Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7945 State: PUBLISHED Published: 2020-09-18T17:58:51 Last Updated: 2024-08-04T09:48:24.936Z Vendors: n/a Products: Continuous Delivery for Puppet Enterprise (CD4PE) Problem Types: Insufficiently Protected Credentials Description: Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access to them. This is resolved in Continuous Delivery for Puppet Enterprise 4.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2020-7945
CVE ID: CVE-2020-7947 State: PUBLISHED Published: 2020-04-01T12:51:59 Last Updated: 2024-08-04T09:48:24.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/auth0/#developers - https://auth0.com/docs/cms/wordpress -
rogram Container: References: - https://wordpress.org/plugins/auth0/#developers - https://auth0.com/docs/cms/wordpress - https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0 - https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
CVE ID: CVE-2020-7948 State: PUBLISHED Published: 2020-04-01T12:53:18 Last Updated: 2024-08-04T09:48:24.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/auth0/#developers - https://auth0.com/docs/cms/wordpress - https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0 - https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
CVE ID: CVE-2020-7949 State: PUBLISHED Published: 2020-01-27T16:40:45 Last Updated: 2024-08-04T09:48:24.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a GetValue call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bi7s/CVE/tree/master/CVE-2020-7949
CVE ID: CVE-2020-7950 State: PUBLISHED Published: 2020-01-27T16:39:58 Last Updated: 2024-08-04T09:48:24.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a vulnerable function call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bi7s/CVE/tree/master/CVE-2020-7950
CVE ID: CVE-2020-7951 State: PUBLISHED Published: 2020-01-27T16:36:21 Last Updated: 2024-08-04T09:48:24.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is affected by memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bi7s/CVE/tree/master/CVE-2020-7951
CVE ID: CVE-2020-7952 State: PUBLISHED Published: 2020-01-27T16:33:21 Last Updated: 2024-08-04T09:48:24.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is affected by memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bi7s/CVE/tree/master/CVE-2020-7952
CVE ID: CVE-2020-7953 State: PUBLISHED Published: 2020-02-06T16:26:12 Last Updated: 2024-08-04T09:48:24.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to the use of the nmap -iL (aka input file) option. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40ph0rensic - https://medium.com/%40ph0rensic/three-cves-on-opmon-3ca775a262f5
CVE ID: CVE-2020-7954 State: PUBLISHED Published: 2020-02-06T16:31:49 Last Updated: 2024-08-04T09:48:24.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of correct configuration in the server's sudoers file, which by default allows the execution of programs (e.g. nmap) without the need for a password with sudo. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40ph0rensic - https://medium.com/%40ph0rensic/three-cves-on-opmon-3ca775a262f5
CVE ID: CVE-2020-7955 State: PUBLISHED Published: 2020-01-31T12:19:40 Last Updated: 2024-08-04T09:48:24.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul/ - https://github.com/hashicorp/consul/issues/7160
CVE ID: CVE-2020-7956 State: PUBLISHED Published: 2020-01-31T12:43:52 Last Updated: 2024-08-04T09:48:24.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/nomad/ - https://github.com/hashicorp/nomad/issues/7003
CVE ID: CVE-2020-7957 State: PUBLISHED Published: 2020-02-12T16:50:56 Last Updated: 2024-08-04T09:48:24.611Z Severity: LOW (CVSS 3.1 CVSS:3.0/AC:H/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - http://www.openwall.com/lists/oss-security/2020/02/12/2 - https://dovecot.org/pipermail/doveco
://dovecot.org/security - http://www.openwall.com/lists/oss-security/2020/02/12/2 - https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XYT55WH372BJOXCJRKBDIFGBMPVOIDT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJXHOUT3FH2DJNMACSX4GHPP4MUV4UKA/
CVE ID: CVE-2020-7958 State: PUBLISHED Published: 2020-04-14T15:16:46 Last Updated: 2024-08-04T09:48:24.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in the Rich Execution Environment (REE) to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the Trusted Application (TA) supports an extended number of commands beyond what is needed to implement a fingerprint authentication system compatible with Android. An attacker who is in the position to send commands to the TA (for ex
int authentication system compatible with Android. An attacker who is in the position to send commands to the TA (for example, the root user) is able to send a sequence of these commands that will result in the TA sending a raw fingerprint image to the REE. This means that the Trusted Execution Environment (TEE) no longer protects identifiable fingerprint data from the REE. Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cve-2020-7958/
CVE ID: CVE-2020-7959 State: PUBLISHED Published: 2020-02-17T20:22:36 Last Updated: 2024-08-04T09:48:24.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognized Database exception message if the database does not exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/websecnl/LabVantage8.3-Exploit - https://www.exploit-db.com/exploits/48090
CVE ID: CVE-2020-7961 State: PUBLISHED Published: 2020-03-20T18:16:42.000Z Last Updated: 2025-10-21T23:35:47.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/117954271 - http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Executi
content/id/117954271 - http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-Unmarshalling-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
CVE ID: CVE-2020-7962 State: PUBLISHED Published: 2020-11-13T18:55:18 Last Updated: 2024-08-04T09:48:24.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an attacker to detect a valid answer based on the HTTP response content, and reuse this answer later for a password reset on a chosen password. The enumeration is possible because, within the HTTP response content, WRONG ID is only returned when the answer is incorrect. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2020050185
CVE ID: CVE-2020-7964 State: PUBLISHED Published: 2020-01-24T19:38:03 Last Updated: 2024-08-04T09:48:24.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3 - https://github.com/mirumee/saleor/releases/tag/2.9.1
CVE ID: CVE-2020-7965 State: PUBLISHED Published: 2020-01-29T14:33:16 Last Updated: 2024-08-04T09:48:25.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made across domains, leading to CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://webargs.readthedocs.io/en/latest/changelog.html
CVE ID: CVE-2020-7966 State: PUBLISHED Published: 2020-02-05T15:58:56 Last Updated: 2024-08-04T09:48:24.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7967 State: PUBLISHED Published: 2020-02-05T15:58:10 Last Updated: 2024-08-04T09:48:24.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7968 State: PUBLISHED Published: 2020-02-05T15:56:45 Last Updated: 2024-08-04T09:48:25.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7969 State: PUBLISHED Published: 2020-02-05T15:55:35 Last Updated: 2024-08-04T09:48:24.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7971 State: PUBLISHED Published: 2020-02-05T15:54:27 Last Updated: 2024-08-04T09:48:24.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 11.0 and later through 12.7.2 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7972 State: PUBLISHED Published: 2020-02-05T15:53:22 Last Updated: 2024-08-04T09:48:24.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7973 State: PUBLISHED Published: 2020-02-05T15:52:09 Last Updated: 2024-08-04T09:48:25.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab through 12.7.2 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/security/gitlab/issues/14 - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7974 State: PUBLISHED Published: 2020-02-05T15:51:08 Last Updated: 2024-08-04T09:48:24.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 10.1 through 12.7.2 allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7975 State: REJECTED Published: 2020-03-06T12:33:30 Last Updated: 2020-03-06T12:33:30 Description: No description available.
CVE ID: CVE-2020-7976 State: PUBLISHED Published: 2020-02-05T15:26:53 Last Updated: 2024-08-04T09:48:24.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7977 State: PUBLISHED Published: 2020-02-05T15:25:36 Last Updated: 2024-08-04T09:48:24.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7978 State: PUBLISHED Published: 2020-02-05T15:20:57 Last Updated: 2024-08-04T09:48:24.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7979 State: PUBLISHED Published: 2020-02-05T14:47:29 Last Updated: 2024-08-04T09:48:25.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.9 and later through 12.7.2 has Insecure Permission Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
CVE ID: CVE-2020-7980 State: PUBLISHED Published: 2020-01-25T18:44:51 Last Updated: 2024-08-04T09:48:24.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html - https://github.com/Xh4H/Satellian-CVE-2020-7980 - http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
CVE ID: CVE-2020-7981 State: PUBLISHED Published: 2020-01-25T19:18:35 Last Updated: 2024-08-04T09:48:24.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613 - https://github.com/alexreisner/geocoder/compare/v1.6.0...v1.6.1
CVE ID: CVE-2020-7982 State: PUBLISHED Published: 2020-03-16T21:05:49 Last Updated: 2024-08-04T09:48:24.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openwrt/openwrt/commits/master - https://openwrt.org/advisory/2020-01-31-1 - https://blog.
erences: - https://github.com/openwrt/openwrt/commits/master - https://openwrt.org/advisory/2020-01-31-1 - https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982 - https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerable-to-attacks-that-execute-malicious-code/
CVE ID: CVE-2020-7983 State: PUBLISHED Published: 2020-05-05T17:06:51 Last Updated: 2024-08-04T09:48:24.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/CyberSecurityUP/26c5b032897630fe8407da4a8ef216d4
CVE ID: CVE-2020-7984 State: PUBLISHED Published: 2020-01-26T20:04:06 Last Updated: 2024-08-04T09:48:24.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration. Additional Analyst Notes: - CVE Program Container: References: - https://blog.huntresslabs.com/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5 - https://www.crn.com/news/managed-serv
om/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5 - https://www.crn.com/news/managed-services/solarwinds-rmm-tool-has-open-zero-day-exploit-huntress-labs - https://success.solarwindsmsp.com/kb/solarwinds_n-central/How-to-Expunge-credentials-for-Customer-levels-of-SolarWinds-N-central - https://community.solarwindsmsp.com/Support/Software-Downloads/MSP-N-Central/MSP-N-central-12-2-SP1-HF2 - https://community.solarwindsmsp.com/Support/Software-Downloads/MSP-N-Central/MSP-N-central-12-1-SP1-HF5 - https://github.com/flipflopfpv - https://packetstormsecurity.com/files/156033 - https://twitter.com/SecurityNewsbot/status/1219722631898812416
CVE ID: CVE-2020-7988 State: PUBLISHED Published: 2020-03-04T16:07:52 Last Updated: 2024-08-04T09:48:24.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens. Additional Analyst Notes: - CVE Program Container: References: - https://phpipam.net/news/phpipam-v1-5-released/ - https://pastebin.com/ZPECbgZb
CVE ID: CVE-2020-7989 State: PUBLISHED Published: 2020-01-26T21:23:08 Last Updated: 2024-08-04T09:48:24.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adive Framework 2.0.8 has admin/user/add userUsername XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47946 - https://github.com/ferdinandmartin/adive-php7/blob/master/README.md
CVE ID: CVE-2020-7990 State: PUBLISHED Published: 2020-01-26T21:22:58 Last Updated: 2024-08-04T09:48:24.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adive Framework 2.0.8 has admin/user/add userName XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47946 - https://github.com/ferdinandmartin/adive-php7/blob/master/README.md
CVE ID: CVE-2020-7991 State: PUBLISHED Published: 2020-01-26T21:22:48 Last Updated: 2024-08-04T09:48:24.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47946 - https://github.com/ferdinandmartin/adive-php7/blob/master/README.md - http://packetstormsecurity.com/files/156106/Adive-Framework-2.0.8-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-7993 State: PUBLISHED Published: 2020-02-03T14:26:38 Last Updated: 2024-08-04T09:48:24.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prototypejs/prototype/blob/master/CHANGELOG - https://medium.com/%40vbharad/improper-access-control-vulnerability-in-prototype-1-6-0-1-framework-379cc3a05079