Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: version 6.2.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2020/12/tibco-security-advisory-december-15-2020-tibco-partnerexpress
CVE ID: CVE-2020-27148 State: PUBLISHED Published: 2021-01-12T18:05:15.739048Z Last Updated: 2024-09-16T16:22:54.482Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: TIBCO Software Inc. Products: TIBCO EBX Add-ons Problem Types: The impact of these vulnerabilities include the possibility that an attacker would gain unauthorized read access to TIBCO EBX data, and the ability to cause a partial denial of service (partial DOS) on the affected system. Description: The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically
IBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity (XXE) attack. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.4.2 and below. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2021/01/tibco-security-advisory-january-12-2021-tibco-ebx - https://www.tibco.com/support/advisories/2021/01/tibco-security-advisory-january-12-2021-tibco-ebx-add-ons
CVE ID: CVE-2020-27149 State: PUBLISHED Published: 2021-05-14T11:13:37 Last Updated: 2024-08-04T16:11:35.514Z Vendors: n/a Products: NPort IA5000A Series with web console enabled Problem Types: Improper Access Control Description: By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console to have the device’s configuration changed. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-018%2C - https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerab
-018%2C - https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities
CVE ID: CVE-2020-27150 State: PUBLISHED Published: 2021-05-14T11:13:41 Last Updated: 2024-08-04T16:11:35.615Z Vendors: n/a Products: NPort IA5000A Series Problem Types: Unprotected Storage of Credentials Description: In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensitive data in the original form if “Pre-shared key” doesn’t set. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klc
5000a-serial-device-servers-vulnerabilities - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-019%2C
CVE ID: CVE-2020-27151 State: PUBLISHED Published: 2020-12-07T13:03:54 Last Updated: 2024-08-04T16:11:35.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on the worker nodes. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/katacontainers.io/+bug/1878234 - https://github.com/kata-containers/runtime/releases/tag/1.12.0 - https://github.com/kata-cont
ntainers.io/+bug/1878234 - https://github.com/kata-containers/runtime/releases/tag/1.12.0 - https://github.com/kata-containers/runtime/releases/tag/1.11.5 - https://github.com/kata-containers/kata-containers/releases/tag/2.0.0
CVE ID: CVE-2020-27152 State: PUBLISHED Published: 2020-11-06T07:46:08 Last Updated: 2024-08-04T16:11:35.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=208767 - http://www.openwall.com/lists/oss-security/2020/11/03/1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77377064c3a94911339f13ce113b3abf265e06da - https:
/git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77377064c3a94911339f13ce113b3abf265e06da - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.2
CVE ID: CVE-2020-27153 State: PUBLISHED Published: 2020-10-15T02:53:27 Last Updated: 2024-08-04T16:11:35.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bluez/bluez/commit/5a180f2ec9edfacafd95e5fed20d36fe8e077f07 - https://github.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a - https://bugzilla.redhat.com/show_bug.cgi?id=188481
hub.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a - https://bugzilla.redhat.com/show_bug.cgi?id=1884817 - https://lists.debian.org/debian-lts-announce/2020/10/msg00022.html - https://security.gentoo.org/glsa/202011-01 - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00036.html - https://www.debian.org/security/2021/dsa-4951
CVE ID: CVE-2020-27154 State: PUBLISHED Published: 2020-12-18T07:16:55 Last Updated: 2024-08-04T16:11:35.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gain access to user information by sending arbitrary code, due to improper input validation. A successful exploit could allow an attacker to view the user information and application data. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories
CVE ID: CVE-2020-27155 State: PUBLISHED Published: 2020-10-22T16:48:40 Last Updated: 2024-08-04T16:11:35.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy - https://github.com/OctopusDeploy/Issues/issues/6637 - https://github.com/OctopusDeploy/Issues/issues/6639 - https://github.com/OctopusDeploy/Issues/issues/6640
CVE ID: CVE-2020-27156 State: PUBLISHED Published: 2020-10-15T04:34:02 Last Updated: 2024-08-04T16:11:35.755Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS20-006#issue1
CVE ID: CVE-2020-27157 State: PUBLISHED Published: 2020-10-15T04:33:50 Last Updated: 2024-08-04T16:11:35.672Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server. An unauthenticated user could login to the application and gain access to the data and functionality accessible to the targeted user account. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS20-006#issue2
CVE ID: CVE-2020-27158 State: PUBLISHED Published: 2020-10-27T19:46:01 Last Updated: 2024-08-04T16:11:35.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity - https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 - https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
CVE ID: CVE-2020-27159 State: PUBLISHED Published: 2020-10-27T19:51:06 Last Updated: 2024-08-04T16:11:35.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Cloud NAS devices prior to 5.04.114 Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity - https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 - https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
CVE ID: CVE-2020-27160 State: PUBLISHED Published: 2020-10-27T19:41:01 Last Updated: 2024-08-04T16:11:35.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114 (issue 3 of 3). Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity - https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 - https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
CVE ID: CVE-2020-27163 State: PUBLISHED Published: 2020-10-16T02:06:50 Last Updated: 2024-08-04T16:11:35.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erikdubbelboer/phpRedisAdmin/commit/eddaa674536d2e76e6d0b4efeb00604e992eab8f
CVE ID: CVE-2020-27165 State: REJECTED Published: 2020-11-10T18:56:41 Last Updated: 2020-11-10T18:56:41 Description: No description available.
CVE ID: CVE-2020-27170 State: PUBLISHED Published: 2021-03-20T21:30:36 Last Updated: 2024-08-04T16:11:35.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 - https://www.openwall.com/lists/oss-security/2021/03/1
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 - https://www.openwall.com/lists/oss-security/2021/03/19/2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/ - http://www.openwall.com/lists/oss-security/2021/03/24/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
CVE ID: CVE-2020-27171 State: PUBLISHED Published: 2021-03-20T21:41:40 Last Updated: 2024-08-04T16:11:35.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 - https://www.openwall.com/lists/oss-security/2021/03/19/3 - htt
//cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 - https://www.openwall.com/lists/oss-security/2021/03/19/3 - https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=10d2bb2e6b1d8c4576c56a748f697dbeb8388899 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/ - http://www.openwall.com/lists/oss-security/2021/03/24/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/ - https://lists
t.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
CVE ID: CVE-2020-27172 State: PUBLISHED Published: 2020-12-28T20:26:00 Last Updated: 2024-08-04T16:11:35.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achieve arbitrary write that leads to elevation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.fortiguard.com/zeroday/FG-VD-20-120
CVE ID: CVE-2020-27173 State: PUBLISHED Published: 2020-10-16T03:58:57 Last Updated: 2024-08-04T16:11:35.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source (i.e., standard input). This behavior cannot be reproduced from the guest side. When no rate limiting is in place, the host can be subject to memory pressure, impacting all other VMs running on the same host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-vmm/vm-superio/issues/17 - https://github.com/rust-vmm/vm-superio/pull/19
CVE ID: CVE-2020-27174 State: PUBLISHED Published: 2020-10-16T04:06:54 Last Updated: 2024-08-04T16:11:35.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/firecracker-microvm/firecracker/issues/2177 - https://github.com/firecracker-microvm/firecracker/pull/2178 - https://github.com/firecracker-microvm/f
er/issues/2177 - https://github.com/firecracker-microvm/firecracker/pull/2178 - https://github.com/firecracker-microvm/firecracker/pull/2179 - http://www.openwall.com/lists/oss-security/2020/10/23/1
CVE ID: CVE-2020-27176 State: PUBLISHED Published: 2020-10-16T04:28:11 Last Updated: 2024-08-04T16:11:36.136Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it can also be considered an issue in the design of the "source code mode" feature, which parses HTML even though HTML support is not one of the primary advertised roles of the product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marktext/marktext/issues/2360
CVE ID: CVE-2020-27178 State: PUBLISHED Published: 2020-10-16T15:22:48 Last Updated: 2024-08-04T16:11:35.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication. Additional Analyst Notes: - CVE Program Container: References: - https://apereo.github.io/2020/10/14/gauthvuln/
CVE ID: CVE-2020-27179 State: PUBLISHED Published: 2020-10-27T04:21:46 Last Updated: 2024-08-04T16:11:35.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Oct/28 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE ID: CVE-2020-27180 State: PUBLISHED Published: 2020-10-27T04:21:30 Last Updated: 2024-08-04T16:11:35.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Oct/28 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE ID: CVE-2020-27181 State: PUBLISHED Published: 2020-10-27T04:21:35 Last Updated: 2024-08-04T16:11:35.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Oct/28 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE ID: CVE-2020-27182 State: PUBLISHED Published: 2020-10-27T04:21:39 Last Updated: 2024-08-04T16:11:35.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Oct/28 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE ID: CVE-2020-27183 State: PUBLISHED Published: 2020-10-27T04:21:42 Last Updated: 2024-08-04T16:11:35.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Oct/28 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE ID: CVE-2020-27184 State: PUBLISHED Published: 2021-05-14T12:06:15 Last Updated: 2024-08-04T16:11:35.819Z Vendors: n/a Products: NPort IA5000A Series with Telnet enabled Problem Types: Cleartext Transmission of Sensitive Information Description: The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities - https://ics-cert.kaspersky.com/advisories/klcert
security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-020%2C
CVE ID: CVE-2020-27185 State: PUBLISHED Published: 2021-05-14T12:06:20 Last Updated: 2024-08-04T16:11:35.824Z Vendors: n/a Products: NPort IA5000A Series with Moxa Service enabled Problem Types: Cleartext Transmission of Sensitive Information Description: Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data transmitted over Moxa Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-
er: References: - https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-021%2C
CVE ID: CVE-2020-27187 State: PUBLISHED Published: 2020-10-26T16:19:47 Last Updated: 2024-08-04T16:11:35.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related commands, while KDE Partition Manager is running. the mount command can then be used to gain full root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KDE/partitionmanager/compare/v4.1.0...v
itional Analyst Notes: - CVE Program Container: References: - https://github.com/KDE/partitionmanager/compare/v4.1.0...v4.2.0 - https://kde.org/info/security/advisory-20201017-1.txt - https://bugzilla.redhat.com/show_bug.cgi?id=1890199 - https://security.gentoo.org/glsa/202011-03
CVE ID: CVE-2020-27191 State: PUBLISHED Published: 2020-11-16T15:17:53 Last Updated: 2024-08-04T16:11:35.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - http://lionwiki.0o.cz/index.php?page=Main+page - https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi