Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8992 State: PUBLISHED Published: 2020-02-14T04:27:04 Last Updated: 2024-08-04T10:19:18.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.ozlabs.org/patch/1236118/ - https://security.netapp.com/advisory/ntap-20200313-0003/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html - https://usn.ubuntu.com/4318-1/ - https://usn.ubuntu.com/4324-1/ - https://usn.ubuntu.com/4344-1/ - https://
00021.html - https://usn.ubuntu.com/4318-1/ - https://usn.ubuntu.com/4324-1/ - https://usn.ubuntu.com/4344-1/ - https://usn.ubuntu.com/4342-1/ - https://usn.ubuntu.com/4419-1/
CVE ID: CVE-2020-8994 State: PUBLISHED Published: 2020-03-05T15:43:59 Last Updated: 2024-08-04T10:19:19.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH
e entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/sites/default/files/soups2018posters-lau.pdf - https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-8994.md - https://youtu.be/yCadG38yZW8
CVE ID: CVE-2020-8995 State: PUBLISHED Published: 2020-12-21T21:07:03 Last Updated: 2024-08-04T10:19:19.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Dec/38 - https://packetstormsecurity.com/files/160626/Programi-Bilanc-Build-007-Release-014-31.01.2020-Hardcoded-Credentials.html
CVE ID: CVE-2020-8996 State: PUBLISHED Published: 2020-02-16T17:06:20 Last Updated: 2024-08-04T10:19:19.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/codingdream/anyshare_vul
CVE ID: CVE-2020-8997 State: PUBLISHED Published: 2020-02-16T17:26:55 Last Updated: 2024-08-04T10:19:19.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Older generation Abbott FreeStyle Libre sensors allow remote attackers within close proximity to enable write access to memory via a specific NFC unlock command. NOTE: The vulnerability is not present in the FreeStyle Libre 14-day in the U.S (announced in August 2018) and FreeStyle Libre 2 outside the U.S (announced in October 2018). Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/zeroday/FG-VD-19-112
CVE ID: CVE-2020-8998 State: REJECTED Published: 2020-02-18T14:31:55 Last Updated: 2020-02-18T14:31:55 Description: No description available.
CVE ID: CVE-2020-8999 State: REJECTED Published: 2020-12-14T01:34:43 Last Updated: 2020-12-14T01:34:43 Description: No description available.
CVE ID: CVE-2020-9000 State: PUBLISHED Published: 2021-09-01T10:45:48 Last Updated: 2024-08-04T10:19:19.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the size of the log file on the remote server until memory is exhausted, therefore consuming the maximum amount of resources (triggering a denial of service condition). Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/blog/ - https://websec.nl/blog/6127847280e759c7d31286d0/cve%20report%20august%202021/
CVE ID: CVE-2020-9001 State: REJECTED Published: 2020-12-14T01:35:21 Last Updated: 2020-12-14T01:35:21 Description: No description available.
CVE ID: CVE-2020-9002 State: PUBLISHED Published: 2021-09-01T10:45:57 Last Updated: 2024-08-04T10:19:19.778Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRoleKey=DOMAIN_ADMIN (to achieve Domain Administrator access). Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/blog/ - https://websec.nl/blog/6127847280e759c7d31286d0/cve%20report%20august%202021/
CVE ID: CVE-2020-9003 State: PUBLISHED Published: 2020-02-20T21:52:32 Last Updated: 2024-08-04T10:19:19.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MachoThemes/modula-lite/blob/master/changelog.txt - https://wordpress.org/plugins/modula-best-grid-gallery/ - https://wpvulndb.com/vulnerabilities/10077 - https://fortiguard.com/zeroday/FG-
.org/plugins/modula-best-grid-gallery/ - https://wpvulndb.com/vulnerabilities/10077 - https://fortiguard.com/zeroday/FG-VD-20-041
CVE ID: CVE-2020-9004 State: PUBLISHED Published: 2020-04-14T14:50:52 Last Updated: 2024-08-04T10:19:19.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004
yst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-Wowza - https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txt
CVE ID: CVE-2020-9005 State: PUBLISHED Published: 2020-02-17T12:52:44 Last Updated: 2024-08-04T10:19:19.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafted map, and inviting a victim to this server. A GetValue call is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bi7s/CVE/blob/master/CVE-2020-9005/README.md
CVE ID: CVE-2020-9006 State: PUBLISHED Published: 2020-02-17T14:33:25 Last Updated: 2024-08-04T10:19:19.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.) Additional Analyst Notes: - CVE Program Container: Refer
(This issue has been fixed in the 3.x branch of popup-builder.) Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/popup-builder/#developers - https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69 - https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/ - https://wpvulndb.com/vulnerabilities/10073
CVE ID: CVE-2020-9007 State: PUBLISHED Published: 2020-02-16T19:08:01 Last Updated: 2024-08-04T10:19:19.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codoforum 4.8.8 allows self-XSS via the title of a new topic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matuhn/Research/blob/master/codoforum/readme.md
CVE ID: CVE-2020-9008 State: PUBLISHED Published: 2020-02-25T17:29:26 Last Updated: 2024-08-04T10:19:19.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor. Additional Analyst Notes: - CVE Program Container: References: - https://blackboard.com - https://github.com/kyletimmermans/blackboard-xss/blob/master/CVE-2020-9008.md
CVE ID: CVE-2020-9009 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T17:35:54.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action=shipnotify) because access to this endpoint is completely unchecked. The attacker must guess an order number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.shipstation.com/hc/en-us/articles/360025855352-CS-Cart - https://www.jerdiggity.com/node/870
CVE ID: CVE-2020-9012 State: PUBLISHED Published: 2020-02-16T20:00:41 Last Updated: 2024-08-04T10:19:18.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.gluu.org/other/7992/reflected-cross-site-scripting-on-import-people/
CVE ID: CVE-2020-9013 State: PUBLISHED Published: 2020-02-16T20:17:55 Last Updated: 2024-08-04T10:19:19.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/GerardFuguet/status/1228462263188758529 - https://www.youtube.com/watch?v=Ok1UmRFWoLY - https://www.exploit-db.com/docs/48175
CVE ID: CVE-2020-9014 State: PUBLISHED Published: 2021-02-05T18:50:05 Last Updated: 2024-08-04T10:19:20.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. \Device\EMPNSAUIO and \DosDevices\EMPNSAU are similarly affected. Additional Analyst Notes: - CVE Program Container: References: - https://epson.com/wireless-projector-app - https://github.com/FULLSHADE/Kernel-exploits - https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_NSAU.sys - https://epson.com/Supp
LLSHADE/Kernel-exploits - https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_NSAU.sys - https://epson.com/Support/wa00935
CVE ID: CVE-2020-9015 State: PUBLISHED Published: 2020-02-20T21:39:13 Last Updated: 2024-08-04T10:19:19.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands Additional Analyst Notes: - CVE Program Container: References: - https://securitybytes.me - https://securitybytes.me/posts/cve-2020-9015/ - https://eos.arista.com/ar
iner: References: - https://securitybytes.me - https://securitybytes.me/posts/cve-2020-9015/ - https://eos.arista.com/arista-eos-is-not-vulnerable-to-cve-2020-9015/ - http://packetstormsecurity.com/files/158119/Arista-Restricted-Shell-Escape-Privilege-Escalation.html
CVE ID: CVE-2020-9016 State: PUBLISHED Published: 2020-02-16T21:10:58 Last Updated: 2024-08-04T10:19:19.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. Additional Analyst Notes: - CVE Program Container: References: - https://code610.blogspot.com/2020/02/this-time-i-tried-to-check-one-of.html
CVE ID: CVE-2020-9017 State: PUBLISHED Published: 2020-02-25T16:58:02 Last Updated: 2024-08-04T10:19:19.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiteCart through 2.2.1 allows CSV injection via a customer's profile. Additional Analyst Notes: - CVE Program Container: References: - https://uploadboy.com/7njf43f167is/384/mp4 - https://cert.ikiu.ac.ir/public-files/pages/attachments/11/e8e09da3c5702511520810527af5b313.pdf
CVE ID: CVE-2020-9018 State: PUBLISHED Published: 2020-02-25T17:13:51 Last Updated: 2024-08-04T10:19:19.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user. Additional Analyst Notes: - CVE Program Container: References: - https://uploadboy.com/7njf43f167is/384/mp4 - https://cert.ikiu.ac.ir/public-files/pages/attachments/11/5a8ed1c216e1a910e413535207563845.pdf
CVE ID: CVE-2020-9019 State: PUBLISHED Published: 2020-02-25T17:20:18 Last Updated: 2024-08-04T10:19:19.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. Additional Analyst Notes: - CVE Program Container: References: - https://uploadboy.com/uhxq91nuxd6d/423/mp4 - https://cert.ikiu.ac.ir/public-files/pages/attachments/11/a1f0e3e5aa9ba583298d03758b8ae95c.pdf - https://wpvulndb.com/vulnerabilities/10113
CVE ID: CVE-2020-9020 State: PUBLISHED Published: 2020-02-17T03:03:49 Last Updated: 2024-08-04T10:19:19.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/iteris-vantage-velocity-field-unit-os.html
CVE ID: CVE-2020-9021 State: PUBLISHED Published: 2020-02-17T03:03:40 Last Updated: 2024-08-04T10:19:19.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system commands through timeconfig.py via shell metacharacters in the htmlNtpServer parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/post-oak-traffic-systems-awam-bluetooth.html
CVE ID: CVE-2020-9022 State: PUBLISHED Published: 2020-02-17T03:03:33 Last Updated: 2024-08-04T10:19:19.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/xirrus-xirrus-wifi-xss.html
CVE ID: CVE-2020-9023 State: PUBLISHED Published: 2020-02-17T03:03:19 Last Updated: 2024-08-04T10:19:19.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password eclipse). Also, bluetooth is the root password. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/iteris-vantage-velocity-field-unit-no.html
CVE ID: CVE-2020-9024 State: PUBLISHED Published: 2020-02-17T03:03:10 Last Updated: 2024-08-04T10:19:19.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/iteris-vantage-velocity-field-unit.html
CVE ID: CVE-2020-9025 State: PUBLISHED Published: 2020-02-17T03:03:02 Last Updated: 2024-08-04T10:19:19.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/iteris-vantage-velocity-field-unit_26.html
CVE ID: CVE-2020-9026 State: PUBLISHED Published: 2020-02-17T03:02:43 Last Updated: 2024-08-04T10:19:19.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/eltex-devices-ntp-rg-1402g-ntp-2-os.html
CVE ID: CVE-2020-9027 State: PUBLISHED Published: 2020-02-17T03:02:34 Last Updated: 2024-08-04T10:19:19.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/eltex-devices-ntp-rg-1402g-ntp-2-os.html
CVE ID: CVE-2020-9028 State: PUBLISHED Published: 2020-02-17T03:02:26 Last Updated: 2024-08-04T10:19:19.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user). Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver_95.html
CVE ID: CVE-2020-9029 State: PUBLISHED Published: 2020-02-17T03:02:16 Last Updated: 2024-08-04T10:19:19.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver.html
CVE ID: CVE-2020-9030 State: PUBLISHED Published: 2020-02-17T03:02:08 Last Updated: 2024-08-04T10:19:19.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver.html
CVE ID: CVE-2020-9031 State: PUBLISHED Published: 2020-02-17T03:01:58 Last Updated: 2024-08-04T10:19:19.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver.html
CVE ID: CVE-2020-9032 State: PUBLISHED Published: 2020-02-17T03:01:51 Last Updated: 2024-08-04T10:19:19.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernlog.php. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver.html
CVE ID: CVE-2020-9033 State: PUBLISHED Published: 2020-02-17T03:01:09 Last Updated: 2024-08-04T10:19:20.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authlog.php. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver.html
CVE ID: CVE-2020-9034 State: PUBLISHED Published: 2020-02-17T03:00:59 Last Updated: 2024-08-04T10:19:19.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of users. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/symmetricom-syncserver_27.html
CVE ID: CVE-2020-9036 State: PUBLISHED Published: 2020-08-05T21:08:14 Last Updated: 2024-08-04T10:19:18.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeedom through 4.0.38 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2020-08-05-cve-2020-9036-jeedom-xss-leading-to-remote-code-execution/
CVE ID: CVE-2020-9038 State: PUBLISHED Published: 2020-02-17T15:47:29 Last Updated: 2024-08-04T10:19:19.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joplin through 1.0.184 allows Arbitrary File Read via XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc - https://github.com/laurent22/joplin/compare/clipper-1.0.19...clipper-1.0.20 - http://packetstormsecurity.com/files/156582/Joplin-Desktop-1.0.184-Cross-Site-Scripting.html
CVE ID: CVE-2020-9039 State: PUBLISHED Published: 2020-02-22T01:30:33 Last Updated: 2024-08-04T10:19:19.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs. Additio
was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts