Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
und you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7 - https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39 - https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/ - http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html
CVE ID: CVE-2020-15150 State: PUBLISHED Published: 2020-09-01T16:30:14 Last Updated: 2024-08-04T13:08:22.305Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: duffelhq Products: paginator Problem Types: CWE-94 Description: There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir ver
should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj - https://hex.pm/packages/paginator - https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8 - https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations
CVE ID: CVE-2020-15151 State: PUBLISHED Published: 2020-08-19T18:10:13 Last Updated: 2024-08-04T13:08:22.288Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-203 Description: OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6 - https:
rogram Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6 - https://helpx.adobe.com/security/products/magento/apsb20-47.html - https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347a
CVE ID: CVE-2020-15152 State: PUBLISHED Published: 2020-08-17T21:55:13 Last Updated: 2024-08-04T13:08:22.363Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: autovance Products: ftp-srv Problem Types: CWE-918 Description: ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.
sible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/autovance/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j - https://github.com/autovance/ftp-srv/commit/e449e75219d918c400dec65b4b0759f60476abca - https://www.npmjs.com/package/ftp-srv
CVE ID: CVE-2020-15153 State: PUBLISHED Published: 2021-04-30T15:20:16 Last Updated: 2024-08-04T13:08:22.314Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: ampache Products: ampache Problem Types: CWE-89 Description: Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ampache/ampache/security/advisories/GHSA-phr3-mpx5-7826 - https://github.com/ampache/ampache/commit/e92cb6154c32c513b9c07e5fdbf5ac7de81ef5ed -
y/advisories/GHSA-phr3-mpx5-7826 - https://github.com/ampache/ampache/commit/e92cb6154c32c513b9c07e5fdbf5ac7de81ef5ed - https://github.com/ampache/ampache/releases/tag/4.2.2
CVE ID: CVE-2020-15154 State: PUBLISHED Published: 2020-08-28T21:10:14 Last Updated: 2024-08-04T13:08:22.291Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baserproject/base
in version 4.3.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-cpxc-67rc-c775 - https://basercms.net/security/20200827
CVE ID: CVE-2020-15155 State: PUBLISHED Published: 2020-08-28T21:40:15 Last Updated: 2024-08-04T13:08:21.880Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7. Additional Analyst Notes: - CVE Program Container: References: - https://basercms.net/security/20200827 - https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3 - https://github.com/b
urity/20200827 - https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3 - https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f
CVE ID: CVE-2020-15156 State: PUBLISHED Published: 2020-08-26T19:10:14 Last Updated: 2024-08-04T13:08:22.293Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: psychobunny Products: nodebb-plugin-blog-comments Problem Types: CWE-352 Description: In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/psychobunny/nodebb-plugin-blog-comments/security/advisories/GHSA-43m5-c88r-cjvv - https://github.com/psychobunny/nodebb-plugin-
unny/nodebb-plugin-blog-comments/security/advisories/GHSA-43m5-c88r-cjvv - https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618 - https://www.npmjs.com/package/nodebb-plugin-blog-comments
CVE ID: CVE-2020-15157 State: PUBLISHED Published: 2020-10-16T16:45:18 Last Updated: 2024-08-04T13:08:22.310Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: containerd Products: containerd Problem Types: CWE-522 Description: In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default conta
containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual insta
username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built o
n the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containerd/containerd/security/advisories/GHSA-742w-89gc-8m9c - https://github.com/containerd/containerd/releases/tag/v1.2.14 - https://usn.ubuntu.com/4589-1/ - https://usn.ubuntu.com/4589-2/ - https://www.debian.org/security/2021/dsa-4865
CVE ID: CVE-2020-15158 State: PUBLISHED Published: 2020-08-26T18:00:16 Last Updated: 2024-08-04T13:08:22.296Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: mz-automation Products: libiec61850 Problem Types: CWE-119, CWE-122 Description: In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in open networks or there are untrusted nodes in the network it is highly recommend to apply the patch. This was patched with commit
rks or there are untrusted nodes in the network it is highly recommend to apply the patch. This was patched with commit 033ab5b. Users of version 1.4.x should upgrade to version 1.4.3 when available. As a workaround changes of commit 033ab5b can be applied to older versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850/security/advisories/GHSA-pq77-fmf7-hjw8 - https://github.com/mz-automation/libiec61850/issues/250 - https://github.com/mz-automation/libiec61850/commit/033ab5b6488250c8c3b838f25a7cbc3e099230bb
CVE ID: CVE-2020-15159 State: PUBLISHED Published: 2020-08-28T21:55:14 Last Updated: 2024-08-04T13:08:22.439Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7. Additional Analyst Notes: - CVE Program Container: References: - https://basercms.net/security/20200827
n version 4.3.7. Additional Analyst Notes: - CVE Program Container: References: - https://basercms.net/security/20200827 - https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw - https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d
CVE ID: CVE-2020-15160 State: PUBLISHED Published: 2020-09-24T22:10:19 Last Updated: 2024-08-04T13:08:22.432Z Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-89 Description: PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g - https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8 - http://packet
ghq-8h87-826g - https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8 - http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html
CVE ID: CVE-2020-15161 State: PUBLISHED Published: 2020-09-24T22:10:13 Last Updated: 2024-08-04T13:08:22.256Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-5cp2-r794-w37w - https://github.com/PrestaShop/PrestaShop/commit/562a231fec18a928e4a601860416fe11af274672 - https://github.com/PrestaShop/PrestaS
github.com/PrestaShop/PrestaShop/commit/562a231fec18a928e4a601860416fe11af274672 - https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
CVE ID: CVE-2020-15162 State: PUBLISHED Published: 2020-09-24T22:15:14 Last Updated: 2024-08-04T13:08:22.436Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc
ub.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392 - https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf
CVE ID: CVE-2020-15163 State: PUBLISHED Published: 2020-09-09T17:30:19 Last Updated: 2024-08-04T13:08:22.456Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: theupdateframework Products: tuf Problem Types: CWE-863 Description: Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in
nating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg - https://github.com/theupdateframework/tuf/pull/885 - https://github.com/theupdateframework/tuf/releases/tag/v0.12.0 - https://pypi.org/project/tuf - https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7
CVE ID: CVE-2020-15164 State: PUBLISHED Published: 2020-08-28T17:05:13 Last Updated: 2024-08-04T13:08:22.307Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: InternationalScratchWiki Products: mediawiki-scratch-login Problem Types: CWE-287 Description: in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verif
ce version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/InternationalScratchWiki/mediawiki-scratch-login/security/advisories/GHSA-8fq5-g4m5-6j43 - https://github.com/InternationalScratchWiki/mediawiki-scratch-login/commit/70849ef375016a1061490c8c4744046dbfc3e679
CVE ID: CVE-2020-15165 State: PUBLISHED Published: 2020-08-28T17:30:14 Last Updated: 2024-08-04T13:08:22.249Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: maxieds Products: ChameleonMiniLiveDebugger Problem Types: CWE-506 Description: Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maxieds/ChameleonMiniLiv
y Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6 - https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US
CVE ID: CVE-2020-15166 State: PUBLISHED Published: 2020-09-11T15:35:14 Last Updated: 2024-08-04T13:08:22.367Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zeromq Products: libzmq Problem Types: CWE-400 Description: In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. Th
kes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m - https://github.com/zeromq/libzmq/pull/3913 - https://github.com/zeromq/libzmq/pull/3973 - https://security.gentoo.org/glsa/202009-12 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ5IMNQXDB52JFBXHFLK4AHVORFELNNG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/ - https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html
CVE ID: CVE-2020-15167 State: PUBLISHED Published: 2020-09-02T17:55:12 Last Updated: 2024-08-04T13:08:22.430Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: johnkerl Products: miller Problem Types: CWE-94 Description: In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/johnkerl/miller/securit
iller 5.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw
CVE ID: CVE-2020-15168 State: PUBLISHED Published: 2020-09-10T18:25:13 Last Updated: 2024-08-04T13:08:22.463Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: node-fetch Products: node-fetch Problem Types: CWE-20, CWE-770 Description: node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't dou
you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r - https://www.npmjs.com/package/node-fetch
CVE ID: CVE-2020-15169 State: PUBLISHED Published: 2020-09-11T15:50:12 Last Updated: 2024-08-04T13:08:22.436Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: rails Products: actionview Problem Types: CWE-79 Description: In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as
as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5 - https://www.debian.org/security/2020/dsa-4766 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00015.html
CVE ID: CVE-2020-15170 State: PUBLISHED Published: 2020-09-10T18:40:14 Last Updated: 2024-08-04T13:08:22.406Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: ctripcorp Products: apollo Problem Types: CWE-20 Description: apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, s