Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7004 State: PUBLISHED Published: 2020-04-03T17:44:24 Last Updated: 2024-08-04T09:18:02.819Z Vendors: VISAM Products: VBASE Editor, VBASE Web-Remote Module Problem Types: CWE-276 Description: VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure permissions on the VBASE directory resulting in elevation of privileges or malicious effects on the system the next time a privileged user runs the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-084-01
CVE ID: CVE-2020-7005 State: PUBLISHED Published: 2020-03-24T19:55:33 Last Updated: 2024-08-04T09:18:02.541Z Vendors: n/a Products: Honeywell WIN-PAK 4.7.2, Web and prior versions Problem Types: CWE-352 Description: In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-056-05
CVE ID: CVE-2020-7006 State: PUBLISHED Published: 2020-03-19T19:18:03 Last Updated: 2024-08-04T09:18:02.468Z Vendors: n/a Products: Systech Corporation NDS-5000 Terminal Server Problem Types: CWE-79 Description: Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerability could allow information disclosure, limit system availability, and may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-079-01
CVE ID: CVE-2020-7007 State: PUBLISHED Published: 2020-03-24T20:12:37 Last Updated: 2024-08-04T09:18:03.127Z Vendors: n/a Products: Moxa EDS-G516E Series firmware, Version 5.2 or lower Problem Types: CWE-121 Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE ID: CVE-2020-7008 State: PUBLISHED Published: 2020-04-03T17:44:19 Last Updated: 2024-08-04T09:18:03.036Z Vendors: VISAM Products: VBASE Editor, VBASE Web-Remote Module Problem Types: CWE-23 Description: VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an attacker to read arbitrary files from local resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-084-01
CVE ID: CVE-2020-7009 State: PUBLISHED Published: 2020-03-31T19:05:13 Last Updated: 2024-08-04T09:18:03.074Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-266 Description: Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920 - https://security.netapp.co
curity/ - https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920 - https://security.netapp.com/advisory/ntap-20200403-0004/
CVE ID: CVE-2020-7010 State: PUBLISHED Published: 2020-06-03T17:55:42 Last Updated: 2024-11-18T17:29:12.007Z Vendors: Elastic Products: Elastic Cloud on Kubernetes Problem Types: CWE-335 Description: Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2020-7011 State: PUBLISHED Published: 2020-06-03T17:55:43 Last Updated: 2024-08-04T09:18:02.528Z Vendors: Elastic Products: Elastic App Search Problem Types: CWE-84 Description: Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victimï¿½s web browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2020-7012 State: PUBLISHED Published: 2020-06-03T17:55:43 Last Updated: 2024-08-04T09:18:03.021Z Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2020-7013 State: PUBLISHED Published: 2020-06-03T17:55:44 Last Updated: 2024-08-04T09:18:02.567Z Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2020-7014 State: PUBLISHED Published: 2020-06-03T17:55:44 Last Updated: 2024-08-04T09:18:02.572Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-266 Description: The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/secu
vated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://security.netapp.com/advisory/ntap-20200619-0003/
CVE ID: CVE-2020-7015 State: PUBLISHED Published: 2020-06-03T17:55:44 Last Updated: 2024-08-04T09:18:02.608Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2020-7016 State: PUBLISHED Published: 2020-07-27T18:00:15 Last Updated: 2024-08-04T09:18:03.007Z Vendors: Elastic Products: Kibana Problem Types: CWE-185 Description: Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786 - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-7017 State: PUBLISHED Published: 2020-07-27T18:00:15 Last Updated: 2024-08-04T09:18:02.514Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786 - https://www.oracle.com//
ecurity/ - https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786 - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-7018 State: PUBLISHED Published: 2020-08-18T16:40:14 Last Updated: 2024-08-04T09:18:02.921Z Vendors: Elastic Products: Elastic Enterprise Search Problem Types: CWE-266 Description: Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ï¿½developerï¿½ role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457
CVE ID: CVE-2020-7019 State: PUBLISHED Published: 2020-08-18T16:40:14 Last Updated: 2024-08-04T09:18:02.598Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-270 Description: In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456 - https
gram Container: References: - https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456 - https://security.netapp.com/advisory/ntap-20200827-0001/
CVE ID: CVE-2020-7020 State: PUBLISHED Published: 2020-10-22T16:30:15 Last Updated: 2024-08-04T09:18:02.985Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-270 Description: Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices. Additional Analyst Notes: - CVE Program Container: References: - https://stag
nsight into potentially sensitive indices. Additional Analyst Notes: - CVE Program Container: References: - https://staging-website.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033 - https://security.netapp.com/advisory/ntap-20201123-0001/
CVE ID: CVE-2020-7021 State: PUBLISHED Published: 2021-02-10T18:55:15 Last Updated: 2024-08-04T09:18:02.537Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-532 Description: Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915 - https://security.netapp.com/a
s: - https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915 - https://security.netapp.com/advisory/ntap-20210319-0003/
CVE ID: CVE-2020-7029 State: PUBLISHED Published: 2020-08-11T23:05:18.034092Z Last Updated: 2024-09-16T22:03:15.362Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: Avaya Products: Avaya Aura Communication Manager, Avaya Aura Messaging Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x p
tions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101070201
CVE ID: CVE-2020-7030 State: PUBLISHED Published: 2020-06-03T23:45:14.497440Z Last Updated: 2024-09-16T22:19:49.392Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Avaya Products: IP Office Problem Types: CWE-522 Description: A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101067493 - http://packetstormsecurity.com
Program Container: References: - https://downloads.avaya.com/css/P8/documents/101067493 - http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html - http://seclists.org/fulldisclosure/2020/Jun/12
CVE ID: CVE-2020-7031 State: REJECTED Published: 2021-06-21T12:39:03 Last Updated: 2021-06-21T12:39:03 Description: No description available.
CVE ID: CVE-2020-7032 State: PUBLISHED Published: 2020-11-13T00:20:14.764716Z Last Updated: 2024-09-17T01:45:48.139Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) Vendors: Avaya Products: WebLM, System Manager Problem Types: CWE-611 Description: An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101072249 - http
onal Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101072249 - http://seclists.org/fulldisclosure/2020/Nov/31 - http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html - https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/
CVE ID: CVE-2020-7033 State: PUBLISHED Published: 2020-11-12T23:55:11.670442Z Last Updated: 2024-09-17T03:59:45.436Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Avaya Products: Avaya Equinox Conferencing Problem Types: CWE-79 Description: A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101072147
CVE ID: CVE-2020-7034 State: PUBLISHED Published: 2021-04-23T20:15:15.818773Z Last Updated: 2024-09-16T23:06:35.730Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Avaya Products: Session Border Controller for Enterprise Problem Types: CWE-78 Description: A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for Enterprise include 7.x, 8.0 through 8.1.1.x Additional Analyst Notes: - CVE Program Container: References: - https://down
nterprise include 7.x, 8.0 through 8.1.1.x Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101075451
CVE ID: CVE-2020-7035 State: PUBLISHED Published: 2021-04-23T21:00:20.316357Z Last Updated: 2024-09-16T17:14:17.189Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Avaya Products: Aura Orchestration Designer Problem Types: CWE-611 Description: An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/doc
ns before 7.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101075450
CVE ID: CVE-2020-7036 State: PUBLISHED Published: 2021-04-23T21:00:20.925071Z Last Updated: 2024-09-17T01:45:37.197Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Avaya Products: Callback Assist Problem Types: CWE-611 Description: An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101075450
CVE ID: CVE-2020-7037 State: PUBLISHED Published: 2021-04-28T21:30:20.662262Z Last Updated: 2024-09-16T22:36:50.329Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Avaya Products: Avaya Meetings Server Problem Types: CWE-611 Description: An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server. Additi
nferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101075574
CVE ID: CVE-2020-7038 State: PUBLISHED Published: 2021-04-28T21:30:21.281149Z Last Updated: 2024-09-16T21:04:25.962Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Avaya Products: Avaya Meetings Management Problem Types: CWE-284 Description: A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3.x versions before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server. Additional Analyst Notes: - CVE Pro
ons before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101075574
CVE ID: CVE-2020-7039 State: PUBLISHED Published: 2020-01-16T22:51:40 Last Updated: 2024-08-04T09:18:02.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/slirp/libslirp/commit/ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9 - https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80 - https://g
03e58fb4a5d9 - https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80 - https://gitlab.freedesktop.org/slirp/libslirp/commit/2655fffed7a9e765bcb4701dd876e9dab975f289 - http://www.openwall.com/lists/oss-security/2020/01/16/2 - https://lists.debian.org/debian-lts-announce/2020/01/msg00022.html - https://lists.debian.org/debian-lts-announce/2020/01/msg00036.html - https://seclists.org/bugtraq/2020/Feb/0 - https://www.debian.org/security/2020/dsa-4616 - https://access.redhat.com/errata/RHSA-2020:0348 - https://usn.ubuntu.com/4283-1/ - https://access.redhat.com/errata/RHSA-2020:0775 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html
s://access.redhat.com/errata/RHSA-2020:0775 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html - https://security.gentoo.org/glsa/202005-02 - https://lists.debian.org/debian-lts-announce/2021/02/msg00012.html
CVE ID: CVE-2020-7040 State: PUBLISHED Published: 2020-01-21T20:03:11 Last Updated: 2024-08-04T09:18:02.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.) Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-7040 - http://www.openwall.com/lists/oss-security/2020/01/20/3 - https://seclists.org/oss-sec/2020/q1/20 - http:/
E-2020-7040 - http://www.openwall.com/lists/oss-security/2020/01/20/3 - https://seclists.org/oss-sec/2020/q1/20 - http://www.openwall.com/lists/oss-security/2020/01/21/2 - http://www.openwall.com/lists/oss-security/2020/01/22/2 - http://www.openwall.com/lists/oss-security/2020/01/22/3 - http://www.openwall.com/lists/oss-security/2020/01/23/1 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.html - https://lists.debian.org/debian-lts-announce/2020/02/msg00003.html - https://usn.ubuntu.com/4508-1/
CVE ID: CVE-2020-7041 State: PUBLISHED Published: 2020-02-27T17:29:38 Last Updated: 2024-08-04T09:18:02.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adrienverge/openfortivpn/issues/536 - https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html - http://lists.opens