Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-16220 State: PUBLISHED Published: 2020-09-11T13:11:22 Last Updated: 2024-08-04T13:37:53.493Z Vendors: Philips Products: Patient Information Center iX (PICiX), PerformanceBridge Focal Point Problem Types: CWE-1286 Description: In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certain syntax) but it does not validate or incorrectly validates that the input complies with the syntax, causing the certificate enrollment service to crash. It does not impact monitoring but prevents new devices from enrolling. Additional Analyst Notes: - CVE Pr
vice to crash. It does not impact monitoring but prevents new devices from enrolling. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 - https://www.philips.com/productsecurity
CVE ID: CVE-2020-16221 State: PUBLISHED Published: 2020-08-06T23:12:20 Last Updated: 2024-08-04T13:37:54.174Z Vendors: n/a Products: Delta Electronics TPEditor Problem Types: CWE-121 Description: Delta Electronics TPEditor Versions 1.97 and prior. A stack-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04 - https://www.zerodayinitiative.com/advisories/ZDI-20-962/
CVE ID: CVE-2020-16222 State: PUBLISHED Published: 2020-09-11T12:55:23 Last Updated: 2024-08-04T13:37:54.092Z Vendors: Philips Products: Patient Information Center iX (PICiX), PerformanceBridge Focal Point Problem Types: CWE-287 Description: In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given identity, the software does not prove or insufficiently proves the claim is correct. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 - https://www.philips.com/productsecurity
CVE ID: CVE-2020-16223 State: PUBLISHED Published: 2020-08-06T23:11:16 Last Updated: 2024-08-04T13:37:54.132Z Vendors: n/a Products: Delta Electronics TPEditor Problem Types: CWE-122 Description: Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04 - https://www.zerodayinitiative.com/advisories/ZDI-20-966/
CVE ID: CVE-2020-16224 State: PUBLISHED Published: 2020-09-11T13:05:19 Last Updated: 2024-08-04T13:37:53.948Z Vendors: Philips Products: Patient Information Center iX (PICiX) Problem Types: CWE-130 Description: In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data, causing the application on the surveillance station to restart. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 - https://www.philips.com/productsecurity
CVE ID: CVE-2020-16225 State: PUBLISHED Published: 2020-08-06T23:14:17 Last Updated: 2024-08-04T13:37:54.172Z Vendors: n/a Products: Delta Electronics TPEditor Problem Types: CWE-123 Description: Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04 - https://www.zerodayinitiative.com/advisories/ZDI-20-964/
CVE ID: CVE-2020-16226 State: PUBLISHED Published: 2020-10-05T17:19:17.358565Z Last Updated: 2024-09-17T00:25:38.551Z Vendors: Mitsubishi Electric Products: QJ71MES96, QJ71WS96, Q06CCPU-V, Q24DHCCPU-V, Q24DHCCPU-VG, R12CCPU-V, RD55UP06-V,, D55UP12-V, RJ71GN11-T2, RJ71EN71, QJ71E71-100, LJ71E71-100, QJ71MT91, RD78Gn(n=4,8,16,32,64), RD78GHV, RD78GHW, NZ2GACP620-60, NZ2GACP620-300, NZ2FT-MT, NZ2FT-EIP, Q03UDECPU, QnUDEHCPU(n=04/06/10/13/20/26/50/100), QnUDVCPU(n=03/04/06/13/26), QnUDPVCPU(n=04/06/13/2), LnCPU(-P)(n=02/06/26), L26CPU-(P)BT, RnCPU(n=00/01/02), RnCPU(n=04/08/16/32/120), RnENCPU(n=04/08/16/32/120), RnSFCPU (n=08/16/32/120), RnPCPU(n=08/16/32/120), RnPSFCPU(n=08/16/32/120), FX5U(C)
32/120), RnENCPU(n=04/08/16/32/120), RnSFCPU (n=08/16/32/120), RnPCPU(n=08/16/32/120), RnPSFCPU(n=08/16/32/120), FX5U(C)-**M*/**, FX5UC-32M*/**-TS, FX5UJ-**M*/**, FX5-ENET, FX5-ENET/IP, FX3U-ENET-ADP, FX3GE-**M*/**, FX3U-ENET, FX3U-ENET-L, FX3U-ENET-P502, FX5-CCLGN-MS, IU1-1M20-D, LE7-40GU-L, GOT2000 Series GT21 Model, GS Series, GOT1000 Series GT14 Model, GT25-J71GN13-T2, FR-A800-E Series, FR-F800-E Series, FR-A8NCG, FR-E800-EPA Series, FR-E800-EPB Series, Conveyor Tracking Application, MR-JE-C, MR-J4-TM Problem Types: CWE-342 Description: Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remote
ucts are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-245-01
CVE ID: CVE-2020-16227 State: PUBLISHED Published: 2020-08-06T23:13:22 Last Updated: 2024-08-04T13:37:54.091Z Vendors: n/a Products: Delta Electronics TPEditor Problem Types: CWE-20 Description: Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04 - https://www.zerodayinitiative.com/advi
Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04 - https://www.zerodayinitiative.com/advisories/ZDI-20-965/
CVE ID: CVE-2020-16228 State: PUBLISHED Published: 2020-09-11T12:58:13 Last Updated: 2024-08-04T13:37:54.179Z Vendors: Philips Products: Patient Information Center iX (PICiX), PerformanceBridge Focal Point, IntelliVue patient monitors, IntelliVue X3 Problem Types: CWE-299 Description: In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a compromised certificate. Additional Analyst Notes: - CVE Program Container: Reference
icate, which may cause it to use a compromised certificate. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 - https://www.philips.com/productsecurity
CVE ID: CVE-2020-16229 State: PUBLISHED Published: 2020-08-06T18:24:10 Last Updated: 2024-08-04T13:37:54.174Z Vendors: n/a Products: Advantech WebAccess HMI Designer Problem Types: CWE-843 Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition, which may allow remote code execution, disclosure/modification of information, or cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02 - https://www.zerodayinitiative.com/advisories/ZDI-20-954/
CVE ID: CVE-2020-16230 State: PUBLISHED Published: 2020-09-18T18:04:16 Last Updated: 2024-08-04T13:37:54.179Z Vendors: n/a Products: HMS Networks Ewon Flexy and Cosy Problem Types: PERMISSIVE CROSS-DOMAIN POLICY WITH UNTRUSTED DOMAINS Description: All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.
idential information through sniffing. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-254-03
CVE ID: CVE-2020-16231 State: PUBLISHED Published: 2022-05-19T17:21:37.000Z Last Updated: 2025-04-16T17:54:00.512Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Bachmann Electronic, GmbH Products: M1 Hardware Controller MX207, M1 Hardware Controller MX213, M1 Hardware Controller MX220, M1 Hardware Controller MC206, M1 Hardware Controller MC212, M1 Hardware Controller MC220, M1 Hardware Controller MH230, M1 Hardware Controller MC205, M1 Hardware Controller MC210, M1 Hardware Controller MH212, M1 Hardware Controller ME203, M1 Hardware Controller CS200, M1 Hardware Controller MP213, M1 Hardware Controller MP226, M1 Hardware Controller MPC240, M1 Hardware Contro
ler CS200, M1 Hardware Controller MP213, M1 Hardware Controller MP226, M1 Hardware Controller MPC240, M1 Hardware Controller MPC265, M1 Hardware Controller MPC270, M1 Hardware Controller MPC293, M1 Hardware Controller MPE270, M1 Hardware Controller CPC210 Problem Types: CWE-916 Description: The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CP
-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CPC210 hardware controllers. Security Level 0 is set at default from the manufacturer, which could allow an unauthenticated remote attacker to gain access to the password hashes. Security Level 4 is susceptible if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password to conduct further attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-026-02
CVE ID: CVE-2020-16232 State: PUBLISHED Published: 2022-03-18T18:00:29.000Z Last Updated: 2025-04-16T16:41:56.260Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Yokogawa Products: WideField3 Problem Types: CWE-120 Description: In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-273-02 - https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/
CVE ID: CVE-2020-16233 State: PUBLISHED Published: 2020-09-16T19:51:20 Last Updated: 2024-08-04T13:37:53.590Z Vendors: n/a Products: CodeMeter Problem Types: CWE-404 Description: An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01
CVE ID: CVE-2020-16234 State: PUBLISHED Published: 2020-09-30T20:44:31 Last Updated: 2024-08-04T13:37:53.800Z Vendors: FATEK Automation Products: PLC WinProladder Problem Types: CWE-121 Description: In PLC WinProladder Version 3.28 and prior, a stack-based buffer overflow vulnerability can be exploited when a valid user opens a specially crafted file, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-254-02
CVE ID: CVE-2020-16235 State: PUBLISHED Published: 2022-05-19T17:23:12.000Z Last Updated: 2025-04-16T16:19:26.405Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Emerson Products: Open Enterprise Problem Types: CWE-326 Description: Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-238-02
CVE ID: CVE-2020-16236 State: PUBLISHED Published: 2021-01-25T18:46:40.532651Z Last Updated: 2024-09-16T22:15:45.566Z Vendors: Panasonic Products: FPWIN Pro Problem Types: CWE-125 Description: FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-005-02
CVE ID: CVE-2020-16237 State: PUBLISHED Published: 2020-08-21T12:11:41 Last Updated: 2025-06-04T21:32:44.371Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Philips Products: SureSigns VS4 Problem Types: CWE-20 Description: Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01 - https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive
CVE ID: CVE-2020-16238 State: PUBLISHED Published: 2022-04-14T20:05:53.000Z Last Updated: 2025-04-16T17:55:42.177Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: B. Braun Melsungen AG Products: SpaceCom, Battery pack with Wi-Fi, Data module compactplus Problem Types: CWE-269 Description: A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
te privileges to the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02 - https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
CVE ID: CVE-2020-16239 State: PUBLISHED Published: 2020-08-21T12:18:29 Last Updated: 2025-06-04T21:37:16.919Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Philips Products: SureSigns VS4 Problem Types: CWE-287 Description: When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the claim is correct. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01 - https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive
CVE ID: CVE-2020-16240 State: PUBLISHED Published: 2020-09-23T13:06:07 Last Updated: 2024-08-04T13:37:54.176Z Vendors: n/a Products: GE Digital APM Classic Problem Types: CWE-639 Description: GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be downloaded in JavaScript object notation (JSON) format by users who should not have access to such functionality. An attacker can download sensitive data related to user accounts without having the proper privileges. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-266-01
CVE ID: CVE-2020-16241 State: PUBLISHED Published: 2020-08-21T12:15:31 Last Updated: 2025-06-04T21:34:45.706Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: Philips Products: SureSigns VS4 Problem Types: CWE-284 Description: Philips SureSigns VS4, A.07.107 and prior does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01 - https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive
CVE ID: CVE-2020-16242 State: PUBLISHED Published: 2020-09-25T17:37:26.885164Z Last Updated: 2024-09-17T00:40:34.187Z Vendors: General Electric Products: Reason S20 Ethernet Switch Problem Types: CWE-79 Description: The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02
CVE ID: CVE-2020-16243 State: PUBLISHED Published: 2021-02-23T16:18:20 Last Updated: 2024-08-04T13:37:54.201Z Vendors: n/a Products: LeviStudioU Problem Types: CWE-121 Description: Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under the privileges of the application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-238-03
CVE ID: CVE-2020-16244 State: PUBLISHED Published: 2020-09-23T13:03:05 Last Updated: 2024-08-04T13:37:53.990Z Vendors: n/a Products: GE Digital APM Classic Problem Types: CWE-759 Description: GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data and then retrieve the actual passwords. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-266-01
CVE ID: CVE-2020-16245 State: PUBLISHED Published: 2020-08-25T18:03:49 Last Updated: 2024-08-04T13:37:54.195Z Vendors: n/a Products: Advantech iView Problem Types: CWE-22 Description: Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-238-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-1085/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1089/ - https://www.zerodayinitiative.com/advisories/
ZDI-20-1085/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1089/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1092/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1086/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1091/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1087/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1088/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1090/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1084/
CVE ID: CVE-2020-16246 State: PUBLISHED Published: 2020-10-20T15:00:40.583062Z Last Updated: 2024-09-17T00:47:00.232Z Vendors: General Electric Products: Reason S20 Ethernet Switch Problem Types: CWE-79 Description: The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site and executed by the victim client. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02
CVE ID: CVE-2020-16247 State: PUBLISHED Published: 2020-09-18T17:55:24 Last Updated: 2025-06-04T21:24:46.327Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Philips Products: Clinical Collaboration Platform Problem Types: CWE-16 Description: Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-261-01 - https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive
CVE ID: CVE-2020-16248 State: PUBLISHED Published: 2020-08-09T16:16:27 Last Updated: 2024-08-04T13:37:54.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prometheus/blackbox_exporter/issues/669 - https://prometheus.io/docs/operating/security/#exporters - https://www.openwall.com/lists/oss-security/2020/08/08/3 - https://www.openwall.com/lists/oss-security/2020/08/08/12 - https://seclists.org/o
com/lists/oss-security/2020/08/08/3 - https://www.openwall.com/lists/oss-security/2020/08/08/12 - https://seclists.org/oss-sec/2020/q3/94
CVE ID: CVE-2020-16250 State: PUBLISHED Published: 2020-08-26T14:17:44 Last Updated: 2024-08-04T13:37:54.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151 - http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html
CVE ID: CVE-2020-16251 State: PUBLISHED Published: 2020-08-26T14:19:55 Last Updated: 2024-08-04T13:37:54.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151 - http://packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.html
CVE ID: CVE-2020-16252 State: PUBLISHED Published: 2020-08-05T13:40:16 Last Updated: 2024-08-04T13:37:54.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ankane/field_test - https://github.com/ankane/field_test/issues/28