Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35124 State: PUBLISHED Published: 2021-01-28T05:37:56 Last Updated: 2024-08-04T16:55:10.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads. Additional Analyst Notes: - CVE Program Container: References: - https://forum.mautic.org/c/announcements/16 - https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 - https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce - https://github.com/mautic/mautic/security/advisories/GHSA-39wj-j
/www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce - https://github.com/mautic/mautic/security/advisories/GHSA-39wj-j3jc-858m
CVE ID: CVE-2020-35125 State: PUBLISHED Published: 2021-02-09T21:39:33 Last Updated: 2024-08-04T16:55:10.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept). Additional Analyst Notes: - CVE Program Container: References: - https://forum.mautic.org/c/announcements/16 - https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 - https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce - htt
-release-all-versions-mautic-prior-2-16-5-and-3-2-4 - https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce - https://github.com/mautic/mautic/security/advisories/GHSA-42q7-95j7-w62m
CVE ID: CVE-2020-35126 State: PUBLISHED Published: 2020-12-11T03:57:08 Last Updated: 2024-08-04T16:55:10.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48852
CVE ID: CVE-2020-35127 State: PUBLISHED Published: 2020-12-11T04:05:47 Last Updated: 2024-08-04T16:55:10.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://discourse.igniterealtime.org/t/openfire-4-6-0-has-stored-xss-vulnerabilities/89276
CVE ID: CVE-2020-35128 State: PUBLISHED Published: 2021-01-19T13:08:02 Last Updated: 2024-08-04T16:55:10.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system. Additional Analyst Notes: - CVE Program Container: References: - https://forum.mautic.org/c/announcem
tor to the system. Additional Analyst Notes: - CVE Program Container: References: - https://forum.mautic.org/c/announcements/16 - https://labs.bishopfox.com/advisories/mautic-version-3.2.2 - https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786
CVE ID: CVE-2020-35129 State: PUBLISHED Published: 2021-01-19T13:05:32 Last Updated: 2024-08-04T16:55:10.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account. Additional Analyst Notes: - CVE Program Container: Referen
role from a low-privileged user to an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://forum.mautic.org/c/announcements/16 - https://labs.bishopfox.com/advisories/mautic-version-3.2.2
CVE ID: CVE-2020-35131 State: PUBLISHED Published: 2021-01-08T16:09:06 Last Updated: 2024-08-04T16:55:10.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/agentejo/cockpit/releases/tag/0.6.1 - https://github.com/agentejo/cockpit/commits/next/lib/MongoLite/Database.php - https://www.exploit-db.com/exploits/49390
CVE ID: CVE-2020-35132 State: PUBLISHED Published: 2020-12-11T04:36:03 Last Updated: 2024-08-04T16:55:10.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1906474 - https://github.com/leenooks/phpLDAPadmin/commit/c87571f6b7be15d5cd8b26381b6eb31ad03d28e2 - https://github.com/leenooks/phpLDAPadmin/issues/130 - https://github.com/leenooks/phpLDAPadmin/compare/1.2.5
ad03d28e2 - https://github.com/leenooks/phpLDAPadmin/issues/130 - https://github.com/leenooks/phpLDAPadmin/compare/1.2.5...1.2.6.2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XA42XDSUPCOXL5ZCP5RGD3FD4JQQWNX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6PZH3EY2T66N2MGOA7DWCAIVYIJH4BC/
CVE ID: CVE-2020-35133 State: PUBLISHED Published: 2020-12-16T17:05:19 Last Updated: 2024-08-04T16:55:10.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: irfanView 4.56 contains an error processing parsing files of type .pcx. Which leads to out-of-bounds writing at i_view32+0xdb60. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/DmitriyMelikov - https://github.com/DmitryMeD/pentesting/blob/main/IrfanView%204.56.md
CVE ID: CVE-2020-35135 State: PUBLISHED Published: 2020-12-11T04:52:09 Last Updated: 2024-08-04T16:55:10.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2434070 - https://wordpress.org/plugins/ultimate-category-excluder/#developers - https://advisory.checkmarx.net/advisory/CX-2020-4294
CVE ID: CVE-2020-35136 State: PUBLISHED Published: 2020-12-23T14:39:49 Last Updated: 2024-08-04T16:55:10.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/releases - https://sourceforge.net/projects/dolibarr/ - http://bilishim.com/2020/12/18/zero-hunting-2.html - https://github.com/Dolibarr/dolibarr/commit/4fcd
ojects/dolibarr/ - http://bilishim.com/2020/12/18/zero-hunting-2.html - https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47ebcbac
CVE ID: CVE-2020-35137 State: PUBLISHED Published: 2021-03-29T00:00:00 Last Updated: 2024-08-04T16:55:10.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com/mobileiron/registration/RegisterActivity.java and can be used for api/v1/gateway/customers/servers requests. NOTE: Vendor states that this is an opt-in feature to the product - it is not enabled by default and customers cannot enable it without an explicit email to support. At this time, they do not plan chan
bled by default and customers cannot enable it without an explicit email to support. At this time, they do not plan change to make any changes to this feature. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US - https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration - https://github.com/optiv/rustyIron
CVE ID: CVE-2020-35138 State: PUBLISHED Published: 2021-03-29T19:36:38 Last Updated: 2024-08-04T16:55:10.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/deta
the MiTM attack Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US - https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration - https://github.com/optiv/rustyIron - https://www.ivanti.com/blog/a-warranted-response-to-inaccurate-optiv-research - https://www.optiv.com/insights/source-zero/blog/mobileiron-mdm-contains-static-key-allowing-account-enumeration
CVE ID: CVE-2020-35139 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:08:07.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OFPBundleCtrlMsg in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/faucetsdn/ryu/issues/118
CVE ID: CVE-2020-35141 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:02:49.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OFPQueueGetConfigReply in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/faucetsdn/ryu/issues/118
CVE ID: CVE-2020-35144 State: REJECTED Published: 2020-12-11T15:37:45 Last Updated: 2020-12-11T15:37:45 Description: No description available.
CVE ID: CVE-2020-35145 State: PUBLISHED Published: 2021-01-29T06:49:39 Last Updated: 2024-08-04T16:55:10.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Untrusted Search Path issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.acronis.com/en-us/products/true-image/ - https://www.acronis.com/en-us/support/updates/changes.html?p=42246
CVE ID: CVE-2020-35149 State: PUBLISHED Published: 2020-12-11T19:00:00 Last Updated: 2024-08-04T16:55:10.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aheckmann/mquery/commit/792e69fd0a7281a0300be5cade5a6d7c1d468ad4
CVE ID: CVE-2020-35151 State: PUBLISHED Published: 2020-12-21T20:20:54 Last Updated: 2024-08-04T16:55:10.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/ - https://www.exploit-db.com/exploits/49307
CVE ID: CVE-2020-35152 State: PUBLISHED Published: 2021-02-02T23:35:31.270649Z Last Updated: 2024-09-16T22:25:07.987Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cloudflare Products: Cloudflare WARP for Windows Problem Types: CWE-428 Description: Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, the vulnerability was fixed by adding quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1.
quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/advisories/security/advisories/GHSA-qc57-v5q8-f22h
CVE ID: CVE-2020-35153 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:04:47.125Z Description: No description available.
CVE ID: CVE-2020-35154 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:05:05.706Z Description: No description available.
CVE ID: CVE-2020-35155 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:01:11.505Z Description: No description available.
CVE ID: CVE-2020-35156 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:01:47.465Z Description: No description available.
CVE ID: CVE-2020-35157 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:02:46.455Z Description: No description available.
CVE ID: CVE-2020-35158 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:03:07.829Z Description: No description available.
CVE ID: CVE-2020-35159 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:04:09.282Z Description: No description available.
CVE ID: CVE-2020-35160 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:05:47.437Z Description: No description available.
CVE ID: CVE-2020-35161 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:05:55.315Z Description: No description available.
CVE ID: CVE-2020-35162 State: REJECTED Published: N/A Last Updated: 2024-06-21T00:06:02.824Z Description: No description available.
CVE ID: CVE-2020-35163 State: PUBLISHED Published: 2022-07-11T19:25:36.649710Z Last Updated: 2024-09-17T02:27:00.885Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-330 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Values Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabiliti
-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-35164 State: PUBLISHED Published: 2022-07-11T19:25:40.941373Z Last Updated: 2024-09-16T20:51:39.336Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-385 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities -
-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-35165 State: PUBLISHED Published: 2024-05-22T05:56:50.088Z Last Updated: 2024-08-04T16:55:10.956Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition, Dell BSAFE Micro Edition Suite Problem Types: CWE-208 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-
CVE ID: CVE-2020-35166 State: PUBLISHED Published: 2022-07-11T19:25:46.298334Z Last Updated: 2024-09-17T01:56:17.672Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: BSAFE Crypto-C Micro Edition, Dell BSAFE Micro Edition Suite Problem Types: CWE-385 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-
oc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities
CVE ID: CVE-2020-35167 State: PUBLISHED Published: 2022-07-11T19:25:51.197478Z Last Updated: 2024-09-16T20:36:20.648Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-200 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities -
CVE ID: CVE-2020-35168 State: PUBLISHED Published: 2022-07-11T19:25:57.203951Z Last Updated: 2024-09-16T16:33:23.108Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-311 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities -
CVE ID: CVE-2020-35169 State: PUBLISHED Published: 2022-07-11T19:26:03.078535Z Last Updated: 2024-09-16T17:37:40.623Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Dell Products: Dell BSAFE Crypto-C Micro Edition Problem Types: CWE-347 Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities -
CVE ID: CVE-2020-35170 State: PUBLISHED Published: 2021-01-05T21:40:26.349130Z Last Updated: 2024-09-17T04:04:45.256Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: Unisphere for PowerMax Problem Types: CWE-79 Description: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users’ sessions. Additional Analyst Notes: - CVE Program Container: R
ect javascript code and affect other authenticated users’ sessions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000181212
CVE ID: CVE-2020-35173 State: PUBLISHED Published: 2020-12-30T19:04:12 Last Updated: 2024-08-04T17:02:06.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER and services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER). Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.amaze.filemanager&hl=en_US&gl=US - https://github.com/TeamAmaze/AmazeFileManager/compare/v3.4.1...v3.4.2 - https://github.com/TeamAmaze/AmazeFileManager/pull/1815
CVE ID: CVE-2020-35175 State: PUBLISHED Published: 2020-12-11T22:10:40 Last Updated: 2024-08-04T17:02:06.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/pull/11237 - https://github.com/frappe/frappe/pull/11228
CVE ID: CVE-2020-35176 State: PUBLISHED Published: 2020-12-11T23:16:22 Last Updated: 2024-08-04T17:02:06.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eldy/awstats/issues/195 - https://lists.debian.org/debian-lts-announce/2020/12/msg00035.html - https://lists.fedoraproject.org/archives/list/package
tps://lists.debian.org/debian-lts-announce/2020/12/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHYCKLW5VPM6KP2WZW6DCCVHVBG7YCW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/
CVE ID: CVE-2020-35177 State: PUBLISHED Published: 2020-12-17T04:17:27 Last Updated: 2024-08-04T17:02:06.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161 - https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984