Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
bitrary Referer header Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10190 - https://github.com/sek1th/iot/blob/master/DIR-816L_XSS.md
CVE ID: CVE-2020-25787 State: PUBLISHED Published: 2020-09-19T20:18:20 Last Updated: 2024-08-04T15:40:36.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them. Additional Analyst Notes: - CVE Program Container: References: - https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef - https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799 - http://packetstormsecurity.com/files/161606/TinyTinyRSS-Remote-Code-Execution.html
CVE ID: CVE-2020-25788 State: PUBLISHED Published: 2020-09-19T20:18:08 Last Updated: 2024-08-04T15:40:36.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message. Additional Analyst Notes: - CVE Program Container: References: - https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef - https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799
CVE ID: CVE-2020-25789 State: PUBLISHED Published: 2020-09-19T20:17:49 Last Updated: 2024-08-04T15:40:36.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799 - https://git.tt-rss.org/fox/tt-rss/commit/da5af2fae091041cca27b24b6f0e69e4a6d0dc60
CVE ID: CVE-2020-25790 State: PUBLISHED Published: 2020-09-19T20:31:08 Last Updated: 2024-08-04T15:40:36.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Typesetter/Typesetter/issues/674 - http://seclists.org/fulldisclosure/2020/Oct/11 - http://packetstormsecurity.com/files/159503/Typesette
tter/issues/674 - http://seclists.org/fulldisclosure/2020/Oct/11 - http://packetstormsecurity.com/files/159503/Typesetter-CMS-5.1-Remote-Code-Execution.html - http://packetstormsecurity.com/files/159615/Typesetter-CMS-5.1-Remote-Code-Execution.html
CVE ID: CVE-2020-25791 State: PUBLISHED Published: 2020-09-19T20:59:02 Last Updated: 2024-08-04T15:40:36.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit(). Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0041.html - https://github.com/bodil/sized-chunks/issues/11
CVE ID: CVE-2020-25792 State: PUBLISHED Published: 2020-09-19T00:00:00.000Z Last Updated: 2025-05-05T17:07:40.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2020-0041.html - https://github.com/bodil/sized-chunks/issues/11 - https://github.com/bodil/sized-chunks/commit/3ae48bd463c1af41c24b96b84079946f51f51e3c
CVE ID: CVE-2020-25793 State: PUBLISHED Published: 2020-09-19T20:58:51 Last Updated: 2024-08-04T15:40:36.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From<InlineArray<A, T>>. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0041.html - https://github.com/bodil/sized-chunks/issues/11
CVE ID: CVE-2020-25794 State: PUBLISHED Published: 2020-09-19T20:58:44 Last Updated: 2024-08-04T15:40:36.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0041.html - https://github.com/bodil/sized-chunks/issues/11
CVE ID: CVE-2020-25795 State: PUBLISHED Published: 2020-09-19T20:58:37 Last Updated: 2024-08-04T15:40:36.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can have a memory-safety issue upon a panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0041.html - https://github.com/bodil/sized-chunks/issues/11
CVE ID: CVE-2020-25796 State: PUBLISHED Published: 2020-09-19T20:58:27 Last Updated: 2024-08-04T15:40:36.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unaligned reference may be generated for a type that has a large alignment requirement. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0041.html - https://github.com/bodil/sized-chunks/issues/11
CVE ID: CVE-2020-25797 State: PUBLISHED Published: 2020-12-31T17:06:19 Last Updated: 2024-08-04T15:40:36.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=15680 - https://github.com/LimeSurvey/LimeSurvey/commit/0a7bdfa1c166f734d11a1528c8d9a7d61b670ad7
CVE ID: CVE-2020-25798 State: PUBLISHED Published: 2020-11-17T14:21:20 Last Updated: 2024-08-04T15:40:36.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=
n the browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=15672 - https://github.com/LimeSurvey/LimeSurvey/commit/38e1ab069b538de7cb5f3a04939aba8e835640cb
CVE ID: CVE-2020-25799 State: PUBLISHED Published: 2020-12-31T17:06:54 Last Updated: 2024-08-04T15:40:36.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=15681 - https://github.com/LimeSurvey/LimeSurvey/commit/a5f317817da4577d9ff457fea9c96482b3d1df23
CVE ID: CVE-2020-25802 State: PUBLISHED Published: 2020-10-06T14:09:25.176725Z Last Updated: 2024-09-17T03:07:43.126Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2020080101
CVE ID: CVE-2020-25803 State: PUBLISHED Published: 2020-10-06T14:21:40.707865Z Last Updated: 2024-09-16T22:36:11.291Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.h
Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2020080102
CVE ID: CVE-2020-25812 State: PUBLISHED Published: 2020-09-27T20:25:18 Last Updated: 2024-08-04T15:40:36.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.wikimedia.org/g/mediawiki/core/+/ad4a3ba45fb955aa8c0eb3c83809b16b40a498b9/includes/specials/SpecialContributions.php#592 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-Septemb
40a498b9/includes/specials/SpecialContributions.php#592 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25813 State: PUBLISHED Published: 2020-09-27T20:44:23 Last Updated: 2024-08-04T15:40:36.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users. Additional Analyst Notes: - CVE Program Container: References: - https://meta.wikimedia.org/wiki/Special:UserRights - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25814 State: PUBLISHED Published: 2020-09-27T20:29:44 Last Updated: 2024-08-04T15:40:36.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked. Additional Analyst Notes: - CVE Program Container: References: - https:
href ="javascript... that executes when clicked. Additional Analyst Notes: - CVE Program Container: References: - https://www.mediawiki.org/wiki/ResourceLoader/Core_modules#mediawiki.jqueryMsg - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25815 State: PUBLISHED Published: 2020-09-27T20:27:14 Last Updated: 2024-08-04T15:40:36.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text(). Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.wikimedia.org/g/mediawiki/core/+/ec76e14be658187544f07c1a249a047e1a75eaf8/includes/logging/LogEventsList.php#214 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://
/logging/LogEventsList.php#214 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25816 State: PUBLISHED Published: 2020-09-30T19:44:01 Last Updated: 2024-08-04T15:40:36.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154
CVE ID: CVE-2020-25817 State: PUBLISHED Published: 2021-06-08T17:54:01 Last Updated: 2024-08-04T15:40:36.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE
s now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]). Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/cve-2020-25817
CVE ID: CVE-2020-25820 State: PUBLISHED Published: 2020-10-21T13:01:48 Last Updated: 2024-08-04T15:40:36.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field. Additional Analyst Notes: - CVE Program Container: References: - https://www.redteam-pentesting.de/advisories/rt-sa-2020-005 - https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html - http://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.html - https://
://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.html - https://github.com/bigbluebutton/bigbluebutton/commit/71fe1eac1e5bd73a2cd44bd79c001086b250e435 - https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.26...v2.2.27
CVE ID: CVE-2020-25821 State: PUBLISHED Published: 2020-09-23T03:12:18 Last Updated: 2024-08-04T15:40:36.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: peg-markdown 0.4.14 has a NULL pointer dereference in process_raw_blocks in markdown_lib.c. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgm/peg-markdown/issues/43
CVE ID: CVE-2020-25824 State: PUBLISHED Published: 2020-10-14T14:10:51 Last Updated: 2024-08-04T15:40:36.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files. Additional Analyst Notes: - CVE Program Container: References: - https://www.Telegram.org - https://github.com/soheilsamanabadi/vulnerability/b
s: - CVE Program Container: References: - https://www.Telegram.org - https://github.com/soheilsamanabadi/vulnerability/blob/main/Telegram-Desktop-CVE-2020-25824 - https://github.com/telegramdesktop/tdesktop/releases/tag/v2.4.3 - https://security.gentoo.org/glsa/202101-34
CVE ID: CVE-2020-25825 State: PUBLISHED Published: 2020-10-12T16:09:24 Last Updated: 2024-08-04T15:40:36.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/6604 - https://github.com/OctopusDeploy/Issues/issues/6605 - https://github.com/OctopusDeploy/Issues/issues/6606 - https://github.com/OctopusDeploy/Issues/issues/6607
CVE ID: CVE-2020-25826 State: PUBLISHED Published: 2020-09-23T04:45:13 Last Updated: 2024-08-04T15:40:36.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/-/snippets/2017709 - https://docs.pingidentity.com/bundle/pingid/page/xqz1597139945488.html
CVE ID: CVE-2020-25827 State: PUBLISHED Published: 2020-09-27T20:43:20 Last Updated: 2024-08-04T15:40:36.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T251661 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.
or.wikimedia.org/T251661 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25828 State: PUBLISHED Published: 2020-09-27T20:31:44 Last Updated: 2024-08-04T15:40:36.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no ex
with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.) Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/mediawiki-announce - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-25829 State: PUBLISHED Published: 2020-10-16T05:07:44 Last Updated: 2024-08-04T15:40:36.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process). Additional Analyst Notes: - CVE Program Container: Referenc
ation when on-demand validation is enabled (dnssec=process). Additional Analyst Notes: - CVE Program Container: References: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html - https://security.gentoo.org/glsa/202012-19
CVE ID: CVE-2020-25830 State: PUBLISHED Published: 2020-09-30T20:33:43 Last Updated: 2024-08-04T15:40:36.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=27304 - http://github.com/mantisbt/mantisbt/commit/8c6f4d8859785b67fb80ac65100ac5259ed9237d
CVE ID: CVE-2020-25832 State: PUBLISHED Published: 2020-11-17T01:06:21 Last Updated: 2024-08-04T15:40:36.996Z Vendors: Micro Focus Products: Filr Problem Types: Reflected Cross Site scripting. Description: Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03763396
CVE ID: CVE-2020-25833 State: PUBLISHED Published: 2020-11-17T01:20:34 Last Updated: 2024-08-04T15:40:37.054Z Vendors: Micro Focus Products: IDOL Problem Types: Persistent Cross-Site Scripting. Description: Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03763397