Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
iner: References: - https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3 - https://learn.liferay.com/dxp/latest/en/system-administration/using-the-script-engine/running-scripts-from-the-script-console.html
CVE ID: CVE-2020-28885 State: PUBLISHED Published: 2022-01-28T11:17:38 Last Updated: 2024-08-04T16:41:00.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to access and execute commands in Gogo Shell and therefore not a design fla Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-porta
: - CVE Program Container: References: - https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3
CVE ID: CVE-2020-28895 State: PUBLISHED Published: 2021-02-03T15:16:34 Last Updated: 2024-08-04T16:41:00.095Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: n/a Problem Types: n/a Description: In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327 - https://support2.windriver.com/index.php?page=cve&on=
ort2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327 - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895 - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-28896 State: PUBLISHED Published: 2020-11-23T18:52:13 Last Updated: 2024-08-04T16:41:00.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/muttmua/mutt/-/commit/d92689088dfe80a290ec836e292376e2d9984f8f - https://g
m Container: References: - https://gitlab.com/muttmua/mutt/-/commit/d92689088dfe80a290ec836e292376e2d9984f8f - https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a - https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06 - https://github.com/neomutt/neomutt/releases/tag/20201120 - https://lists.debian.org/debian-lts-announce/2020/11/msg00048.html - https://security.gentoo.org/glsa/202101-32
CVE ID: CVE-2020-28898 State: PUBLISHED Published: 2021-04-15T18:03:16 Last Updated: 2024-08-04T16:40:59.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to insufficient input validation. Additional Analyst Notes: - CVE Program Container: References: - https://resourcexpress.atlassian.net/wiki/spaces/RSG/pages/1318289409/v2021.2+-+March+2021
CVE ID: CVE-2020-28899 State: PUBLISHED Published: 2021-03-16T16:17:06 Last Updated: 2024-08-04T16:41:00.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JSON action data to /cgi-bin/gui.cgi) to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi passphrase, send an SMS message, or modify the IP forwarding to access the internal network. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advisory-for-CGI-vulnerability-o
es: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advisory-for-CGI-vulnerability-of-LTE.shtml
CVE ID: CVE-2020-28900 State: PUBLISHED Published: 2021-05-24T12:43:22 Last Updated: 2024-08-04T16:40:59.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Esc
13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28901 State: PUBLISHED Published: 2021-05-24T12:43:27 Last Updated: 2024-08-04T16:40:59.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28902 State: PUBLISHED Published: 2021-05-24T12:43:33 Last Updated: 2024-08-04T16:41:00.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28903 State: PUBLISHED Published: 2021-05-24T12:43:39 Last Updated: 2024-08-04T16:40:59.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28904 State: PUBLISHED Published: 2021-05-24T12:43:44 Last Updated: 2024-08-04T16:41:00.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28905 State: PUBLISHED Published: 2021-05-24T12:43:48 Last Updated: 2024-08-04T16:40:59.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28906 State: PUBLISHED Published: 2021-05-24T12:43:53 Last Updated: 2024-08-04T16:40:59.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cr
vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28907 State: PUBLISHED Published: 2021-05-24T12:43:59 Last Updated: 2024-08-04T16:41:00.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-C
ll-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28908 State: PUBLISHED Published: 2021-05-24T12:44:04 Last Updated: 2024-08-04T16:40:59.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28909 State: PUBLISHED Published: 2021-05-24T12:44:10 Last Updated: 2024-08-04T16:41:00.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.h
http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28910 State: PUBLISHED Published: 2021-05-24T12:44:15 Last Updated: 2024-08-04T16:41:00.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28911 State: PUBLISHED Published: 2021-05-24T12:44:30 Last Updated: 2024-08-04T16:41:00.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-28912 State: PUBLISHED Published: 2020-12-24T19:49:20 Last Updated: 2024-08-04T16:41:00.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 10.3.
rs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other vendors that were originally affected by CVE-2019-2503. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-24040 - https://hackerone.com/reports/1019891
CVE ID: CVE-2020-28914 State: PUBLISHED Published: 2020-11-17T21:23:33 Last Updated: 2024-08-04T16:41:00.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kata-containers/ka
to be read-only. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kata-containers/kata-containers/pull/1062 - https://github.com/kata-containers/runtime/pull/3042 - https://github.com/kata-containers/runtime/pull/3051 - https://github.com/kata-containers/runtime/releases/tag/1.12.0 - https://github.com/kata-containers/runtime/releases/tag/1.11.5
CVE ID: CVE-2020-28915 State: PUBLISHED Published: 2020-11-18T07:59:42 Last Updated: 2024-08-04T16:40:59.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.15 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6735b4632def0640dbdf4eb9f99816aca18c4f16 - https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd - https://bugzilla.suse.com
16aca18c4f16 - https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd - https://bugzilla.suse.com/show_bug.cgi?id=1178886 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5af08640795b2b9a940c9266c0260455377ae262
CVE ID: CVE-2020-28916 State: PUBLISHED Published: 2020-12-04T06:22:37 Last Updated: 2024-08-04T16:41:00.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03185.html - http://www.openwall.com/lists/oss-security/2020/12/01/2 - https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-28917 State: PUBLISHED Published: 2020-11-18T08:16:34 Last Updated: 2024-08-04T16:40:59.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2020-019
CVE ID: CVE-2020-28918 State: PUBLISHED Published: 2021-02-16T19:57:39.000Z Last Updated: 2025-05-30T16:01:37.418Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: DualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the password, whereas an invalid one will produce an "unknown username" error message. Additional Analyst Notes: - CVE Program Container: References: - https://deepnetsecurity.com/multi-factor-authentication/ - https://excellium-services.com/cert-xlm-advisory/CVE-2020-28918 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28918
CVE ID: CVE-2020-28919 State: PUBLISHED Published: 2022-01-15T16:34:59 Last Updated: 2024-08-04T16:41:00.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/check_mk-werks.php?werk_id=11501 - https://github.com/tribe29/checkmk/commit/c00f450f884d8a229b7d8ab3f0452ed802a1ae04 - https://github.com/tribe29/checkmk/commit/e7fd8e4c90be490e4293ec91804d00ec01af5ca6 - https://emacsninja.com/posts/cve-2020-28919-s
thub.com/tribe29/checkmk/commit/e7fd8e4c90be490e4293ec91804d00ec01af5ca6 - https://emacsninja.com/posts/cve-2020-28919-stored-xss-in-checkmk-160p18.html
CVE ID: CVE-2020-28921 State: PUBLISHED Published: 2020-11-27T17:52:15 Last Updated: 2024-08-04T16:40:59.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This could lead to arbitrary Ring-0 code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eset/vulnerability-disclosures - http://www.pcanalyser.de/index.php/historie/ - https://github.com/eset/vulnerability-disclosures/blob/mast
disclosures - http://www.pcanalyser.de/index.php/historie/ - https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-28921/CVE-2020-28921.md
CVE ID: CVE-2020-28922 State: PUBLISHED Published: 2020-11-27T17:51:00 Last Updated: 2024-08-04T16:41:00.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL functionality that allows low-privilege users to read and write arbitrary physical memory. This could lead to arbitrary Ring-0 code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eset/vulnerability-disclosures - https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-28922/CVE-2020-28922.md - http://www.pcanalyser.de/ind
://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-28922/CVE-2020-28922.md - http://www.pcanalyser.de/index.php/historie/
CVE ID: CVE-2020-28923 State: PUBLISHED Published: 2020-12-03T16:21:31 Last Updated: 2024-08-04T16:41:00.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON. Additional Analyst Notes: - CVE Program Container: References: - https://www.playframework.com/security/vulnerability - https://www.playframework.com/security/vulnerability/CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeS
ility - https://www.playframework.com/security/vulnerability/CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeStorageorTransfer
CVE ID: CVE-2020-28924 State: PUBLISHED Published: 2020-11-19T19:32:41 Last Updated: 2024-08-04T16:41:00.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password len
data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed. Additional Analyst Notes: - CVE Program Container: References: - https://rclone.org/downloads/ - https://github.com/rclone/rclone/issues/4783 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJIFT24Q6EFXLQZ24AER2QGFFZLMIPCD/ - https://security.gentoo.org/glsa/202107-14
CVE ID: CVE-2020-28925 State: PUBLISHED Published: 2020-12-30T18:47:18 Last Updated: 2024-08-04T16:41:00.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bolt/bolt/commit/c0cd530e78c2a8c6d71ceb75b10c251b39fb923a - https://github.com/bolt/bolt/compare/3.7.1...3.7.2
CVE ID: CVE-2020-28926 State: PUBLISHED Published: 2020-11-30T17:09:40 Last Updated: 2024-08-04T16:40:59.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/minidlna/ - https://www.rootshellsecurity.net/remote-heap-corruption-bug-discovery-minidlna/ - https://www.debian.org/security/2020/dsa-4806 - https://lists.debian.org/debian-lt