Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s.apache.org/thread.html/r209de85beae4d257d27fc577e3a3e97039bdb4c2dc6f4a8e5a5a5811%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r0847c7eb78c8f9e87d5b841fbd5da52b2ad4b4345e04b51c30621d88%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r2237a27040b57adc2fcc5570bd530ad2038e67fcb2a3ce65283d3143%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r77c48cd851f60833df9a9c9c31f12243508e15d1b2a0961066d44fc6%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r4a62133ad01d5f963755021027a4cce23f76b8674a13860d2978c7c8%40%3Ccommits.tomee.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https
76b8674a13860d2978c7c8%40%3Ccommits.tomee.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153 - https://github.com/vt-middleware/cryptacular/issues/52 - https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://github.com/apereo/cas/pull/4685 - https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45 - https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75 - htt
b6c71d73341d4dde6b09a18eb46cfd6d45 - https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75 - https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101f
CVE ID: CVE-2020-7227 State: PUBLISHED Published: 2020-01-18T18:42:03 Last Updated: 2024-08-04T09:25:48.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, backup.asp, sys-power.asp, ifaces-wls.asp, ifaces-wls-pkt.asp, and ifaces-wls-pkt-adv.asp. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/westermo-source-code-disclousure-in.h
tes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/westermo-source-code-disclousure-in.html
CVE ID: CVE-2020-7228 State: PUBLISHED Published: 2020-01-22T14:10:31 Last Updated: 2024-08-04T09:25:48.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/calculated-fields-form/#developers - https://spider-security.co.uk/blog-cve-2020-7228 - https://wpvulndb.com/vulnerabilities/10043
CVE ID: CVE-2020-7229 State: PUBLISHED Published: 2020-01-21T16:16:15 Last Updated: 2024-08-04T09:25:48.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Simplejobscript.com SJS before 1.65. There is unauthenticated SQL injection via the search engine. The parameter is landing_location. The function is countSearchedJobs(). The file is _lib/class.Job.php. Additional Analyst Notes: - CVE Program Container: References: - https://simplejobscript.com - https://github.com/niteosoft/simplejobscript/issues/7
CVE ID: CVE-2020-7231 State: PUBLISHED Published: 2020-01-19T19:45:47 Last Updated: 2024-08-04T09:25:48.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/evoko-otra-sala-por-favor.html
CVE ID: CVE-2020-7232 State: PUBLISHED Published: 2020-01-19T19:45:39 Last Updated: 2024-08-04T09:25:48.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information (such as usernames and password hashes) via a WebSocket request, as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/evoko-otra-sala-por-favor.html
CVE ID: CVE-2020-7233 State: PUBLISHED Published: 2020-01-19T19:45:23 Last Updated: 2024-08-04T09:25:48.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME variable in the BC_Logon.swf file. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/kms-controls-backdoor-in-bacnet.html
CVE ID: CVE-2020-7234 State: PUBLISHED Published: 2020-01-19T20:03:16 Last Updated: 2024-08-04T09:25:48.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login to the super account). Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/ruckus-wireless-authenticated-stored.html
CVE ID: CVE-2020-7235 State: PUBLISHED Published: 2020-01-19T20:03:04 Last Updated: 2024-08-04T09:25:48.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cB3?ta= (profile title). Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/uhp-networks-multiple-reflected-xss-in.html
CVE ID: CVE-2020-7236 State: PUBLISHED Published: 2020-01-19T20:02:54 Last Updated: 2024-08-04T09:25:48.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section). Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/uhp-networks-multiple-reflected-xss-in.html
CVE ID: CVE-2020-7237 State: PUBLISHED Published: 2020-01-20T04:06:41 Last Updated: 2024-08-04T09:25:48.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/3201 - https://ctrsec.io/index.php/2020/01/25/cve-2020-7237-remote-code-execution-in-cacti-rrdtool/ - https:/
cti/issues/3201 - https://ctrsec.io/index.php/2020/01/25/cve-2020-7237-remote-code-execution-in-cacti-rrdtool/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUSOTOIEJKD2IWJHN7TY56TDZJQZJUVJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XLZAMGTW2OSIBLYLXWHQBGWP7M4DTRS7/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html - https://security.gentoo.org/glsa/202003-40 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html - http://lists.opensuse.org/opensuse-security-a
tp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
CVE ID: CVE-2020-7238 State: PUBLISHED Published: 2020-01-27T16:43:44 Last Updated: 2024-08-04T09:25:48.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869. Additional Analyst Notes: - CVE Program Container: References: - https://netty.io/news/ - https://github.com/jdordonezn/CVE-2020-72381/issues/1 - https://access.redhat.com/errata/RHSA-2020:0497 - https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html - https://lists.d
.redhat.com/errata/RHSA-2020:0497 - https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html - https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html - https://access.redhat.com/errata/RHSA-2020:0601 - https://access.redhat.com/errata/RHSA-2020:0606 - https://access.redhat.com/errata/RHSA-2020:0605 - https://access.redhat.com/errata/RHSA-2020:0567 - https://access.redhat.com/errata/RHSA-2020:0806 - https://access.redhat.com/errata/RHSA-2020:0811 - https://access.redhat.com/errata/RHSA-2020:0804 - https://access.redhat.com/errata/RHSA-2020:0805 - https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html - https://lists.fedoraproject.org/archives/list/package-ann
//lists.debian.org/debian-lts-announce/2020/09/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/ - https://www.debian.org/security/2021/dsa-4885 - https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7%40%3Ccommits.cassandra.apache.org%3E
CVE ID: CVE-2020-7239 State: PUBLISHED Published: 2020-01-21T04:17:15 Last Updated: 2024-08-04T09:25:48.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/conversation-watson/#developers - https://www.hooperlabs.xyz/disclosures/cve-2020-7239.php - https://wpvulndb.com/vulnerabilities/10035
CVE ID: CVE-2020-7240 State: PUBLISHED Published: 2020-01-20T19:27:51 Last Updated: 2024-08-28T13:28:59.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meinberg Lantime M300 and M1000 devices allow attackers (with privileges to configure a device) to execute arbitrary OS commands by editing the /config/netconf.cmd script (aka Extended Network Configuration). Note: According to the description, the vulnerability requires a fully authenticated super-user account using a webUI function that allows super users to edit a script supposed to execute OS commands. The given weakness enumeration (CWE-78) is not applicable in this case as it refers to abusing functions/input fields not
e given weakness enumeration (CWE-78) is not applicable in this case as it refers to abusing functions/input fields not supposed to be accepting OS commands by using 'Special Elements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/heinberg-lantime-m1000-rce.html - https://sku11army.blogspot.com/2020/01/meinberg-lantime-m1000-rce.html - https://wolke.meinberg.de/index.php/s/dKP3PKgFXS6sPRE#pdfviewer
CVE ID: CVE-2020-7241 State: PUBLISHED Published: 2020-01-20T19:44:28 Last Updated: 2024-08-04T09:25:48.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-database-backup/#developers - https://github.com/V1n1v131r4/Expl
ntainer: References: - https://wordpress.org/plugins/wp-database-backup/#developers - https://github.com/V1n1v131r4/Exploiting-WP-Database-Backup-WordPress-Plugin/blob/master/README.md - https://zeroauth.ltd/blog/2020/01/21/analysis-on-cve-2020-7241-misrepresenting-a-security-vulnerability/
CVE ID: CVE-2020-7242 State: PUBLISHED Published: 2020-01-20T21:56:46 Last Updated: 2024-08-04T09:25:48.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Diagnostics Trace Route page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.) Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech.html
CVE ID: CVE-2020-7243 State: PUBLISHED Published: 2020-01-20T21:56:33 Last Updated: 2024-08-04T09:25:49.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Fetch URL page and entering shell metacharacters in the URL field. (In some cases, authentication can be achieved with the comtech password for the comtech account.) Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/comtech-multiple-authenticated-rce-on.html
CVE ID: CVE-2020-7244 State: PUBLISHED Published: 2020-01-20T21:56:21 Last Updated: 2024-08-04T09:25:48.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and entering shell metacharacters in the Router IP Address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.) Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/comtech-multiple-authenticated-rce-on.html
CVE ID: CVE-2020-7245 State: PUBLISHED Published: 2020-01-23T22:47:11 Last Updated: 2024-08-04T09:25:48.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's username, but with white space inserted before and/or after the username. This will register the account with the same username as the victim. After initiating a password reset for the new account, CTFd will reset the victim's account pa
e username as the victim. After initiating a password reset for the new account, CTFd will reset the victim's account password due to the username collision. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CTFd/CTFd/pull/1218 - https://github.com/CTFd/CTFd/releases/tag/2.2.3
CVE ID: CVE-2020-7246 State: PUBLISHED Published: 2020-01-21T13:02:35 Last Updated: 2024-08-04T09:25:48.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/edit?usp=shari
Container: References: - https://docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/edit?usp=sharing - http://packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.html - http://packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.html - http://packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.html - http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html
CVE ID: CVE-2020-7247 State: PUBLISHED Published: 2020-01-29T15:53:18.000Z Last Updated: 2025-10-21T23:35:53.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openbsd.org/security.html - http://www
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openbsd.org/security.html - http://www.openwall.com/lists/oss-security/2020/01/28/3 - https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45 - http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html - https://seclists.org/bugtraq/2020/Jan/51 - https://www.debian.org/security/2020/dsa-4611 - http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html - https://www.kb.cert.org/vuls/id/390745 - http://seclists.org/fulldisclosure/2020/Jan/49 - http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-
//seclists.org/fulldisclosure/2020/Jan/49 - http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html - http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html - https://usn.ubuntu.com/4268-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/ - http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html
CVE ID: CVE-2020-7248 State: PUBLISHED Published: 2020-03-16T20:49:53 Last Updated: 2024-08-04T09:25:48.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openwrt/openwrt/commits/master - https://openwrt.org/advisory/2020-01-31-2 - https://openwrt.org/advisory/2020-01-31-2 - https://nvd.nist.gov/vuln/detail/CVE-2020-7248#range-4512438
CVE ID: CVE-2020-7249 State: PUBLISHED Published: 2020-01-21T00:23:04 Last Updated: 2024-08-04T09:25:48.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account). Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/smc-networks-stored-cross-site.html
CVE ID: CVE-2020-7250 State: PUBLISHED Published: 2020-04-15T12:45:14.302136Z Last Updated: 2024-09-16T17:18:05.249Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee LLC Products: McAfee Endpoint Security (ENS) Problem Types: CWE-59 Description: Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory. Additional Analyst Notes: - CVE Program Container: R
carefully creating symbolic links from the ENS log file directory. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10309
CVE ID: CVE-2020-7251 State: PUBLISHED Published: 2020-02-14T14:50:14 Last Updated: 2024-08-04T09:25:48.459Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: McAfee, LLC Products: Mcafee Endpoint Security (ENS) Problem Types: CWE-358 Description: Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10299
CVE ID: CVE-2020-7252 State: PUBLISHED Published: 2020-02-17T06:35:14 Last Updated: 2024-08-04T09:25:48.709Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: McAfee, LLC Products: Data Exchange Layer (DXL) Broker Problem Types: CWE-250 Description: Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10307
CVE ID: CVE-2020-7253 State: PUBLISHED Published: 2020-03-12T10:55:14.321278Z Last Updated: 2024-09-17T03:53:32.479Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: McAfee, LLC Products: McAfee Agent (MA) Problem Types: CWE-284 Description: Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protection via a McAfee supplied command-line utility. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10312
CVE ID: CVE-2020-7254 State: PUBLISHED Published: 2020-03-12T11:00:18.459320Z Last Updated: 2024-09-16T20:37:10.544Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: McAfee, LLC Products: McAfee Advanced Threat Defense (ATD) Problem Types: CWE-264, CWE-269 Description: Privilege Escalation vulnerability in the command line interface in McAfee Advanced Threat Defense (ATD) 4.x prior to 4.8.2 allows local users to execute arbitrary code via improper access controls on the sudo command. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10311
CVE ID: CVE-2020-7255 State: PUBLISHED Published: 2020-04-15T12:45:20.103026Z Last Updated: 2024-09-16T22:01:36.891Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L) Vendors: McAfee LLC Products: McAfee Endpoint Security (ENS) Problem Types: CWE-264 Description: Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface. Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration. Addi
Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10309