Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r9d437371793b410f8a8e18f556d52d4bb68e18c537962f6a97f4945e%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/r1526dbce98a138629a41daa06c13393146ddcaf8f9d273cc49d57681%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rffabc9e83cc2831bbee5db32b3965b84b09346a26ebc1012db63d28c%40%3Ccommits.druid.apache.org%3E - https://lists.apache.
.html/rffabc9e83cc2831bbee5db32b3965b84b09346a26ebc1012db63d28c%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r1c32c95543d44559b8d7fd89b0a85f728c80e8b715685bbf788a15a4%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rf70876ecafb45b314eff9d040c5281c4adb0cb7771eb029448cfb79b%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r026540c617d334007810cd8f0068f617b5c78444be00a31fc1b03390%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r75e74d39c41c1b95a658b6a9f75fc6fd02b1d1922566a0ee4ee2fdfc%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r47c90a378efdb3fd07ff7f74095b8eb63b3ca93b8ada5c26
0%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r47c90a378efdb3fd07ff7f74095b8eb63b3ca93b8ada5c2661c5e371%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2020-1959 State: PUBLISHED Published: 2020-05-04T12:25:18 Last Updated: 2024-08-04T06:54:00.293Z Vendors: n/a Products: Apache Syncope Problem Types: Multiple Remote Code Execution Vulnerabilities Description: A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary
support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code. Additional Analyst Notes: - CVE Program Container: References: - http://syncope.apache.org/security
CVE ID: CVE-2020-1960 State: PUBLISHED Published: 2020-05-14T16:02:50 Last Updated: 2024-08-04T06:54:00.339Z Vendors: n/a Products: Apache Flink Problem Types: Information Disclosure Description: A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's contro
-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r23e559dee1e69741557b5fe431846de1f1a5981356d0ddb9482df88a%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r663cf0d5c386bba2f562d45ad484d786151a84f0b95e45e2b0fb8e50%40%3Cissues.flink.apache.or
tps://lists.apache.org/thread.html/r663cf0d5c386bba2f562d45ad484d786151a84f0b95e45e2b0fb8e50%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3E
CVE ID: CVE-2020-1961 State: PUBLISHED Published: 2020-05-04T12:28:53 Last Updated: 2024-08-04T06:53:59.969Z Vendors: n/a Products: Apache Syncope Problem Types: Server-Side Template Injection on mail templates Description: Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered. Additional Analyst Notes: - CVE Program Container: References: - http://syncope.apache.org/security
CVE ID: CVE-2020-1962 State: REJECTED Published: 2020-05-11T17:43:39 Last Updated: 2020-05-11T17:43:39 Description: No description available.
CVE ID: CVE-2020-1963 State: PUBLISHED Published: 2020-06-03T12:53:40 Last Updated: 2024-08-04T06:54:00.364Z Vendors: n/a Products: Apache Ignite Problem Types: Information Disclosure Description: Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2020/06/03/2 - https://lists.apache.org/thread.html/rdf37011b92a31a67c299ff45655e2638f194fc814e5c6e2fde352884%40%3Cuser.ignite.apache.org%3E - https://lists.apache.org/thread.html/rdf37011b92a31a67c299ff45655e2638f194fc814e5c6e2fde35288
ser.ignite.apache.org%3E - https://lists.apache.org/thread.html/rdf37011b92a31a67c299ff45655e2638f194fc814e5c6e2fde352884%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/rf032a13a4711f88c0a2c0734eecbee1026cc1b6cde27d16a653f8755%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/rd43ae18588fd7bdb375be63bc95a651aab319ced6306759e1237ce67%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/r119024ef71c8d39f952df0950a275d09714715179aff544aea0129a3%40%3Cuser.ignite.apache.org%3E - https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/
f8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94%40%3Cuser.ignite.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://lists.apache.org/thread.html/r1933faf8a26c431f38a5f8dbbfab80254454e54e33a79be474b67dc4%40%3Cdev.ignite.apache.org%3E
CVE ID: CVE-2020-1964 State: PUBLISHED Published: 2020-04-16T16:21:05 Last Updated: 2024-08-04T06:54:00.371Z Vendors: n/a Products: Apache Heron Problem Types: Information Disclosure Description: It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r16dd39f4180e4443ef4ca774a3a5a3d7ac69f91812c183ed2a99e959%40%3Cdev.heron.apache.org%3E - https://lists.apach
thread.html/r16dd39f4180e4443ef4ca774a3a5a3d7ac69f91812c183ed2a99e959%40%3Cdev.heron.apache.org%3E - https://lists.apache.org/thread.html/rf032a13a4711f88c0a2c0734eecbee1026cc1b6cde27d16a653f8755%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/rd43ae18588fd7bdb375be63bc95a651aab319ced6306759e1237ce67%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94%40%3Cdev.ignite.apache.org%3E - https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94%40%3Cuser.ignite.apache.org%3E
CVE ID: CVE-2020-1966 State: REJECTED Published: 2021-02-15T21:57:14 Last Updated: 2021-02-15T21:57:14 Description: No description available.
CVE ID: CVE-2020-1967 State: PUBLISHED Published: 2020-04-21T13:45:15.136203Z Last Updated: 2024-09-17T03:13:46.200Z Vendors: OpenSSL Products: OpenSSL Problem Types: NULL pointer dereference Description: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not a
a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f). Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc - https://www.debian.org/security/2020/dsa-4661 - http://www.openwall.com/lists/oss-security/2020/04/22/2 - https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org
ttps://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E - https://security.gentoo.org/glsa/202004-10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/ - http://seclists.org/fulldisclosure/2020/May/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org
org/fulldisclosure/2020/May/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.tenable.com/security/tns-2020-03 - https://www.openssl.org/news/secadv/20200421.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 - https://security.netapp.com/advisory/ntap-2020
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 - https://security.netapp.com/advisory/ntap-20200424-0003/ - https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL - https://github.com/irsl/CVE-2020-1967 - http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html - https://www.synology.com/security/advisory/Synology_SA_20_05 - https://www.tenable.com/security/tns-2020-04 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200717-0004/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.tenable.com/security/tns-2020-11 - https://www.oracle.com/
/www.oracle.com/security-alerts/cpujan2021.html - https://www.tenable.com/security/tns-2020-11 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-10 - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-1968 State: PUBLISHED Published: 2020-09-09T13:50:12.423004Z Last Updated: 2024-09-16T19:50:54.434Z Vendors: OpenSSL Products: OpenSSL Problem Types: Protocol flaw Description: The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not
mentation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v). Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20200909.txt - https://usn.ubuntu.com/4504-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://security.netapp.com/advisory/ntap-20200911-0004/ - https://www.oracle.com/security-a
ty-alerts/cpujan2021.html - https://security.netapp.com/advisory/ntap-20200911-0004/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.gentoo.org/glsa/202210-02
CVE ID: CVE-2020-1969 State: REJECTED Published: 2021-02-15T21:57:20 Last Updated: 2021-02-15T21:57:20 Description: No description available.
CVE ID: CVE-2020-1970 State: REJECTED Published: 2021-02-15T21:57:28 Last Updated: 2021-02-15T21:57:28 Description: No description available.
CVE ID: CVE-2020-1971 State: PUBLISHED Published: 2020-12-08T15:30:16.835255Z Last Updated: 2024-09-17T02:57:20.238Z Vendors: OpenSSL Products: OpenSSL Problem Types: NULL pointer dereference Description: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp funct
nce and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some appli
client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser wi
correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20201208.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d
1215ebf3f65e03d4d5d857fb9b666d6920 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e - https://www.debian.org/security/2020/dsa-4807 - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc - https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html - https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/ - https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E - https://lists.fedoraproject.org/ar
71711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/ - https://security.gentoo.org/glsa/202012-13 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.tenable.com/security/tns-2020-11 - https://security.netapp.com/advisory/ntap-20201218-0005/ - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676 - https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenab
4c109a49b750c%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-10 - https://www.tenable.com/security/tns-2021-09 - https://security.netapp.com/advisory/ntap-20210513-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - http://www.openwall.com/lists/oss-security/2021/09/14/2 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2020-1972 State: REJECTED Published: 2021-02-15T21:57:34 Last Updated: 2021-02-15T21:57:34 Description: No description available.
CVE ID: CVE-2020-1973 State: REJECTED Published: 2021-02-15T21:57:40 Last Updated: 2021-02-15T21:57:40 Description: No description available.
CVE ID: CVE-2020-1974 State: REJECTED Published: 2021-02-15T21:57:46 Last Updated: 2021-02-15T21:57:46 Description: No description available.
CVE ID: CVE-2020-1975 State: PUBLISHED Published: 2020-02-12T22:57:08.099602Z Last Updated: 2024-09-16T18:23:27.053Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-112 Description: Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. Additional Analyst Notes: - CVE Prog
This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-1975
CVE ID: CVE-2020-1976 State: PUBLISHED Published: 2020-02-12T22:57:08.144091Z Last Updated: 2024-09-17T01:51:07.142Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: GlobalProtect Problem Types: CWE-642 Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-1976
CVE ID: CVE-2020-1977 State: PUBLISHED Published: 2020-02-12T22:57:08.179851Z Last Updated: 2024-09-17T01:01:37.367Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Expedition Problem Types: CWE-352 Description: Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-1977 - htt
ditional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-1977 - https://www.tenable.com/security/research/tra-2020-11
CVE ID: CVE-2020-1978 State: PUBLISHED Published: 2020-04-08T18:41:58.205418Z Last Updated: 2024-09-16T22:35:22.462Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H) Vendors: Palo Alto Networks Products: VM-Series Plugin Problem Types: CWE-255 Description: TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting
ure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves. This issue affects VM Series Plugin versions before 1.0.9 for PAN-OS 9.0. This issue does not affect VM Series in non-HA configurations or on other cloud platforms. It does not affect hardware firewall appliances. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the tech support files with the credentials. We now filter and remove these credentials from all TechSupport files sent to us. The TechSupport files uploaded to Palo Alto Networks systems were on
credentials from all TechSupport files sent to us. The TechSupport files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-1978
CVE ID: CVE-2020-1979 State: PUBLISHED Published: 2020-03-11T18:58:21.177187Z Last Updated: 2024-09-17T00:10:53.810Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-134 Description: A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-O