Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ces where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/ - https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1745 - https://www.cnvd.org.cn/webinfo/show/5415 - https://security.netapp.com/advisory/ntap-20240216-0011/
CVE ID: CVE-2020-1746 State: PUBLISHED Published: 2020-05-12T17:30:47 Last Updated: 2024-08-04T06:46:31.070Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: ansible Problem Types: CWE-200 Description: A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from th
stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746 - https://github.com/ansible/ansible/pull/67866 - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2020-1747 State: PUBLISHED Published: 2020-03-24T13:56:37 Last Updated: 2024-08-04T06:46:30.893Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: PyYAML Problem Types: CWE-20 Description: A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor. Additi
ttacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html - http://lists.opensuse.org/opensuse-security-a
tp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747 - https://github.com/yaml/pyyaml/pull/386
CVE ID: CVE-2020-1748 State: PUBLISHED Published: 2020-09-16T15:27:36 Last Updated: 2024-08-04T06:46:30.892Z Vendors: n/a Products: Wildfly Problem Types: Improper Authorization Description: A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1807707 - https://security.netapp.com/advisory/ntap-20201001-0005/
CVE ID: CVE-2020-1749 State: PUBLISHED Published: 2020-09-09T14:35:17 Last Updated: 2024-08-04T06:46:30.814Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux Kernel Products: kernel Problem Types: CWE-319 Description: A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confi
e in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1749 - https://security.netapp.com/advisory/ntap-20201222-0001/
CVE ID: CVE-2020-1750 State: PUBLISHED Published: 2021-06-07T20:18:34 Last Updated: 2024-08-04T06:46:30.892Z Vendors: n/a Products: machine-config-operator-container Problem Types: CWE-400 Description: A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operator 4.4.3, openshift/machine-config-operator 4.3.25, openshift/machine-config-operator 4.2.36. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id
tor 4.2.36. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1808130
CVE ID: CVE-2020-1751 State: PUBLISHED Published: 2020-04-17T18:32:44 Last Updated: 2024-08-04T06:46:30.859Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: glibc Problem Types: CWE-787 Description: An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/sh
to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751 - https://sourceware.org/bugzilla/show_bug.cgi?id=25423 - https://security.netapp.com/advisory/ntap-20200430-0002/ - https://security.gentoo.org/glsa/202006-04 - https://usn.ubuntu.com/4416-1/
CVE ID: CVE-2020-1752 State: PUBLISHED Published: 2020-04-30T00:00:00 Last Updated: 2024-08-04T06:46:30.943Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GNU Libc Products: glibc Problem Types: CWE-416 Description: A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. Additional Ana
by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752 - https://sourceware.org/bugzilla/show_bug.cgi?id=25414 - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ddc650e9b3dc916eab417ce9f79e67337b05035c - https://security.netapp.com/advisory/ntap-20200511-0005/ - https://usn.ubuntu.com/4416-1/ - https://security.gentoo.org/glsa/202101-20 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e
778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2020-1753 State: PUBLISHED Published: 2020-03-16T14:37:21 Last Updated: 2024-08-04T06:46:30.868Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Ansible Problem Types: CWE-200, CWE-214, CWE-532 Description: A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from
and line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1753 - https://github.com/ansible-collections/kubernetes/pull/51 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJ
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2020-1754 State: PUBLISHED Published: 2022-08-05T15:21:59 Last Updated: 2024-08-04T06:46:30.902Z Vendors: n/a Products: Moodle Problem Types: CWE-284 Description: In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=398350
CVE ID: CVE-2020-1755 State: PUBLISHED Published: 2022-08-16T19:29:48 Last Updated: 2024-08-04T06:46:30.891Z Vendors: n/a Products: Moodle Problem Types: CWE-345 Description: In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=398351
CVE ID: CVE-2020-1756 State: PUBLISHED Published: 2022-08-16T19:30:09 Last Updated: 2024-08-04T06:46:30.903Z Vendors: n/a Products: Moodle Problem Types: CWE-20 Description: In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=398352
CVE ID: CVE-2020-1757 State: PUBLISHED Published: 2020-04-21T15:31:14 Last Updated: 2024-08-04T06:46:30.881Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: undertow Problem Types: CWE-20, CWE-200 Description: A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/s
g in the security bypass. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757
CVE ID: CVE-2020-1758 State: PUBLISHED Published: 2020-05-15T18:52:52 Last Updated: 2024-08-04T06:46:30.910Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-297 Description: A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758 - https://issues.redhat.com/browse/KEYCLOAK-13285
CVE ID: CVE-2020-1759 State: PUBLISHED Published: 2020-04-13T12:04:04 Last Updated: 2024-08-04T06:46:30.894Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: The Ceph Project Products: ceph Problem Types: CWE-323 Description: A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. Ad
sion. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1759 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/ - https://security.gentoo.org/glsa/202105-39
CVE ID: CVE-2020-1760 State: PUBLISHED Published: 2020-04-23T00:00:00 Last Updated: 2024-08-04T06:46:30.894Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: ceph Problem Types: CWE-79 Description: A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760 - https://www.openwall.com/lists/oss-security/2020/04/07/1 - https://lists.fedoraproject.org/archives/list/p
E-2020-1760 - https://www.openwall.com/lists/oss-security/2020/04/07/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/ - https://usn.ubuntu.com/4528-1/ - https://security.gentoo.org/glsa/202105-39 - https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE ID: CVE-2020-1761 State: PUBLISHED Published: 2021-05-27T19:45:14 Last Updated: 2024-08-04T06:46:30.893Z Vendors: n/a Products: openshift/console Problem Types: CWE-358 Description: A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser. This flaw affects openshift/console versions before openshift/console-4. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1813788
CVE ID: CVE-2020-1762 State: PUBLISHED Published: 2020-04-27T20:41:37 Last Updated: 2024-08-04T06:46:30.907Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: [Kiali] Products: kiali Problem Types: CWE-613, CWE-384 Description: An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration. Additional Analyst Notes: - CVE Program Container: References: - https://kiali.io/news/security-bulletins/kiali-security-001/
onal Analyst Notes: - CVE Program Container: References: - https://kiali.io/news/security-bulletins/kiali-security-001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762
CVE ID: CVE-2020-1763 State: PUBLISHED Published: 2020-05-12T13:41:20 Last Updated: 2024-08-04T06:46:30.902Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: the libreswan Project Products: libreswan Problem Types: CWE-125 Description: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash. Additional Analyst Notes: - CVE Program Container: References: - https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt - https://bugzilla.re
VE Program Container: References: - https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763 - https://bugzilla.redhat.com/show_bug.cgi?id=1813329 - https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8 - https://www.debian.org/security/2020/dsa-4684 - https://security.gentoo.org/glsa/202007-21 - https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
CVE ID: CVE-2020-1764 State: PUBLISHED Published: 2020-03-26T11:16:09 Last Updated: 2024-08-04T06:46:30.916Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: kiali Problem Types: CWE-321 Description: A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration. Additional Analyst Notes: - CVE Program Container: References: - https://kiali.io/news/security-bulletins/kiali-security-001/ -
nal Analyst Notes: - CVE Program Container: References: - https://kiali.io/news/security-bulletins/kiali-security-001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764
CVE ID: CVE-2020-1765 State: PUBLISHED Published: 2020-01-10T15:08:55.756034Z Last Updated: 2024-09-16T22:15:10.396Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-472 Description: An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Additional Analyst Notes: - CVE Program Container: Refe
nd prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2020-01/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2020-1766 State: PUBLISHED Published: 2020-01-10T15:08:57.704919Z Last Updated: 2024-09-17T00:10:59.231Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-79 Description: Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Additional Analyst Notes: -
ons; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2020-02/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2020-1767 State: PUBLISHED Published: 2020-01-10T15:09:00.608111Z Last Updated: 2024-09-16T16:33:51.552Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: Sender spoofing Description: Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Additional Analyst Notes: - CVE Prog
.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2020-03/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2020-1768 State: PUBLISHED Published: 2020-02-07T15:42:29.087385Z Last Updated: 2024-09-16T19:09:28.404Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: OTRS AG Products: OTRS Problem Types: CWE-613 Description: The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2020-04/
CVE ID: CVE-2020-1769 State: PUBLISHED Published: 2020-03-27T12:47:49.378986Z Last Updated: 2024-09-17T01:27:02.769Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-16 Description: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2020-06/ - http: