE Program Container: References: - https://jira.ixsystems.com/browse/NAS-107270 - https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f - https://reviews.freebsd.org/D26107 - https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1
CVE ID: CVE-2020-24718 State: PUBLISHED Published: 2020-09-25T03:49:02 Last Updated: 2024-08-04T15:19:09.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/illumos/illumos-gate/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249 - https://security.FreeB
e/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:28.bhyve_vmcs.asc - https://security.netapp.com/advisory/ntap-20201016-0002/
CVE ID: CVE-2020-24719 State: PUBLISHED Published: 2020-11-12T20:31:47 Last Updated: 2024-08-04T15:19:09.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#Vuln
.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#VulnerabilityReporting
CVE ID: CVE-2020-24721 State: PUBLISHED Published: 2020-09-30T17:43:01 Last Updated: 2024-08-04T15:19:09.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework. Additional Analyst Notes: - CVE Program Container: References: - https://blog.google/inside-google/company-announcements/update-exposure-notifications - https://github.com/minvws/nl-covid19-
://blog.google/inside-google/company-announcements/update-exposure-notifications - https://github.com/minvws/nl-covid19-notification-app-coordination/blob/master/CVEs/CVE-2020-24721.txt - https://seclists.org/fulldisclosure/2020/Sep/53 - http://packetstormsecurity.com/files/159419/Corona-Exposure-Notifications-API-Data-Leakage.html
CVE ID: CVE-2020-24722 State: PUBLISHED Published: 2020-10-07T14:07:36 Last Updated: 2024-08-04T15:19:09.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks. Additional Analyst Notes: - CVE Program Container: Referen
thentication would be a useful defense against relay attacks. Additional Analyst Notes: - CVE Program Container: References: - https://blog.google/inside-google/company-announcements/update-exposure-notifications - http://seclists.org/fulldisclosure/2020/Oct/12 - https://github.com/google/exposure-notifications-internals/blob/main/en-risks-and-mitigations-faq.md#additional-considerations - http://packetstormsecurity.com/files/159496/GAEN-Protocol-Metadata-Deanonymization-Risk-Score-Inflation.html
CVE ID: CVE-2020-24723 State: PUBLISHED Published: 2020-11-18T12:25:17 Last Updated: 2024-08-04T15:19:09.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/ - https://th3cyb3rc0p.medium.com/cve-2020-24723-89ea76588286 - https://systemweakness.com/cve-2020-24723-89ea76588286
CVE ID: CVE-2020-24736 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T17:33:13.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sqlite.org/src/info/4feb3159c6bc3f7e33959 - https://security.netapp.com/advisory/ntap-20230526-0005/
CVE ID: CVE-2020-24739 State: PUBLISHED Published: 2020-09-10T13:17:30 Last Updated: 2024-08-04T15:19:09.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all administrators except the initial administrator will be deleted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/76
CVE ID: CVE-2020-24740 State: PUBLISHED Published: 2021-05-18T15:28:56 Last Updated: 2024-08-04T15:19:09.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/81
CVE ID: CVE-2020-24741 State: REJECTED Published: 2021-08-09T21:18:25 Last Updated: 2021-08-21T16:54:53 Description: No description available.
CVE ID: CVE-2020-24742 State: PUBLISHED Published: 2021-08-09T21:18:27 Last Updated: 2024-08-04T15:19:09.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files. Additional Analyst Notes: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/280730
CVE ID: CVE-2020-24743 State: PUBLISHED Published: 2021-11-03T16:07:41 Last Updated: 2024-08-04T15:19:09.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/issues.html#v14550
CVE ID: CVE-2020-24750 State: PUBLISHED Published: 2020-09-17T18:39:40 Last Updated: 2024-08-04T15:19:09.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/2798 - https://www.oracle.com/security-alerts/cpujan2021.html - https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b - https://security.netapp.com/advisory/ntap-20201009-0003/ - https:/
ind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b - https://security.netapp.com/advisory/ntap-20201009-0003/ - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-24753 State: PUBLISHED Published: 2020-09-17T18:00:28 Last Updated: 2024-08-04T15:19:09.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption. Additional Analyst Notes: - CVE Program Container: References: -
ng a crash or potentially exploitable heap corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/objsys/oocborrt/commit/539851c66778f68a244633985f6f8d0df94ea3b3 - https://warcollar.com/cve-2020-24753.html
CVE ID: CVE-2020-24755 State: PUBLISHED Published: 2021-05-17T21:06:37 Last Updated: 2024-08-04T15:19:09.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modification of the library to execute code on the system. This was tested in (Windows 7 x64/Windows 10 x64). Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=T41h4yeh9dk
CVE ID: CVE-2020-24765 State: PUBLISHED Published: 2020-10-20T19:11:24 Last Updated: 2024-08-04T15:19:09.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trump88/CVE-2020-24765