Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26408 State: PUBLISHED Published: 2020-12-11T04:01:26 Last Updated: 2024-08-04T15:56:04.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab CE/EE Problem Types: Information exposure in GitLab Description: A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/33563 - https://hackerone.com/reports/703894 - https://gitlab.com/gitlab-org/cves/-/blob/maste
itlab-org/gitlab/-/issues/33563 - https://hackerone.com/reports/703894 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26408.json
CVE ID: CVE-2020-26409 State: PUBLISHED Published: 2020-12-11T01:17:28 Last Updated: 2024-08-04T15:56:04.626Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab CE/EE Problem Types: Uncontrolled resource consumption in GitLab Description: A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/259626 - https://hackerone.com/reports/990461 - https://gitlab.com/gitlab-org/cves/-/blob/master/
ab-org/gitlab/-/issues/259626 - https://hackerone.com/reports/990461 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26409.json
CVE ID: CVE-2020-26411 State: PUBLISHED Published: 2020-12-11T04:09:00 Last Updated: 2024-08-04T15:56:03.962Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/260330 - https://gitlab.
yst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/260330 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26411.json
CVE ID: CVE-2020-26412 State: PUBLISHED Published: 2020-12-11T03:51:02 Last Updated: 2024-08-04T15:56:04.357Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab EE Problem Types: Information exposure in GitLab EE Description: Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/228670 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26412.json
CVE ID: CVE-2020-26413 State: PUBLISHED Published: 2020-12-11T03:47:34 Last Updated: 2024-08-04T15:56:04.703Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab CE/EE Problem Types: Information exposure in GitLab CE/EE Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/244275 - https://hackerone.com/reports/972355 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-2641
sues/244275 - https://hackerone.com/reports/972355 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json
CVE ID: CVE-2020-26414 State: PUBLISHED Published: 2021-01-15T15:15:18 Last Updated: 2024-08-04T15:56:04.447Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Incorrect regular expression in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/270199 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-
- https://gitlab.com/gitlab-org/gitlab/-/issues/270199 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26414.json
CVE ID: CVE-2020-26415 State: PUBLISHED Published: 2020-12-11T03:29:26 Last Updated: 2024-08-04T15:56:04.810Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/277337 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26415.json
CVE ID: CVE-2020-26416 State: PUBLISHED Published: 2020-12-11T03:34:03 Last Updated: 2024-08-04T15:56:04.341Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab EE Problem Types: Information exposure in GitLab EE Description: Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/244495 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26416.json
CVE ID: CVE-2020-26417 State: PUBLISHED Published: 2020-12-11T03:37:36 Last Updated: 2024-08-04T15:56:04.584Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab CE/EE Problem Types: Information exposure in GitLab Description: Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/282539 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26417.json
CVE ID: CVE-2020-26418 State: PUBLISHED Published: 2020-12-11T17:27:05 Last Updated: 2024-08-04T15:56:04.643Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Missing release of memory after effective lifetime in Wireshark Description: Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-16.html - https://gitlab.com/wireshark/wireshark/-/issues/16739 - https://gitlab.com/gitlab-org/cves/-/blob/mas
sec-2020-16.html - https://gitlab.com/wireshark/wireshark/-/issues/16739 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26418.json - https://security.gentoo.org/glsa/202101-12 - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHWDZPWQJMLK64VFDWJC5SEGPNH6Y72Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M75HYXU36SP6GHIDPHNZGJKEO6TX4C4Y/ - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-26419 State: PUBLISHED Published: 2020-12-11T17:17:07 Last Updated: 2024-08-04T15:56:04.280Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Missing release of memory after effective lifetime in Wireshark Description: Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-19.html - https://gitlab.com/wireshark/wireshark/-/issues/17032 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-2641
ps://gitlab.com/wireshark/wireshark/-/issues/17032 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26419.json - https://security.gentoo.org/glsa/202101-12 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHWDZPWQJMLK64VFDWJC5SEGPNH6Y72Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M75HYXU36SP6GHIDPHNZGJKEO6TX4C4Y/ - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-26420 State: PUBLISHED Published: 2020-12-11T17:20:55 Last Updated: 2024-08-04T15:56:04.825Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Missing release of memory after effective lifetime in Wireshark Description: Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-18.html - https://gitlab.com/wireshark/wireshark/-/issues/16994 - https://gitlab.com/gitlab-org/cves/-/blob/mast
ec-2020-18.html - https://gitlab.com/wireshark/wireshark/-/issues/16994 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26420.json - https://security.gentoo.org/glsa/202101-12 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHWDZPWQJMLK64VFDWJC5SEGPNH6Y72Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M75HYXU36SP6GHIDPHNZGJKEO6TX4C4Y/ - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-26421 State: PUBLISHED Published: 2020-12-11T17:25:09 Last Updated: 2024-08-04T15:56:04.704Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Buffer over-read in Wireshark Description: Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-17.html - https://gitlab.com/wireshark/wireshark/-/issues/16958 - https://gitlab.com/gitlab-org/cves/-/blob/master/2
020-17.html - https://gitlab.com/wireshark/wireshark/-/issues/16958 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26421.json - https://security.gentoo.org/glsa/202101-12 - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHWDZPWQJMLK64VFDWJC5SEGPNH6Y72Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M75HYXU36SP6GHIDPHNZGJKEO6TX4C4Y/ - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-26422 State: PUBLISHED Published: 2020-12-21T17:15:13 Last Updated: 2024-08-04T15:56:04.417Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Buffer copy without checking size of input ('classic buffer overflow') in Wireshark Description: Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-20.html - https://gitlab.com/wireshark/wireshark/-/issues/17073 - https://gitlab.com/gitlab-org/cves/-/blob/
pa-sec-2020-20.html - https://gitlab.com/wireshark/wireshark/-/issues/17073 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26422.json - https://security.gentoo.org/glsa/202101-12 - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-26505 State: PUBLISHED Published: 2020-11-05T16:57:01 Last Updated: 2024-08-04T15:56:04.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.
sets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.marmind.com/en/ - https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1
CVE ID: CVE-2020-26506 State: PUBLISHED Published: 2020-11-05T15:04:01 Last Updated: 2024-08-04T15:56:04.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI. Additional Analyst Notes: - CVE Program Container: References: - https://www.marmind.com/en/ - https://www2.deloitte.com/de/de/pages/risk/articles/marmind-authorization-bypass.html
CVE ID: CVE-2020-26507 State: PUBLISHED Published: 2020-11-05T17:09:03 Last Updated: 2024-08-04T15:56:04.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into the “Description” field under the “Insert To-Do” option. Other users might download this data, for example a CSV file, and execute the malicious commands on their computer by opening the file using a software such as Microsoft Excel.
ile, and execute the malicious commands on their computer by opening the file using a software such as Microsoft Excel. The attacker could gain remote access to the user’s PC. Additional Analyst Notes: - CVE Program Container: References: - https://www.marmind.com/en/ - https://www2.deloitte.com/de/de/pages/risk/articles/marmind-csv-injection.html
CVE ID: CVE-2020-26508 State: PUBLISHED Published: 2020-11-16T18:49:16 Last Updated: 2024-08-04T15:56:04.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/
CVE ID: CVE-2020-26509 State: PUBLISHED Published: 2020-11-16T18:54:20 Last Updated: 2024-08-04T15:56:04.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt
CVE ID: CVE-2020-26510 State: PUBLISHED Published: 2020-11-16T18:56:01 Last Updated: 2024-08-04T15:56:04.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resultant remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt
CVE ID: CVE-2020-26511 State: PUBLISHED Published: 2020-10-02T04:04:01 Last Updated: 2024-08-04T15:56:04.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://www.wpo365.com/change-log/ - https://plugins.trac.wordpress.org/changeset/2388992/ - https://wordpress.org/plugins/wpo365-login/#developers - https://wpvulndb.com/vulnerabilities/10418
CVE ID: CVE-2020-26513 State: PUBLISHED Published: 2020-12-07T15:26:25 Last Updated: 2024-08-04T15:56:04.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks. Additional Analyst Notes: - CVE Program Container: References: - https://intland.com/codebeamer/application-lifecycle-management/ - https://compass-security.com/fileadmin/Research/Advisories/2020-09_CSNC-2020-008_Intland_codeBeamer_ALM_XXE.txt
CVE ID: CVE-2020-26515 State: PUBLISHED Published: 2021-06-08T12:47:42 Last Updated: 2024-08-04T15:56:04.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key. Additional Analyst Notes: - CVE Program Container: References: - https://intland.com/codebeamer/application-lifecycle-management/ - https://www.compass-security.com/fileadmin/Research/Advisories/2021-09_CSNC-20
eamer/application-lifecycle-management/ - https://www.compass-security.com/fileadmin/Research/Advisories/2021-09_CSNC-2020-010-codebeamer_ALM_Insecure-RememberMe.txt
CVE ID: CVE-2020-26516 State: PUBLISHED Published: 2021-06-08T12:28:19 Last Updated: 2024-08-04T15:56:04.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application through crafted requests. Additional Analyst Notes: - CVE Program Container: References: - https://intland.com/codebeamer/application-lifecycle-management/ - https://www.compass-security.com/fileadmin/Research/Advisories/2021-08_CSNC-20
eamer/application-lifecycle-management/ - https://www.compass-security.com/fileadmin/Research/Advisories/2021-08_CSNC-2020-009-codebeamer_ALM_Missing-CSRF.txt
CVE ID: CVE-2020-26517 State: PUBLISHED Published: 2021-06-08T12:42:17 Last Updated: 2024-08-04T15:56:04.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project (Authn users), using the users import functionality (Admin only), and changing the login text in the application configuration (Admin only). Additional Analyst Notes: - CVE Program Container: References: - https://intland.com/codebeamer/application-lifecycle-management/ - https://www.compass-security.com/fileadmin/Research/A
https://intland.com/codebeamer/application-lifecycle-management/ - https://www.compass-security.com/fileadmin/Research/Advisories/2021-10_CSNC-2020-012-codebeamer_ALM_XSS.txt
CVE ID: CVE-2020-26518 State: PUBLISHED Published: 2020-10-02T04:31:27 Last Updated: 2024-08-04T15:56:04.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained
CVE ID: CVE-2020-26519 State: PUBLISHED Published: 2020-10-02T05:34:12 Last Updated: 2024-08-04T15:56:04.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=702937 - http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=af1e390a2c7abceb32676ec684cd1dbb92907ce8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOF4PX2A5TGKKPMXINADSOJJ4H5UUMKK/ - https://lists.fedoraproject.org/archives/lis
ounce%40lists.fedoraproject.org/message/SOF4PX2A5TGKKPMXINADSOJJ4H5UUMKK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJMBKWVY7ZBIQV3EU5YHEFH5XWV4PABG/ - https://www.debian.org/security/2020/dsa-4794 - https://lists.debian.org/debian-lts-announce/2021/03/msg00012.html - https://security.gentoo.org/glsa/202105-30
CVE ID: CVE-2020-26521 State: PUBLISHED Published: 2020-11-06T07:35:12 Last Updated: 2024-08-04T15:56:04.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nats-io/nats-server/commits/master - http://www.openwall.com/lists/oss-security/2020/11/02/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI/
CVE ID: CVE-2020-26522 State: PUBLISHED Published: 2020-10-09T06:44:27 Last Updated: 2024-08-04T15:56:04.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts. Additional Analyst Notes: - CVE Program Container: References: - https://detapos.co/ - https://demo.detapos.co.id/petshop/ - http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt - http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-26523 State: PUBLISHED Published: 2020-10-02T06:29:45 Last Updated: 2024-08-04T15:56:04.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Froala Editor before 3.2.2 allows XSS via pasted content. Additional Analyst Notes: - CVE Program Container: References: - https://froala.com/wysiwyg-editor/changelog/
CVE ID: CVE-2020-26524 State: PUBLISHED Published: 2020-10-02T06:58:58 Last Updated: 2024-08-04T15:56:04.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeLathe FileCloud before 20.2.0.11915 allows username enumeration. Additional Analyst Notes: - CVE Program Container: References: - https://www.getfilecloud.com/releasenotes/ - https://github.com/lukaszstu/filecloud-UE-CVE-2020-26524/blob/main/README.md - https://www.filecloud.com/releasenotes/