Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-36643 State: REJECTED Published: 2023-01-06T16:20:07.598Z Last Updated: 2025-02-13T15:46:14.409Z Description: No description available.
CVE ID: CVE-2020-36644 State: PUBLISHED Published: 2023-01-07T09:02:44.569Z Last Updated: 2025-05-28T13:33:45.442Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: jamesmartin Products: Inline SVG Problem Types: CWE-79 Description: A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b3515
e launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217597 - https://vuldb.com/?ctiid.217597 - https://github.com/jamesmartin/inline_svg/pull/117 - https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621 - https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2
CVE ID: CVE-2020-36645 State: PUBLISHED Published: 2023-01-07T18:13:47.217Z Last Updated: 2024-08-04T17:30:08.415Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: square Products: squalor Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623. Additional Analyst Notes: - CVE Program Container: Refer
The associated identifier of this vulnerability is VDB-217623. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217623 - https://vuldb.com/?ctiid.217623 - https://github.com/square/squalor/pull/76 - https://github.com/square/squalor/commit/f6f0a47cc344711042eb0970cb423e6950ba3f93 - https://github.com/square/squalor/releases/tag/v0.0.0
CVE ID: CVE-2020-36646 State: PUBLISHED Published: 2023-01-07T19:34:51.643Z Last Updated: 2024-08-04T17:30:08.335Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: MediaArea Products: ZenLib Problem Types: CWE-690 Description: A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended t
able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217629 - https://vuldb.com/?ctiid.217629 - https://github.com/MediaArea/ZenLib/pull/119 - https://github.com/MediaArea/ZenLib/commit/6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408 - https://github.com/MediaArea/ZenLib/releases/tag/v0.4.39
CVE ID: CVE-2020-36647 State: PUBLISHED Published: 2023-01-08T09:06:31.027Z Last Updated: 2024-08-04T17:30:08.600Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: YunoHost-Apps Products: transmission_ynh Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container:
issue. VDB-217638 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217638 - https://vuldb.com/?ctiid.217638 - https://github.com/YunoHost-Apps/transmission_ynh/pull/75 - https://github.com/YunoHost-Apps/transmission_ynh/commit/f136dfd44eda128129e5fd2d850a3a3c600e6a4a
CVE ID: CVE-2020-36648 State: PUBLISHED Published: 2023-01-08T09:21:41.318Z Last Updated: 2024-08-04T17:30:08.329Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: pouetnet Products: pouet Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in pouetnet pouet 2.0. This affects an unknown part. The manipulation of the argument howmany leads to sql injection. The identifier of the patch is 11d615931352066fb2f6dcb07428277c2cd99baf. It is recommended to apply a patch to fix this issue. The identifier VDB-217641 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vu
B-217641 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217641 - https://vuldb.com/?ctiid.217641 - https://github.com/pouetnet/pouet2.0/commit/11d615931352066fb2f6dcb07428277c2cd99baf
CVE ID: CVE-2020-36649 State: PUBLISHED Published: 2023-01-11T14:50:51.436Z Last Updated: 2024-08-04T17:30:08.528Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: mholt Products: PapaParse Problem Types: CWE-1333 Description: A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is V
d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218004 - https://vuldb.com/?ctiid.218004 - https://github.com/mholt/PapaParse/issues/777 - https://github.com/mholt/PapaParse/pull/779 - https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621 - https://github.com/mholt/PapaParse/releases/tag/5.2.0
CVE ID: CVE-2020-36650 State: PUBLISHED Published: 2023-01-11T17:52:05.766Z Last Updated: 2024-08-04T17:30:08.543Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IonicaBizau Products: node-gry Problem Types: CWE-77 Description: A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019. Additional Analyst Notes: - CVE
e the affected component. The associated identifier of this vulnerability is VDB-218019. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218019 - https://vuldb.com/?ctiid.218019 - https://github.com/IonicaBizau/node-gry/pull/22 - https://github.com/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c - https://github.com/IonicaBizau/node-gry/releases/tag/6.0.0
CVE ID: CVE-2020-36651 State: PUBLISHED Published: 2023-01-18T00:58:05.292Z Last Updated: 2024-11-25T16:33:30.671Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: youngerheart Products: nodeserver Problem Types: CWE-22 Description: A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability. Additional Analyst Notes: - CVE
a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218461 - https://vuldb.com/?ctiid.218461 - https://github.com/youngerheart/nodeserver/pull/6 - https://github.com/youngerheart/nodeserver/commit/c4c0f0138ab5afbac58e03915d446680421bde28
CVE ID: CVE-2020-36652 State: PUBLISHED Published: 2023-02-28T02:06:32.073Z Last Updated: 2025-03-07T18:12:57.576Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Hitachi Products: Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Automator, Hitachi Ops Center Analyzer, Hitachi Ops Center Viewpoint Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure Analytics Advisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux
dvisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer, Analyzer probe server components), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Automation Director: from 8.2.0-00 through 10.6.1-00; Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.0.0-00; Hitachi Ops Center Automator: before 10.9.1-00; Hitachi Ops Center Analyzer: before 10.9.1-00; Hitachi Ops Center Viewpoint: before 10.9.1-00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
ewpoint: before 10.9.1-00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-106/index.html
CVE ID: CVE-2020-36653 State: PUBLISHED Published: 2023-01-18T07:58:04.096Z Last Updated: 2024-08-04T17:30:08.527Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GENI Products: Portal Problem Types: CWE-79 Description: A vulnerability was found in GENI Portal. It has been rated as problematic. Affected by this issue is some unknown functionality of the file portal/www/portal/error-text.php. The manipulation of the argument error leads to cross site scripting. The attack may be launched remotely. The patch is identified as c2356cc41260551073bfaa3a94d1ab074f554938. It is recommended to apply a patch to fix this issue. VDB-218474 is the identifier assigned to this vulnerability. Add
. It is recommended to apply a patch to fix this issue. VDB-218474 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218474 - https://vuldb.com/?ctiid.218474 - https://github.com/GENI-NSF/geni-portal/pull/1822 - https://github.com/GENI-NSF/geni-portal/commit/c2356cc41260551073bfaa3a94d1ab074f554938
CVE ID: CVE-2020-36654 State: PUBLISHED Published: 2023-01-18T07:58:05.039Z Last Updated: 2024-08-04T17:30:08.365Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: GENI Products: Portal Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in GENI Portal. This affects the function no_invocation_id_error of the file portal/www/portal/sliceresource.php. The manipulation of the argument invocation_id/invocation_user leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 39a96fb4b822bd3497442a96135de498d4a81337. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnera
7442a96135de498d4a81337. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218475. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218475 - https://vuldb.com/?ctiid.218475 - https://github.com/GENI-NSF/geni-portal/pull/1824 - https://github.com/GENI-NSF/geni-portal/commit/39a96fb4b822bd3497442a96135de498d4a81337
CVE ID: CVE-2020-36655 State: PUBLISHED Published: 2023-01-21T00:00:00.000Z Last Updated: 2025-04-02T13:48:32.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lab.wallarm.com/yii2-gii-remote-code-execution/ - https://github.com/yiisoft/yii2-gii/issues/433
CVE ID: CVE-2020-36656 State: PUBLISHED Published: 2023-02-21T08:50:37.298Z Last Updated: 2025-04-23T16:23:49.229Z Vendors: Unknown Products: Spectra Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/10f7e892-7a91-4292-b03e-6ad75756488b
CVE ID: CVE-2020-36657 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T20:11:33.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.gentoo.org/630810 - https://security.gentoo.org/glsa/202305-14
CVE ID: CVE-2020-36658 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T17:37:05.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LemonLDAPNG/Apache-Session-LDAP/commit/490722b71eed1ed1ab33d58c78578f23e043561f - https://lists.debian.org/debian-lts-an
LemonLDAPNG/Apache-Session-LDAP/commit/490722b71eed1ed1ab33d58c78578f23e043561f - https://lists.debian.org/debian-lts-announce/2023/01/msg00024.html
CVE ID: CVE-2020-36659 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-04-03T12:58:44.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/fdf393235140b293cae5578ef136055a78f3574f - https://lists.debian.org
hub.com/LemonLDAPNG/Apache-Session-Browseable/commit/fdf393235140b293cae5578ef136055a78f3574f - https://lists.debian.org/debian-lts-announce/2023/01/msg00025.html
CVE ID: CVE-2020-36660 State: PUBLISHED Published: 2023-02-06T16:31:02.844Z Last Updated: 2024-11-25T15:39:42.926Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: paxswill Products: EVE Ship Replacement Program Problem Types: CWE-200 Description: A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c969
initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.220211 - https://vuldb.com/?ctiid.220211 - https://github.com/paxswill/evesrp/commit/9e03f68e46e85ca9c9694a6971859b3ee66f0240 - https://github.com/paxswill/evesrp/releases/tag/v0.12.12
CVE ID: CVE-2020-36661 State: PUBLISHED Published: 2023-02-12T20:31:03.522Z Last Updated: 2025-03-24T18:40:00.463Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Kong Products: lua-multipart Problem Types: CWE-1333 Description: A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is
ntified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.220642 - https://vuldb.com/?ctiid.220642 - https://github.com/Kong/lua-multipart/pull/34 - https://github.com/Kong/lua-multipart/commit/d632e5df43a2928fd537784a99a79dec288bf01b - https://github.com/Kong/lua-multipart/releases/tag/0.5.9-1
CVE ID: CVE-2020-36662 State: REJECTED Published: N/A Last Updated: 2025-02-13T15:46:15.020Z Description: No description available.
CVE ID: CVE-2020-36663 State: PUBLISHED Published: 2023-03-04T06:31:03.924Z Last Updated: 2024-08-04T17:30:08.469Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Artesãos Products: SEOTools Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The patch is named ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The associated identifier of this vulnerabi
05227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222231. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222231 - https://vuldb.com/?ctiid.222231 - https://github.com/artesaos/seotools/pull/201 - https://github.com/artesaos/seotools/commit/ca27cd0edf917e0bc805227013859b8b5a1f01fb - https://github.com/artesaos/seotools/releases/tag/v0.17.2
CVE ID: CVE-2020-36664 State: PUBLISHED Published: 2023-03-04T17:00:05.012Z Last Updated: 2024-08-04T17:30:08.702Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Artesãos Products: SEOTools Problem Types: CWE-601 Description: A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier of this vuln
27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222232. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222232 - https://vuldb.com/?ctiid.222232 - https://github.com/artesaos/seotools/pull/201 - https://github.com/artesaos/seotools/commit/ca27cd0edf917e0bc805227013859b8b5a1f01fb - https://github.com/artesaos/seotools/releases/tag/v0.17.2
CVE ID: CVE-2020-36665 State: PUBLISHED Published: 2023-03-04T18:31:04.393Z Last Updated: 2024-08-04T17:30:08.470Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Artesãos Products: SEOTools Problem Types: CWE-601 Description: A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The identifier of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier VDB-222233 was a
0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier VDB-222233 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222233 - https://vuldb.com/?ctiid.222233 - https://github.com/artesaos/seotools/pull/201 - https://github.com/artesaos/seotools/commit/ca27cd0edf917e0bc805227013859b8b5a1f01fb - https://github.com/artesaos/seotools/releases/tag/v0.17.2
CVE ID: CVE-2020-36666 State: PUBLISHED Published: 2023-03-27T15:37:27.159Z Last Updated: 2025-02-19T20:09:36.125Z Vendors: Unknown Products: directory-pro, final-user-wp-frontend-user-profiles, producer-retailer, photographer-directory, real-estate-pro, institutions-directory, lawyer-directory, doctor-listing, Hotel Listing, fitness-trainer, wp-membership Problem Types: CWE-269 Improper Privilege Management Description: The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institut
ough TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admi
tting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d079cb16-ead5-4bc8-b0b8-4a4dc2a54c96 - https://codecanyon.net/user/e-plugins