Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12782 State: PUBLISHED Published: 2020-06-23T06:05:37.538760Z Last Updated: 2024-09-17T03:22:44.377Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Openfind Products: MailGates, MailAudit Problem Types: Command Injection Description: Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and gain unauthorized access to system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3688-271ea-1.html
CVE ID: CVE-2020-12783 State: PUBLISHED Published: 2020-05-11T13:51:54 Last Updated: 2024-08-04T12:04:22.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.exim.org/show_bug.cgi?id=2571 - https://git.exim.org/exim.git/commit/57aa14b216432be381b6295c312065b2fd034f86 - https://git.exim.org/exim.git/commit/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0 - https://www.debian.org/security/2020/dsa-4687 - https://lists.debian.org/debian-lts-announce/2020/05/ms
09e7fa3fb7b8b0 - https://www.debian.org/security/2020/dsa-4687 - https://lists.debian.org/debian-lts-announce/2020/05/msg00017.html - https://usn.ubuntu.com/4366-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6IQQ2SERFUD4WMRSX6XYDNK7Q4GPT7Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7Z5UG6ZIG32V7M4PP3BCC65C27EWK7G/ - http://www.openwall.com/lists/oss-security/2021/05/04/7
CVE ID: CVE-2020-12784 State: PUBLISHED Published: 2020-05-11T15:49:58 Last Updated: 2024-08-04T12:04:22.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/86+Change+Log
CVE ID: CVE-2020-12785 State: PUBLISHED Published: 2020-05-11T15:51:38 Last Updated: 2024-08-04T12:04:22.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/86+Change+Log
CVE ID: CVE-2020-12787 State: PUBLISHED Published: 2020-09-14T13:24:38 Last Updated: 2024-08-04T12:04:22.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/
CVE ID: CVE-2020-12788 State: PUBLISHED Published: 2020-09-14T13:24:41 Last Updated: 2024-08-04T12:04:22.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/
CVE ID: CVE-2020-12789 State: PUBLISHED Published: 2020-09-14T13:24:44 Last Updated: 2024-08-04T12:04:22.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/
CVE ID: CVE-2020-12790 State: PUBLISHED Published: 2020-05-11T18:08:04 Last Updated: 2024-08-04T12:04:22.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nystudio107/craft-seomatic/releases/tag/3.2.49 - https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md#3249---20200324 - https://isec.pl/en/vulnerabilities/isec-0028-seomatic-ssti-23032020.txt - https://
lob/v3/CHANGELOG.md#3249---20200324 - https://isec.pl/en/vulnerabilities/isec-0028-seomatic-ssti-23032020.txt - https://github.com/nystudio107/craft-seomatic/commit/82f4a25b28fd622393da6592dc9e5ccee7fc5be3#diff-52fd042c50432133a00a8f840f4a6165
CVE ID: CVE-2020-12797 State: PUBLISHED Published: 2020-06-11T19:37:19 Last Updated: 2024-08-04T12:04:22.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md - https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md - https://github.com/hashicorp/consul/pull/8047
CVE ID: CVE-2020-12798 State: PUBLISHED Published: 2020-05-15T17:33:42 Last Updated: 2024-08-04T12:04:22.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Windows file dialog that is reachable via the Certificate-Based Authentication option of the Wireless Network Connection screen. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/thatguylevel - https://korelogic.com/advisories.html - https://github.com/thatguylevel - http://packetstormsecurity.com/files/157715/Cellebrite-UFED-7.5.0.845-Desktop-Escape-Privile
//github.com/thatguylevel - http://packetstormsecurity.com/files/157715/Cellebrite-UFED-7.5.0.845-Desktop-Escape-Privilege-Escalation.html - https://korelogic.com/Resources/Advisories/KL-001-2020-002.txt
CVE ID: CVE-2020-12800 State: PUBLISHED Published: 2020-06-08T16:25:13 Last Updated: 2024-08-04T12:04:22.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/157951/WordPress-Drag-And-Drop-Multi-File-Uploader-Remote-Code-Execution.html - https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/#developers
CVE ID: CVE-2020-12801 State: PUBLISHED Published: 2020-05-18T14:20:08.325905Z Last Updated: 2024-11-18T17:29:42.515Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-311 Description: If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format
hat subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4 series versions prior to 6.4.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12801 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00011.html - https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
CVE ID: CVE-2020-12802 State: PUBLISHED Published: 2020-06-08T15:23:05.479080Z Last Updated: 2024-09-17T04:08:53.179Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-200 Description: LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
his protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12802 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQIBAKXD7VO5IGBD7ZMH3GGBNR5R2IOA/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00058.html - https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
CVE ID: CVE-2020-12803 State: PUBLISHED Published: 2020-06-08T15:43:09.400466Z Last Updated: 2024-09-16T22:25:46.168Z Vendors: The Document Foundation Products: LibreOffice Problem Types: xforms submission target on local file system allowed Description: ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form
ripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the form, but to avoid the possibility of malicious documents engineered to maximize the possibility of inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12803 - https://lists.fedoraproject.org/archives/list/pa
tps://www.libreoffice.org/about-us/security/advisories/CVE-2020-12803 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQIBAKXD7VO5IGBD7ZMH3GGBNR5R2IOA/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00058.html - https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
CVE ID: CVE-2020-12811 State: PUBLISHED Published: 2020-09-24T13:36:12 Last Updated: 2024-10-25T14:00:35.701Z Vendors: Fortinet Products: Fortinet FortiManager, FortiAnalyzer Problem Types: Execute unauthorized code or commands Description: An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6.2.3 may allow an attacker to execute a cross site scripting (XSS) via the Identify Provider name field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-005
CVE ID: CVE-2020-12812 State: PUBLISHED Published: 2020-07-24T22:28:43.000Z Last Updated: 2025-10-21T23:35:38.889Z Vendors: n/a Products: Fortinet FortiOS Problem Types: Improper Access Control Description: An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-283
CVE ID: CVE-2020-12814 State: PUBLISHED Published: 2021-11-02T17:56:02 Last Updated: 2024-10-25T13:47:44.558Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiAnalyzer Problem Types: Execute unauthorized code or commands Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows attacker to execute unauthorized code or commands via specifically crafted requests to the web GUI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-092
CVE ID: CVE-2020-12815 State: PUBLISHED Published: 2020-09-24T13:33:14 Last Updated: 2024-10-25T14:00:46.553Z Vendors: Fortinet Products: Fortinet FortiTester Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-054
CVE ID: CVE-2020-12816 State: PUBLISHED Published: 2020-09-24T13:29:01 Last Updated: 2024-10-25T14:00:57.750Z Vendors: Fortinet Products: Fortinet FortiNAC Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-002
CVE ID: CVE-2020-12817 State: PUBLISHED Published: 2020-09-24T13:31:29 Last Updated: 2024-10-25T14:24:23.911Z Vendors: Fortinet Products: Fortinet FortiAnalyzer Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to inject script related HTML tags via Name parameter of Storage Connectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-054
CVE ID: CVE-2020-12818 State: PUBLISHED Published: 2020-09-24T13:30:18 Last Updated: 2024-10-25T14:24:36.510Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Improper Access Control Description: An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-033
CVE ID: CVE-2020-12819 State: PUBLISHED Published: 2024-12-19T07:40:58.144Z Last Updated: 2024-12-20T17:41:24.593Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context A
. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-082
CVE ID: CVE-2020-12820 State: PUBLISHED Published: 2024-12-19T10:57:31.517Z Last Updated: 2024-12-20T17:25:13.362Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-121 Description: Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL VPN to crash the FortiClient NAC daemon (fcnacd) and potentially execute arbitrary code via requesting a large FortiClient file name. We are not aware of proof of concept code successfully achieving the latter. Additional Analyst Notes: - CISA ADP
name. We are not aware of proof of concept code successfully achieving the latter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-20-083
CVE ID: CVE-2020-12821 State: PUBLISHED Published: 2020-07-07T19:18:43 Last Updated: 2024-08-04T12:04:22.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libp2p/specs/tree/master/pubsub/gossipsub - https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md - https://bitcoin.stackexchange.com/questions/61151/eclipse-attack-vs-sybil-attack - https://github.com/ipfs/blog/pull/450 - https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evalu
b.com/ipfs/blog/pull/450 - https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evaluation%20Report.pdf
CVE ID: CVE-2020-12823 State: PUBLISHED Published: 2020-05-12T17:07:15 Last Updated: 2024-08-04T12:04:22.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/openconnect/openconnect/-/merge_requests/108 - https://bugs.gentoo.org/721570 - https://lists.debian.org/debian-lts-announce/2020/05/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYSXLXAPXD2T73T6
html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYSXLXAPXD2T73T6JMHI5G2WP7KHAGMN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEVTIH5UFX35CC7MVSYBGRM3D66ACFD5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25MFX4AZE7RDCUWOL4ZOE73YBOPUMQDX/ - https://security.gentoo.org/glsa/202006-15 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00056.html
CVE ID: CVE-2020-12824 State: PUBLISHED Published: 2020-09-25T03:33:13 Last Updated: 2024-08-04T12:04:22.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.pexip.com - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2020-12825 State: PUBLISHED Published: 2020-05-12T17:30:57 Last Updated: 2024-08-04T12:04:22.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libcroco/-/issues/8 - http://www.openwall.com/lists/oss-security/2020/08/13/3 - http://www.openwall.com/lists/oss-security/2020/09/08/3 - https://security.gentoo.org/glsa/202208-33
CVE ID: CVE-2020-12826 State: PUBLISHED Published: 2020-05-12T18:58:48 Last Updated: 2024-08-04T12:04:22.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat
er overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.5 - https://www.openwall.com/lists/kernel-hardening/2020/03/25/1 - https://lists.openwall.net/linux-kernel/2020/03/24/1803 - https://github.com/torvalds/linux/commit/7395ea4e65c2a00d23185a3f63ad315756ba9cef - https://bugzilla.redhat.com/show_bug.cgi?id=1822077 - https://usn.ubuntu.com/4367-1/ - https://usn.ubuntu.com/4369-1/ - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://usn.ubuntu.com/4391-1/
CVE ID: CVE-2020-12827 State: PUBLISHED Published: 2020-06-17T13:28:04 Last Updated: 2024-08-04T12:04:22.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12 - https://github.com/mjmlio/mjml/releases/tag/v4.6.3 - https://twitter.com/mjmlio - https://mjml.io/community - https://rcesecurity.com - http://seclists.org/fulldisclosure/2020/Jun/23 - http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html
CVE ID: CVE-2020-12828 State: PUBLISHED Published: 2020-05-21T16:25:46 Last Updated: 2024-08-04T12:04:22.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.pango.co/sec31944/
CVE ID: CVE-2020-12829 State: PUBLISHED Published: 2020-08-31T14:41:14 Last Updated: 2024-08-04T12:04:22.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4467-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1808510 - h