Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13617 State: PUBLISHED Published: 2020-08-26T18:02:00 Last Updated: 2024-08-04T12:25:16.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed login attempts. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0007
CVE ID: CVE-2020-13619 State: PUBLISHED Published: 2020-07-01T16:54:07 Last Updated: 2024-08-04T12:25:16.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/locutus - https://locutus.io/php/ - https://reallinkers.github.io/CVE-2020-13619/
CVE ID: CVE-2020-13620 State: PUBLISHED Published: 2020-11-24T17:12:01 Last Updated: 2024-08-04T12:25:16.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration. Additional Analyst Notes: - CVE Program Container: References: - https://members.backbox.org/fastgate-gpon-cross-site-request-forgery/ - https://lucadidomenico.medium.com/fastgate-gpon-cross-site-request-forgery-cve-2020-13620-e279f3fbaee4
CVE ID: CVE-2020-13622 State: PUBLISHED Published: 2020-05-26T23:15:14 Last Updated: 2024-08-04T12:25:16.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3787 - https://github.com/jerryscript-project/jerryscript/pull/3797
CVE ID: CVE-2020-13623 State: PUBLISHED Published: 2020-05-26T23:15:04 Last Updated: 2024-08-04T12:25:16.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3785
CVE ID: CVE-2020-13625 State: PUBLISHED Published: 2020-06-08T16:03:22 Last Updated: 2024-08-04T12:25:16.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6 - https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj - https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html - https://lists.fedo
advisories/GHSA-f7hx-fqxw-rvvj - https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html - https://usn.ubuntu.com/4505-1/
CVE ID: CVE-2020-13626 State: PUBLISHED Published: 2020-10-09T05:02:52 Last Updated: 2024-08-04T12:25:16.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked. Additional Analyst Notes: - CVE Program Container: References: - https://support.oneplus.com/app/answers/detail/a_id/301/~/how-to-use-app-locker - https://medium.com/%40bugsbunnyy1107/the-tell-tale-of-cve-in-oneplus-phones-91e97342a8b5
CVE ID: CVE-2020-13627 State: PUBLISHED Published: 2020-05-27T15:12:35 Last Updated: 2024-08-04T12:25:16.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/l
n tactical-overview widget. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
CVE ID: CVE-2020-13628 State: PUBLISHED Published: 2020-05-27T15:12:39 Last Updated: 2024-08-04T12:25:16.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/la
tactical-overview widget. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
CVE ID: CVE-2020-13630 State: PUBLISHED Published: 2020-05-27T14:42:44 Last Updated: 2024-08-04T12:25:16.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ - https://usn.ubuntu.com/4394-1/ - https://www.oracle.com/security-alerts/cpujul2020.html - https://bugs.chromium.org/p/chromium/issues/detail?id=1080459 - https://sqlite.org/src/info/0d69f76f0865f962 - https://security.ne
gs.chromium.org/p/chromium/issues/detail?id=1080459 - https://sqlite.org/src/info/0d69f76f0865f962 - https://security.netapp.com/advisory/ntap-20200608-0002/ - https://security.gentoo.org/glsa/202007-26 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc - https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html - https://support.apple.com/kb/HT211843 - https://support.apple.com/kb/HT211850 - https://support.apple.com/kb/HT211844 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://support.apple.com/kb/HT211931 - https://support.apple.com/kb/HT211952 - http://seclists.org/fulldisclosure/2020/Nov/19 - http://seclists.org/fulldisclosure/2020/Nov/20 - h
le.com/kb/HT211952 - http://seclists.org/fulldisclosure/2020/Nov/19 - http://seclists.org/fulldisclosure/2020/Nov/20 - http://seclists.org/fulldisclosure/2020/Nov/22 - https://support.apple.com/kb/HT211935 - http://seclists.org/fulldisclosure/2020/Dec/32 - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-13631 State: PUBLISHED Published: 2020-05-27T14:42:28 Last Updated: 2024-08-04T12:25:16.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ - https://usn.ubuntu.com/4394-1/ - https://www.oracle.com/security-alerts/cpujul2020.html - https://bugs.chromium.org/p/chromium/issues/detail?id=1080459 - https://security.netapp.com/advisory/ntap-202006
.html - https://bugs.chromium.org/p/chromium/issues/detail?id=1080459 - https://security.netapp.com/advisory/ntap-20200608-0002/ - https://sqlite.org/src/info/eca0ba2cf4c0fdf7 - https://security.gentoo.org/glsa/202007-26 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc - https://support.apple.com/kb/HT211843 - https://support.apple.com/kb/HT211850 - https://support.apple.com/kb/HT211844 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://support.apple.com/kb/HT211931 - https://support.apple.com/kb/HT211952 - http://seclists.org/fulldisclosure/2020/Nov/19 - http://seclists.org/fulldisclosure/2020/Nov/20 - http://seclists.org/fulldisclosure/2020/Nov/22 - htt
sure/2020/Nov/19 - http://seclists.org/fulldisclosure/2020/Nov/20 - http://seclists.org/fulldisclosure/2020/Nov/22 - https://support.apple.com/kb/HT211935 - http://seclists.org/fulldisclosure/2020/Dec/32 - https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-13632 State: PUBLISHED Published: 2020-05-27T14:42:17 Last Updated: 2024-08-04T12:25:16.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/ - https://usn.ubuntu.com/4394-1/ - https://www.oracle.com/security-alerts/cpujul2020.html - https://bugs.chromium.org/p/chromium/issues/detail?id=1080459 - https://security.netapp.com/advisory/ntap-20200608-0002/ - https://
s.chromium.org/p/chromium/issues/detail?id=1080459 - https://security.netapp.com/advisory/ntap-20200608-0002/ - https://sqlite.org/src/info/a4dd148928ea65bd - https://security.gentoo.org/glsa/202007-26 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc - https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-13633 State: PUBLISHED Published: 2020-05-27T15:04:47 Last Updated: 2024-08-04T12:25:16.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fork before 5.8.3 allows XSS via navigation_title or title. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/forkcms/forkcms/pull/3093
CVE ID: CVE-2020-13634 State: PUBLISHED Published: 2020-05-29T16:05:59 Last Updated: 2024-08-04T12:25:16.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xF1002558 Additional Analyst Notes: - CVE Program Container: References: - http://www.youhua.com - https://github.com/y5s5k5/CVE-2020-13634
CVE ID: CVE-2020-13637 State: PUBLISHED Published: 2020-06-17T16:34:30 Last Updated: 2024-08-04T12:25:16.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context. Additional Analyst Notes: - CVE Program Container: References: - http://www.jvanlaak.de/stashcat.html - http://www
text. Additional Analyst Notes: - CVE Program Container: References: - http://www.jvanlaak.de/stashcat.html - http://www.jvanlaak.de/stashcat_CWE_312_200527.pdf
CVE ID: CVE-2020-13638 State: PUBLISHED Published: 2020-11-13T19:53:36 Last Updated: 2024-08-04T12:25:16.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7. Additional Analyst Notes: - CVE Program Container: References: - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
CVE ID: CVE-2020-13639 State: PUBLISHED Published: 2021-08-31T03:56:44 Last Updated: 2024-08-04T12:25:16.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime
or's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console. Additional Analyst Notes: - CVE Program Container: References: - https://www.outsystems.com/platform/ - https://labs.integrity.pt/advisories/CVE-2020-13639/
CVE ID: CVE-2020-13640 State: PUBLISHED Published: 2020-06-18T14:34:05 Last Updated: 2024-08-04T12:25:16.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.) Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wpdiscuz/#developers - https://wpdiscuz.com/community/news/security-vulnerability-issue-in-5-3-5-please-udate/ - https://plugins.trac.wordpress.org/changeset/2323200 - https://plugins.trac.wordpress.org
issue-in-5-3-5-please-udate/ - https://plugins.trac.wordpress.org/changeset/2323200 - https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/5.3.6 - http://www.openwall.com/lists/oss-security/2020/07/06/1
CVE ID: CVE-2020-13641 State: PUBLISHED Published: 2020-05-28T03:11:16 Last Updated: 2024-08-04T12:25:16.399Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/04/h
ctims browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-patched-in-real-time-find-and-replace-plugin/ - https://wordpress.org/plugins/real-time-find-and-replace/#developers
CVE ID: CVE-2020-13642 State: PUBLISHED Published: 2020-05-28T03:11:57 Last Updated: 2024-08-04T12:25:16.127Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/05/vulnerabilities-patched
nal Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/ - https://wordpress.org/plugins/siteorigin-panels/#developers
CVE ID: CVE-2020-13643 State: PUBLISHED Published: 2020-05-28T03:11:48 Last Updated: 2024-08-04T12:25:16.534Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/05/vulnerabilities-patched
CVE ID: CVE-2020-13644 State: PUBLISHED Published: 2020-05-28T03:11:33 Last Updated: 2024-08-04T12:25:16.466Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/ - http
rogram Container: References: - https://www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/ - https://wordpress.org/plugins/accordions/#developers
CVE ID: CVE-2020-13645 State: PUBLISHED Published: 2020-05-28T11:55:39 Last Updated: 2024-08-04T12:25:16.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. Additional Analyst Notes: - CVE Program Container:
1, accept a TLS certificate if the certificate is valid for any host. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135 - https://gitlab.gnome.org/GNOME/balsa/-/issues/34 - https://security.netapp.com/advisory/ntap-20200608-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWI
/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS/ - https://usn.ubuntu.com/4405-1/ - https://security.gentoo.org/glsa/202007-50
CVE ID: CVE-2020-13646 State: PUBLISHED Published: 2020-06-05T20:46:04 Last Updated: 2024-08-04T12:25:16.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020f8, 0x830020E0, 0x830020E4, or 0x8300210c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/y5s5k5/CVE-2020-13646
CVE ID: CVE-2020-13649 State: PUBLISHED Published: 2020-05-28T14:13:59 Last Updated: 2024-08-04T12:25:16.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3786 - https://github.com/jerryscript-project/jerryscript/issues/3788 - https://github.com/jerryscript-project/jerryscript/commit/69f8e78c2f8d562bd6d8002b5488f1662ac30d24
CVE ID: CVE-2020-13650 State: PUBLISHED Published: 2020-06-15T18:08:00 Last Updated: 2024-08-04T12:25:16.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery (SSRF) that allows use of the application as a proxy. Sent to an external server, a forged request discloses application credentials. For a request to an internal component, the request is blind, but through the error message it's possible to determine whether the request targeted a open service. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopf
e request targeted a open service. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/digdash-version-2018
CVE ID: CVE-2020-13651 State: PUBLISHED Published: 2020-06-15T18:07:55 Last Updated: 2024-08-04T12:25:16.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be used to generate the JNLP file used by a client to obtain the right Java application. By providing an attacker-controlled URL, the client will obtain a rogue JNLP file specifying the installation of malicious JAR archives and executed with full privileges on the client computer. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com
eges on the client computer. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/digdash-version-2018
CVE ID: CVE-2020-13652 State: PUBLISHED Published: 2020-06-15T18:07:50 Last Updated: 2024-08-04T12:25:16.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200528, 2019R2 before p20200430, and 2020R1 before p20200507. A cross-site scripting (XSS) vulnerability exists in the login menu. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/digdash-version-2018
CVE ID: CVE-2020-13653 State: PUBLISHED Published: 2020-07-02T15:15:44 Last Updated: 2024-08-04T12:25:16.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P11 - https://wiki.zim