Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26150 State: PUBLISHED Published: 2020-09-29T21:16:22 Last Updated: 2024-08-04T15:49:07.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function. Additional Analyst Notes: - CVE Program Container: References: - https://godofdarkness-msf.blogspot.com/2020/09/aware-callmanager-2012-php-info.html
CVE ID: CVE-2020-26153 State: PUBLISHED Published: 2021-07-13T10:44:57 Last Updated: 2024-08-04T15:49:07.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventespresso/event-espresso-core/compare/4.10.6.p...4.10.7.p - https://labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site
spresso-core/compare/4.10.6.p...4.10.7.p - https://labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site-scripting/
CVE ID: CVE-2020-26154 State: PUBLISHED Published: 2020-09-29T22:02:17 Last Updated: 2024-08-04T15:49:07.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libproxy/libproxy/pull/126 - https://bugs.debian.org/968366 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BID3HVHAF6DA3YJOFDBSAZSMR3ODNIW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr
sage/3BID3HVHAF6DA3YJOFDBSAZSMR3ODNIW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZVZXTFMFTSML3J6OOCDBDYH474BRJSW/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00033.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00024.html - https://www.debian.org/security/2020/dsa-4800
CVE ID: CVE-2020-26155 State: PUBLISHED Published: 2021-03-18T16:17:01 Last Updated: 2024-08-04T15:49:07.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for binaries to be manipulated by non-administrator users. Additionally, entries are made to the PATH environment variable which, in conjunction with these weak permissions, could enable an attacker to perform a DLL hijacking attack. Additional Analyst Notes: - CVE Program Container: References: - https://hsm.utimaco.com/products-hardware-security-modules/general-purpose-h
tes: - CVE Program Container: References: - https://hsm.utimaco.com/products-hardware-security-modules/general-purpose-hsm/ - https://secureyourit.co.uk/wp/2021/03/13/utimaco-cve-2020-26155/
CVE ID: CVE-2020-26156 State: REJECTED Published: 2020-10-27T17:57:56 Last Updated: 2020-10-27T17:57:56 Description: No description available.
CVE ID: CVE-2020-26157 State: PUBLISHED Published: 2020-09-30T03:35:52 Last Updated: 2024-08-04T15:49:07.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leanote/desktop-app/issues/353
CVE ID: CVE-2020-26158 State: PUBLISHED Published: 2020-09-30T03:35:35 Last Updated: 2024-08-04T15:49:07.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leanote/desktop-app/issues/353
CVE ID: CVE-2020-26159 State: REJECTED Published: 2020-09-30T12:41:13 Last Updated: 2021-02-02T20:16:32 Description: No description available.
CVE ID: CVE-2020-26160 State: PUBLISHED Published: 2020-09-30T12:57:10 Last Updated: 2024-08-04T15:49:07.136Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dgrijalva/jwt-go/pull/426 - https://snyk.io/
al Analyst Notes: - CVE Program Container: References: - https://github.com/dgrijalva/jwt-go/pull/426 - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
CVE ID: CVE-2020-26161 State: PUBLISHED Published: 2020-10-26T17:29:39 Last Updated: 2024-08-04T15:49:07.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy - https://github.com/OctopusDeploy/Issues/issues/6622 - https://github.com/OctopusDeploy/Issues/issues/6627
CVE ID: CVE-2020-26162 State: PUBLISHED Published: 2020-10-09T06:42:29 Last Updated: 2024-08-04T15:49:07.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com - https://securitydocs.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19Y_for_WorkCentre-EC7836-EC7856.pdf
CVE ID: CVE-2020-26163 State: PUBLISHED Published: 2020-09-30T15:28:54 Last Updated: 2024-08-04T15:49:07.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link. Additional Analyst Notes: - CVE Program Container: References: - https://www.sakshamanand.com/host-header-injection-bigbluebutton/ - https://github.com/bigbluebutton/greenlight/releases/tag/release-2.5.6 - https://github.com/bigbluebutton/greenlight/pull/1543
CVE ID: CVE-2020-26164 State: PUBLISHED Published: 2020-10-07T18:07:51 Last Updated: 2024-08-04T15:49:07.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack. Additional Analyst Notes: - CVE Program Container: References: - https://kdeconnect.kde.org/official/ - https://github.com/KDE/kdeconnect-kde/releases - https://bugzilla.suse.com/show_bug.cgi?id=1176268 - https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00014.html - https://github.com/KDE/kd
cgi?id=1176268 - https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00014.html - https://github.com/KDE/kdeconnect-kde/commit/ce0f00fc2d3eccb51d0af4eba61a4f60de086a59 - https://github.com/KDE/kdeconnect-kde/commit/542d94a70c56aa386c8d4d793481ce181b0422e8 - https://github.com/KDE/kdeconnect-kde/commit/613899be24b6e2a6b3e5cc719efce8ae8a122991 - https://github.com/KDE/kdeconnect-kde/commit/024e5f23db8d8ad3449714b906b46094baaffb89 - https://github.com/KDE/kdeconnect-kde/commit/4fbd01a3d44a0bcca888c49a77ec7cfd10e113d7 - https://github.com/KDE/kdeconnect-kde/commit/8112729eb0f13e6947984416118531078e65580d - https://kde.org/info/security/advisory-20201002-1.txt - http://lists.opensuse
8112729eb0f13e6947984416118531078e65580d - https://kde.org/info/security/advisory-20201002-1.txt - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00018.html - http://www.openwall.com/lists/oss-security/2020/10/13/5 - http://www.openwall.com/lists/oss-security/2020/10/13/4 - http://www.openwall.com/lists/oss-security/2020/10/14/1 - http://www.openwall.com/lists/oss-security/2020/11/30/1 - https://security.gentoo.org/glsa/202101-16
CVE ID: CVE-2020-26165 State: PUBLISHED Published: 2020-12-31T20:38:22 Last Updated: 2024-08-04T15:49:07.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used. Additional Analyst Notes: - CVE Program Container: References: - http://qdpm.net/qdpm-release-notes-free-project-management - http://packetstormsecurity.com/files/160733/qdPM-9.1-PHP-Object-Injection.html - http://seclists.org/fulldisclosure/2021/Jan/10
CVE ID: CVE-2020-26166 State: PUBLISHED Published: 2020-10-05T12:00:35 Last Updated: 2024-08-04T15:49:07.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task. Additional Analyst Notes: - CVE Program Container: References: - http://qdpm.net/qdpm-release-notes-free-project-management - https://sourceforge.net/projects/qdpm/ - https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md
CVE ID: CVE-2020-26167 State: PUBLISHED Published: 2020-11-04T16:39:21.000Z Last Updated: 2025-05-30T16:01:24.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/ - https://www.getfuelcms.com/ - https://github.com/daylightstudio/FUEL-CMS/ - https://thedaylightstudio.com/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167
CVE ID: CVE-2020-26168 State: PUBLISHED Published: 2020-11-09T21:28:39 Last Updated: 2024-08-04T15:49:07.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords. Additional Analyst Notes: - CVE Program Container: References: - https://docs.hazelcast.org/docs/ern/index.html#4-0-3 - https://jet-start.sh/blog/2020/10/23/jet-43-is-released - https://hazelcast.zendesk.com/hc/en-us/articles/360
ml#4-0-3 - https://jet-start.sh/blog/2020/10/23/jet-43-is-released - https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass - https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass
CVE ID: CVE-2020-26171 State: PUBLISHED Published: 2020-12-18T09:28:06 Last Updated: 2024-08-04T15:49:07.183Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26172 State: PUBLISHED Published: 2020-12-18T09:27:50 Last Updated: 2024-08-04T15:49:07.166Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26173 State: PUBLISHED Published: 2020-12-18T09:27:35 Last Updated: 2024-08-04T15:49:07.107Z Severity: LOW (CVSS 3.1 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid document ID and token. No further authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26174 State: PUBLISHED Published: 2020-12-18T09:27:18 Last Updated: 2024-08-04T15:49:07.156Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser (client-side) and can be circumvented. This allows an attacker to upload any file as an attachment to a workitem. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-m
Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26175 State: PUBLISHED Published: 2020-12-18T09:27:05 Last Updated: 2024-08-04T15:49:07.181Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26176 State: PUBLISHED Published: 2020-12-18T09:26:48 Last Updated: 2024-08-04T15:49:07.145Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to gather valid attachment IDs for workitems that do not belong to them. Additional Analyst Notes: - CVE Program Container: References: - https://www.ta
or workitems that do not belong to them. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26177 State: PUBLISHED Published: 2020-12-18T09:26:32 Last Updated: 2024-08-04T15:49:07.297Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibited server-side. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple
- CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26178 State: PUBLISHED Published: 2020-12-18T09:26:16 Last Updated: 2024-08-04T15:49:07.204Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated. Additional Analyst Notes: - CVE Program Container: References: - https://www.tangro.de/ - https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/
CVE ID: CVE-2020-26180 State: PUBLISHED Published: 2021-07-28T00:05:13.010485Z Last Updated: 2024-09-17T02:36:15.927Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-276 Description: Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account. A remote malicious user with low privileges may gain access to data stored on the /ifs directory through most protocols. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/546591/DSA-2020-225-Dell
tes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/546591/DSA-2020-225-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-OneFS-Security-Update-for-remotesuppor
CVE ID: CVE-2020-26181 State: PUBLISHED Published: 2021-01-05T21:40:22.043302Z Last Updated: 2024-09-16T18:12:49.554Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-269 Description: Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if they have ISI PRIV HARDENING privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/sec
HARDENING privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/546720/DSA-2020-227-Dell-EMC-PowerScale-OneFS-and-Dell-EMC-Isilon-OneFS-Security-Update-for-SmartLock-Co
CVE ID: CVE-2020-26182 State: PUBLISHED Published: 2020-10-16T18:10:17.357866Z Last Updated: 2024-09-16T20:28:03.773Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: Dell Products: NetWorker Problem Types: CWE-266 Description: Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote user with low privileges may exploit this vulnerability to perform 'saveset' related operations in an unintended manner. The vulnerability is not exploitable by users authenticated via LDAP. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/546616/DSA
nal Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities
CVE ID: CVE-2020-26183 State: PUBLISHED Published: 2020-10-16T18:10:17.753634Z Last Updated: 2024-09-16T17:38:59.166Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: Dell Products: NetWorker Problem Types: CWE-285 Description: Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulnerability to perform 'nsrmmdbd' operations in an unintended manner. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities
CVE ID: CVE-2020-26184 State: PUBLISHED Published: 2022-06-01T14:25:13.497993Z Last Updated: 2024-09-16T17:33:28.028Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Dell BSAFE Micro Edition Suite Problem Types: CWE-295 Description: Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/en-us/sln322935/dsa-2020-245-dell-bsafe-micro-edition-suite-multiple-vulnerabilities?lang=en - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-26185 State: PUBLISHED Published: 2022-06-01T14:25:14.948277Z Last Updated: 2024-09-17T00:20:55.880Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: Dell BSAFE Micro Edition Suite Problem Types: CWE-20 Description: Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/en-us/sln322935/dsa-2020-245-dell-bsafe-micro-edition-suite-multiple-vulnerabilities?lang=en - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-26186 State: PUBLISHED Published: 2021-01-08T18:55:13.689319Z Last Updated: 2024-09-17T02:26:57.793Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-642 Description: Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM). Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-
E Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerability
CVE ID: CVE-2020-26191 State: PUBLISHED Published: 2021-02-09T21:25:19.654194Z Last Updated: 2024-09-16T18:28:39.223Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-269 Description: Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job to grant themselves the highest level of RBAC privileges thus being able to read arbitrary data, tamper with system software or deny service to users. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000182873/dsa-202
itional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000182873/dsa-2021-009-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities