Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
fix this issue. The identifier VDB-216473 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sah-comp/bienlein/commit/d7836a4f2b241e4745ede194f0f6fb47199cab6b - https://vuldb.com/?id.216473
CVE ID: CVE-2020-36623 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-15T12:55:49.525Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Pengu Problem Types: CWE-863 Description: A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475. Additional
commended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jtojnar/pengu/commit/aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91 - https://vuldb.com/?id.216475
CVE ID: CVE-2020-36624 State: PUBLISHED Published: 2022-12-22T00:00:00 Last Updated: 2024-08-04T17:30:08.410Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: ahorner Products: text-helpers Problem Types: CWE-1022 Description: A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2
remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216520 - https://github.com/ahorner/text-helpers/pull/19 - https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3 - https://github.com/ahorner/text-helpers/releases/tag/v1.1.0
CVE ID: CVE-2020-36625 State: PUBLISHED Published: 2022-12-22T00:00:00 Last Updated: 2024-08-04T17:30:08.328Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: destiny.gg Products: chat Problem Types: CWE-863 Description: A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerab
ed to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/destinygg/chat/pull/35 - https://github.com/destinygg/chat/commit/bebd256fc3063111fb4503ca25e005ebf6e73780 - https://vuldb.com/?id.216521
CVE ID: CVE-2020-36626 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-14T17:27:31.677Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Modern Tribe Products: Panel Builder Plugin Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is
s been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moderntribe/panel-builder/pull/173 - https://github.com/moderntribe/panel-builder/commit/4528d4f855dbbf24e9fc12a162fda84ce3bedc2f - https://vuldb.com/?id.216738
CVE ID: CVE-2020-36627 State: PUBLISHED Published: 2022-12-25T10:19:28.072Z Last Updated: 2024-08-04T17:30:08.535Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Macaron Products: i18n Problem Types: CWE-601 Description: A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 0.5.0 is able to address this issue. The name of the patch is 329b0c4844cc16a5a253c011b55180598e707735. It is recommended to upgrade the affected component. The identifier VDB-216745 wa
b0c4844cc16a5a253c011b55180598e707735. It is recommended to upgrade the affected component. The identifier VDB-216745 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216745 - https://github.com/go-macaron/i18n/commit/329b0c4844cc16a5a253c011b55180598e707735 - https://github.com/go-macaron/i18n/releases/tag/v0.5.0
CVE ID: CVE-2020-36628 State: PUBLISHED Published: 2022-12-25T10:19:53.152Z Last Updated: 2024-08-04T17:30:08.460Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Calsign Products: APDE Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB
this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216747 - https://github.com/Calsign/APDE/commit/c6d64cbe465348c1bfd211122d89e3117afadecf - https://github.com/Calsign/APDE/releases/tag/v0.5.2-pre2-alpha
CVE ID: CVE-2020-36629 State: PUBLISHED Published: 2022-12-25T10:20:00.919Z Last Updated: 2025-04-14T17:27:10.077Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SimbCo Products: httpster Problem Types: CWE-22 Description: A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748. Additiona
5d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216748 - https://github.com/SimbCo/httpster/pull/36 - https://github.com/SimbCo/httpster/commit/d3055b3e30b40b65d30c5a06d6e053dffa7f35d0
CVE ID: CVE-2020-36630 State: PUBLISHED Published: 2022-12-25T19:20:13.546Z Last Updated: 2024-08-04T17:30:08.684Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: FreePBX Products: cdr Problem Types: CWE-89 Description: A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerab
9d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216771. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216771 - https://vuldb.com/?ctiid.216771 - https://github.com/FreePBX/cdr/commit/f1a9eea2dfff30fb99d825bac194a676a82b9ec8 - https://github.com/FreePBX/cdr/releases/tag/release%2F14.0.5.21
CVE ID: CVE-2020-36631 State: PUBLISHED Published: 2022-12-25T19:24:40.218Z Last Updated: 2024-08-04T17:30:08.460Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: barronwaffles Products: dwc_network_server_emulator Problem Types: CWE-89 Description: A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to
ated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216772 - https://vuldb.com/?ctiid.216772 - https://github.com/barronwaffles/dwc_network_server_emulator/pull/538 - https://github.com/barronwaffles/dwc_network_server_emulator/commit/f70eb21394f75019886fbc2fb536de36161ba422
CVE ID: CVE-2020-36632 State: PUBLISHED Published: 2022-12-25T19:37:16.959Z Last Updated: 2024-08-04T17:30:08.479Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: hughsk Products: flat Problem Types: CWE-1321 Description: A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is r
version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216777 - https://vuldb.com/?ctiid.216777 - https://github.com/hughsk/flat/issues/105 - https://github.com/hughsk/flat/pull/106 - https://github.com/hughsk/flat/commit/20ef0ef55dfa028caddaedbcb33efbdb04d18e13 - https://github.com/hughsk/flat/releases/tag/5.0.1
CVE ID: CVE-2020-36633 State: PUBLISHED Published: 2022-12-27T12:11:35.448Z Last Updated: 2024-08-04T17:30:08.317Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: moodle-block_sitenews Problem Types: CWE-352 Description: A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected
this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216879 - https://vuldb.com/?ctiid.216879 - https://github.com/eberhardt/moodle-block_sitenews/pull/5 - https://github.com/eberhardt/moodle-block_sitenews/commit/cd18d8b1afe464ae6626832496f4e070bac4c58f - https://github.com/eberhardt/moodle-block_sitenews/releases/tag/v1.1
CVE ID: CVE-2020-36634 State: PUBLISHED Published: 2022-12-27T12:21:17.013Z Last Updated: 2024-11-19T19:47:14.378Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Indeed Engineering Products: util Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e
he attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e9544d9fac2a2218a6bfc9c63. It is recommended to upgrade the affected component. VDB-216882 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216882 - https://vuldb.com/?ctiid.216882 - https://github.com/indeedeng/util/commit/c0952a9db51a880e9544d9fac2a2218a6bfc9c63 - https://github.com/indeedeng/util/releases/tag/published%2F1.0.34
CVE ID: CVE-2020-36635 State: PUBLISHED Published: 2022-12-27T22:51:59.270Z Last Updated: 2025-04-11T14:35:54.524Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: OpenMRS Products: Appointment Scheduling Module Problem Types: CWE-79 Description: A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.13.0 is able to address this
ross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.13.0 is able to address this issue. The name of the patch is 34213c3f6ea22df427573076fb62744694f601d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216915. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216915 - https://vuldb.com/?ctiid.216915 - https://github.com/openmrs/openmrs-module-appointmentscheduling/pull/32 - https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/34213c3f6ea22df427573076fb62744694f601d8 - https://github.com/openmrs/openmrs-module-appo
e-appointmentscheduling/commit/34213c3f6ea22df427573076fb62744694f601d8 - https://github.com/openmrs/openmrs-module-appointmentscheduling/releases/tag/1.13.0
CVE ID: CVE-2020-36636 State: PUBLISHED Published: 2022-12-27T22:59:23.592Z Last Updated: 2024-08-04T17:30:08.316Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: OpenMRS Products: Admin UI Module Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.5.0 is able to addr
leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 702fbfdac7c4418f23bb5f6452482b4a88020061. It is recommended to upgrade the affected component. VDB-216918 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216918 - https://vuldb.com/?ctiid.216918 - https://github.com/openmrs/openmrs-module-adminui/pull/57 - https://github.com/openmrs/openmrs-module-adminui/commit/702fbfdac7c4418f23bb5f6452482b4a88020061 - https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0
CVE ID: CVE-2020-36637 State: PUBLISHED Published: 2022-12-30T11:08:53.364Z Last Updated: 2024-08-04T17:30:08.466Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Chris92de Products: AdminServ Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been declared as problematic. This vulnerability affects unknown code of the file resources/core/adminserv.php. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier a
ab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217042 - https://vuldb.com/?ctiid.217042 - https://github.com/Chris92de/AdminServ/pull/7 - https://github.com/Chris92de/AdminServ/commit/3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7
CVE ID: CVE-2020-36638 State: PUBLISHED Published: 2022-12-30T11:11:03.047Z Last Updated: 2024-08-04T17:30:08.392Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Chris92de Products: AdminServ Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been rated as problematic. This issue affects some unknown processing of the file resources/core/adminserv.php. The manipulation of the argument error leads to cross site scripting. The attack may be initiated remotely. The patch is named 9a45087814295de6fb3a3fe38f96293665234da1. It is recommended to apply a patch to fix this issue. The associated identifier of this vul
de6fb3a3fe38f96293665234da1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217043. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217043 - https://vuldb.com/?ctiid.217043 - https://github.com/Chris92de/AdminServ/pull/6 - https://github.com/Chris92de/AdminServ/commit/9a45087814295de6fb3a3fe38f96293665234da1
CVE ID: CVE-2020-36639 State: PUBLISHED Published: 2023-01-04T09:28:10.856Z Last Updated: 2024-08-04T17:30:08.435Z Severity: N/A (CVSS 4.7 AV:A/AC:L/Au:M/C:P/I:P/A:P) Vendors: AlliedModders Products: AMX Mod X Problem Types: CWE-22 Description: A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument amx_votemap leads to path traversal. The patch is identified as a5f2b5539f6d61050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned
050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.217354 - https://vuldb.com/?ctiid.217354 - https://github.com/alliedmodders/amxmodx/pull/823 - https://github.com/alliedmodders/amxmodx/commit/a5f2b5539f6d61050b68df8b22ebb343a2862681
CVE ID: CVE-2020-36640 State: PUBLISHED Published: 2023-01-05T09:09:51.264Z Last Updated: 2025-04-10T14:17:41.423Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: bonitasoft Products: bonita-connector-webservice Problem Types: CWE-611 Description: A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b
ntity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217443 - https://vuldb.com/?ctiid.217443 - https://github.com/bonitasoft/bonita-connector-webservice/pull/17 - https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 - https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1
CVE ID: CVE-2020-36641 State: PUBLISHED Published: 2023-01-05T11:29:57.735Z Last Updated: 2024-08-04T17:30:08.461Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: gturri Products: aXMLRPC Problem Types: CWE-611 Description: A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component.
he patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217450 - https://vuldb.com/?ctiid.217450 - https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae - https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0
CVE ID: CVE-2020-36642 State: PUBLISHED Published: 2023-01-06T10:28:44.659Z Last Updated: 2025-04-10T13:21:31.171Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: trampgeek Products: jobe Problem Types: CWE-77 Description: A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifier of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was a
f50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217553 - https://vuldb.com/?ctiid.217553 - https://github.com/trampgeek/jobe/issues/39 - https://github.com/trampgeek/jobe/commit/8f43daf50c943b98eaf0c542da901a4a16e85b02 - https://github.com/trampgeek/jobe/releases/tag/v1.7.0