Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28394 State: PUBLISHED Published: 2021-02-09T15:38:20 Last Updated: 2024-08-04T16:33:59.078Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of RAS files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12283) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.
e current process. (ZDI-CAN-12283) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-236/
CVE ID: CVE-2020-28395 State: PUBLISHED Published: 2021-01-12T00:00:00 Last Updated: 2024-08-04T16:33:59.028Z Vendors: Siemens Products: SCALANCE X-200RNA switch family, SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) Problem Types: CWE-321 Description: A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic. Additional Analyst Notes: - CVE Program Container: Refere
-the-middle situation and decrypt previously captured traffic. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02
CVE ID: CVE-2020-28396 State: PUBLISHED Published: 2020-12-14T21:05:19 Last Updated: 2024-08-04T16:33:59.131Z Vendors: Siemens Products: SICAM A8000 CP-8000, SICAM A8000 CP-8021, SICAM A8000 CP-8022 Problem Types: CWE-693 Description: A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions < V16). A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position could decrypt the communication and compromise confidentiality and integrity of the transmitted information. Additional Analyst Notes: - CVE Program Contain
compromise confidentiality and integrity of the transmitted information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-415783.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-062/
CVE ID: CVE-2020-28397 State: PUBLISHED Published: 2021-08-10T10:35:23 Last Updated: 2024-08-04T16:33:59.119Z Vendors: Siemens Products: SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7 PLCSIM Advanced, SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, TIM 1531 IRC (incl. SIPLUS NET variants) Problem Types: CWE-863 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.
ly (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes a
bout access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-865327.pdf
CVE ID: CVE-2020-28398 State: PUBLISHED Published: 2024-12-10T13:53:19.090Z Last Updated: 2024-12-10T15:28:51.944Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-352 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM RO
< V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The CLI feature in the web interface of affected devices is vulnerable to cross-site request forgery (CSRF). This could allow an attacker to read or modify the device configuration by tricking an authenticated legiti
gery (CSRF). This could allow an attacker to read or modify the device configuration by tricking an authenticated legitimate user into accessing a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-384652.html
CVE ID: CVE-2020-28400 State: PUBLISHED Published: 2021-07-13T11:02:49 Last Updated: 2024-12-10T13:53:22.763Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, RUGGEDCOM RM1224 LTE(4G) EU, RUGGEDCOM RM1224 LTE(4G) NAM, SCALANCE M804PB, SCALANCE M812-1 ADSL-Router, SCALANCE M816-1 ADSL-Router, SCALANCE M826-2 SHDSL-Router, SCALANCE M874-2, SCALANCE M874-3, SCALANCE M874-3 3G-Router (CN), SCALANCE M876-3, SCALANCE M876-3 (ROK), SCALANCE M876-4, SCALANCE
74-2, SCALANCE M874-3, SCALANCE M874-3 3G-Router (CN), SCALANCE M876-3, SCALANCE M876-3 (ROK), SCALANCE M876-4, SCALANCE M876-4 (EU), SCALANCE M876-4 (NAM), SCALANCE MUM853-1 (A1), SCALANCE MUM853-1 (B1), SCALANCE MUM853-1 (EU), SCALANCE MUM856-1 (A1), SCALANCE MUM856-1 (B1), SCALANCE MUM856-1 (CN), SCALANCE MUM856-1 (EU), SCALANCE MUM856-1 (RoW), SCALANCE S615 EEC LAN-Router, SCALANCE S615 LAN-Router, SCALANCE W1748-1 M12, SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, SCALANCE W1788-2IA M12, SCALANCE W721-1 RJ45, SCALANCE W722-1 RJ45, SCALANCE W734-1 RJ45, SCALANCE W734-1 RJ45 (USA), SCALANCE W738-1 M12, SCALANCE W748-1 M12, SCALANCE W748-1 RJ45, SCALANCE W761-1 RJ45
1 RJ45, SCALANCE W734-1 RJ45 (USA), SCALANCE W738-1 M12, SCALANCE W748-1 M12, SCALANCE W748-1 RJ45, SCALANCE W761-1 RJ45, SCALANCE W774-1 M12 EEC, SCALANCE W774-1 RJ45, SCALANCE W774-1 RJ45 (USA), SCALANCE W778-1 M12, SCALANCE W778-1 M12 EEC, SCALANCE W778-1 M12 EEC (USA), SCALANCE W786-1 RJ45, SCALANCE W786-2 RJ45, SCALANCE W786-2 SFP, SCALANCE W786-2IA RJ45, SCALANCE W788-1 M12, SCALANCE W788-1 RJ45, SCALANCE W788-2 M12, SCALANCE W788-2 M12 EEC, SCALANCE W788-2 RJ45, SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X2
IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X204-2TS, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE X206-1, SCALANCE X206-1LD, SCALANCE X208, SCALANCE X208PRO, SCALANCE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (24V, co
-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XB205-3 (SC, PN), SCALANCE XB205-3 (ST, E/IP), SCALANCE XB205-3 (ST, PN), SCALANCE XB205-3LD (SC, E/IP), SCALANCE XB205-3LD (SC, PN),
N), SCALANCE XB205-3 (ST, E/IP), SCALANCE XB205-3 (ST, PN), SCALANCE XB205-3LD (SC, E/IP), SCALANCE XB205-3LD (SC, PN), SCALANCE XB208 (E/IP), SCALANCE XB208 (PN), SCALANCE XB213-3 (SC, E/IP), SCALANCE XB213-3 (SC, PN), SCALANCE XB213-3 (ST, E/IP), SCALANCE XB213-3 (ST, PN), SCALANCE XB213-3LD (SC, E/IP), SCALANCE XB213-3LD (SC, PN), SCALANCE XB216 (E/IP), SCALANCE XB216 (PN), SCALANCE XC206-2 (SC), SCALANCE XC206-2 (ST/BFOC), SCALANCE XC206-2G PoE, SCALANCE XC206-2G PoE (54 V DC), SCALANCE XC206-2G PoE EEC (54 V DC), SCALANCE XC206-2SFP, SCALANCE XC206-2SFP EEC, SCALANCE XC206-2SFP G, SCALANCE XC206-2SFP G (EIP DEF.), SCALANCE XC206-2SFP G EEC, SCALANCE XC208, SCALANCE XC208EEC, SCALANCE XC
C206-2SFP G, SCALANCE XC206-2SFP G (EIP DEF.), SCALANCE XC206-2SFP G EEC, SCALANCE XC208, SCALANCE XC208EEC, SCALANCE XC208G, SCALANCE XC208G (EIP def.), SCALANCE XC208G EEC, SCALANCE XC208G PoE, SCALANCE XC208G PoE (54 V DC), SCALANCE XC216, SCALANCE XC216-3G PoE, SCALANCE XC216-3G PoE (54 V DC), SCALANCE XC216-4C, SCALANCE XC216-4C G, SCALANCE XC216-4C G (EIP Def.), SCALANCE XC216-4C G EEC, SCALANCE XC216EEC, SCALANCE XC224, SCALANCE XC224-4C G, SCALANCE XC224-4C G (EIP Def.), SCALANCE XC224-4C G EEC, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SCALANCE XF204 DNA, SCALANCE XF204-2, SCALANCE XF204-2BA, SCALANCE XF204-2BA DNA, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCAL
XF204 DNA, SCALANCE XF204-2, SCALANCE XF204-2BA, SCALANCE XF204-2BA DNA, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF208, SCALANCE XM408-4C, SCALANCE XM408-4C (L3 int.), SCALANCE XM408-8C, SCALANCE XM408-8C (L3 int.), SCALANCE XM416-4C, SCALANCE XM416-4C (L3 int.), SCALANCE XP208, SCALANCE XP208 (Ethernet/IP), SCALANCE XP208EEC, SCALANCE XP208PoE EEC, SCALANCE XP216, SCALANCE XP216 (Ethernet/IP), SCALANCE XP216EEC, SCALANCE XP216POE EEC, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC
ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear
324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SCALANCE XR324WG (24 x FE, AC 230V), SCALANCE XR324WG (24 X FE, DC 24V), SCALANCE XR326-2C PoE WG, SCALANCE XR326-2C PoE WG (without UL), SCALANCE XR328-4C WG (24XFE, 4XGE, 24V), SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V), SCALANCE XR328-4C WG (24xFE,4xGE,AC230V), SCALANCE XR328-4C WG (28xGE, AC 230V), SCALANCE XR328-4C WG (28xGE, DC 24V), SCALANCE XR524-8C, 1x230V, SCALANCE XR524-8C, 1x230V (L3 int.), SCALANCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C, 2x230V (L3 int.), SCA
NCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C, 2x230V (L3 int.), SCALANCE XR526-8C, 1x230V, SCALANCE XR526-8C, 1x230V (L3 int.), SCALANCE XR526-8C, 24V, SCALANCE XR526-8C, 24V (L3 int.), SCALANCE XR526-8C, 2x230V, SCALANCE XR526-8C, 2x230V (L3 int.), SCALANCE XR528-6M, SCALANCE XR528-6M (2HR2, L3 int.), SCALANCE XR528-6M (2HR2), SCALANCE XR528-6M (L3 int.), SCALANCE XR552-12M, SCALANCE XR552-12M (2HR2, L3 int.), SCALANCE XR552-12M (2HR2), SIMATIC CFU DIQ, SIMATIC CFU PA, SIMATIC CM 1542-1, SIMATIC CP 1604, SIMATIC CP 1616, SIMATIC CP 1626, SIMATIC IE/PB-LINK, SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560
SIMATIC CP 1626, SIMATIC IE/PB-LINK, SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560 U, SIMATIC MV560 X, SIMATIC NET DK-16xx PN IO, SIMATIC Power Line Booster PLB, Base Module, SIMATIC PROFINET Driver, SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants), SIMOCODE pro V PROFINET (incl. SIPLUS variants), SIPLUS NET SCALANCE X308-2, SIPLUS NET SCALANCE XC206-2, SIPLUS NET SCALANCE XC206-2SFP, SIPLUS NET SCALANCE XC208, SIPLUS NET SCALANCE XC216-4C, SOFTNET-IE PNIO Problem Types: CWE-770 Description: Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service
iption: Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered if a large amount of DCP reset packets are sent to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-599968.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-194-03 - https://cert-portal.siemens.com/productcert/html/ssa-599968.html
CVE ID: CVE-2020-28401 State: PUBLISHED Published: 2021-01-29T06:07:04.000Z Last Updated: 2025-05-30T16:01:24.859Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access WIP details about jobs he should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28401 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28401
CVE ID: CVE-2020-28402 State: PUBLISHED Published: 2021-01-29T06:07:40.000Z Last Updated: 2025-05-30T16:01:32.921Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access Launcher Configuration Panel. Additional Analyst Notes: - CVE Program Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28402 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28402
CVE ID: CVE-2020-28403 State: PUBLISHED Published: 2021-01-29T06:08:44.000Z Last Updated: 2025-05-30T16:01:26.454Z Severity: HIGH (CVSS 8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE
Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28403 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28403
CVE ID: CVE-2020-28404 State: PUBLISHED Published: 2021-01-29T06:09:38.000Z Last Updated: 2025-05-30T16:01:36.521Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access the Billing page without the appropriate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28404 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28404
CVE ID: CVE-2020-28405 State: PUBLISHED Published: 2021-01-29T06:10:27.000Z Last Updated: 2025-05-30T16:01:29.330Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change the privileges of any user of the application. This can be used to grant himself the administrative role or remove all administrative accounts of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-adviso
rogram Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28405 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28405
CVE ID: CVE-2020-28406 State: PUBLISHED Published: 2021-01-29T06:11:11.000Z Last Updated: 2025-05-30T16:01:33.482Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access details about jobs he should not have access to via the Audit Trail Feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.starpracticemanagement.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28406 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28406
CVE ID: CVE-2020-28407 State: PUBLISHED Published: 2023-11-03T00:00:00 Last Updated: 2024-09-12T19:34:06.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stefanberger/swtpm/releases/tag/v0.4.2 - https://bugzilla.suse.com/show_bug.cgi?id=1198395 - https://github.com/stefanberger/swtpm/releases/tag/v0.5.1
CVE ID: CVE-2020-28408 State: PUBLISHED Published: 2020-11-10T20:20:06 Last Updated: 2024-08-04T16:33:59.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://mattschmidt.net/2020/11/10/dundas-persistent-xss/
CVE ID: CVE-2020-28409 State: PUBLISHED Published: 2020-11-10T20:19:55 Last Updated: 2024-08-04T16:33:59.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. occur. Additional Analyst Notes: - CVE Program Container: References: - https://mattschmidt.net/2020/11/10/dundas-persistent-xss/
CVE ID: CVE-2020-28413 State: PUBLISHED Published: 2020-12-30T21:28:21 Last Updated: 2024-08-04T16:33:59.083Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP. Additional Analyst Notes: - CVE Program Container: References: - https://ethicalhcop.medium.com/cve-2020-28413-blind-sql-injection-en-mantis-bug-tracker-2-24-3-api-soap-54238f8e046d - http://packetstormsecurity.com/files/160750/Mantis-Bug-Tracker-2.24.3-SQL-Injection.html
CVE ID: CVE-2020-28414 State: PUBLISHED Published: 2020-11-12T19:39:14 Last Updated: 2024-08-04T16:33:59.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28415). Additional Analyst Notes: - CVE Program Container: References: - https://compassplus.com/solutions/tranzware/ - https://github.com/jet-pentest/CVE-2020-28414/blob/main/README.md
CVE ID: CVE-2020-28415 State: PUBLISHED Published: 2020-11-12T19:32:08 Last Updated: 2024-08-04T16:33:59.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414). Additional Analyst Notes: - CVE Program Container: References: - https://compassplus.com/solutions/tranzware/ - https://github.com/jet-pentest/CVE-2020-28415/blob/main/README.md
CVE ID: CVE-2020-28416 State: PUBLISHED Published: 2021-11-03T19:02:37 Last Updated: 2024-08-04T16:33:59.102Z Vendors: n/a Products: HP OfficeJet Printer; HP PageWide Printer Problem Types: unauthorized local code execution Description: HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c07051163
CVE ID: CVE-2020-28419 State: PUBLISHED Published: 2021-11-09T18:01:41 Last Updated: 2024-08-04T16:33:59.136Z Vendors: n/a Products: HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide Printer; HP PageWide Pro Printer; HP inkjet Printer; HP OfficeJet Printer Problem Types: Arbitrary code execution Description: During installation with certain driver software or application packages an arbitrary code execution could occur. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c07058567