Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25834 State: PUBLISHED Published: 2020-11-17T00:51:31 Last Updated: 2024-08-04T15:40:37.000Z Vendors: Micro Focus Products: ArcSight Logger Problem Types: Cross-Site Scripting. Description: Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600 - https://www.cybereagle.io/blog/cve-2020-25834/
CVE ID: CVE-2020-25835 State: PUBLISHED Published: 2023-12-09T01:52:11.907Z Last Updated: 2024-08-04T15:40:36.993Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Micro Focus Products: ArcSight Management Center Problem Types: Stored XSS Description: A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-29/5037.ArcMC_5F00_RelNotes_5F00_2_2D00_9_2D00_6.pdf
CVE ID: CVE-2020-25836 State: PUBLISHED Published: 2024-07-16T21:21:27.986Z Last Updated: 2024-08-04T15:40:37.000Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: OpenText Products: NetIQ Directory and Resource Administrator Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Access vulnerability in OpenText NetIQ Directory and Resource Administrator. This issue affects NetIQ Directory and Resource Administrator versions prior to 10.0.2 and prior to 9.2.1 Patch 10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/directory-and-resource-administra
lnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/directory-and-resource-administrator-10/releasenotes_10.0.2/data/releasenotes_10.0.2.html#b149h4pv
CVE ID: CVE-2020-25837 State: PUBLISHED Published: 2020-11-05T20:21:03 Last Updated: 2024-08-04T15:40:36.943Z Vendors: n/a Products: Micro Focus Self Service Password Reset (SSPR) Problem Types: information leakage Description: Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p7/data/release-notes-sspr-44-p7.html
CVE ID: CVE-2020-25838 State: PUBLISHED Published: 2020-12-11T01:37:27 Last Updated: 2024-08-04T15:40:37.018Z Vendors: n/a Products: Filr Problem Types: Unauthorized disclosure of sensitive information Description: Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x versions. The vulnerability could be exploited to disclose unauthorized sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03767186
CVE ID: CVE-2020-25839 State: PUBLISHED Published: 2020-11-20T15:24:20 Last Updated: 2024-08-04T15:40:37.183Z Vendors: n/a Products: NetIQ Identity Manager Problem Types: Injection attack Description: NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1. Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html
CVE ID: CVE-2020-25840 State: PUBLISHED Published: 2021-03-26T13:41:51 Last Updated: 2024-08-04T15:40:36.945Z Vendors: n/a Products: Access Manager. Problem Types: Cross-Site scripting Description: Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction. Additional Analyst Notes: - CVE Program Container: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html
CVE ID: CVE-2020-25842 State: PUBLISHED Published: 2020-12-31T07:45:45.548262Z Last Updated: 2024-09-16T19:25:28.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CHANGING Inc. Products: NHIServiSignAdapter Problem Types: Arbitrary File Access Description: The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html
CVE ID: CVE-2020-25843 State: PUBLISHED Published: 2020-12-31T07:45:46.167437Z Last Updated: 2024-09-16T18:28:28.082Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CHANGING Inc. Products: NHIServiSignAdapter Problem Types: CWE-122 Description: NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html
CVE ID: CVE-2020-25844 State: PUBLISHED Published: 2020-12-31T07:45:46.812952Z Last Updated: 2024-09-16T16:53:50.623Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CHANGING Inc. Products: NHIServiSignAdapter Problem Types: CWE-121 Description: The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html
CVE ID: CVE-2020-25845 State: PUBLISHED Published: 2020-12-31T07:45:47.467391Z Last Updated: 2024-09-16T18:08:11.534Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CHANGING Inc. Products: NHIServiSignAdapter Problem Types: Information Leakage Description: Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html
CVE ID: CVE-2020-25846 State: PUBLISHED Published: 2020-12-31T07:45:48.074739Z Last Updated: 2024-09-17T01:41:45.846Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CHANGING Inc. Products: NHIServiSignAdapter Problem Types: Information Leakage Description: The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html
CVE ID: CVE-2020-25847 State: PUBLISHED Published: 2020-12-29T07:10:13.047777Z Last Updated: 2024-09-16T16:28:10.857Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-77, CWE-78 Description: This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-20
CVE ID: CVE-2020-25848 State: PUBLISHED Published: 2020-12-31T07:45:48.728303Z Last Updated: 2024-09-17T00:11:14.724Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: MailSherlock MSR45/SSR45 Problem Types: Broken Authentication Description: HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html
CVE ID: CVE-2020-25849 State: PUBLISHED Published: 2020-11-01T17:10:18.514022Z Last Updated: 2024-09-16T23:05:21.105Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Openfind Products: MailGates, MailAudit Problem Types: CWE-78 Description: MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4118-6292c-1.html
CVE ID: CVE-2020-25850 State: PUBLISHED Published: 2020-12-31T07:45:49.379478Z Last Updated: 2024-09-16T20:36:52.413Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: MailSherlock MSR45/SSR45 Problem Types: Arbitrary File Download Description: The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html
CVE ID: CVE-2020-25853 State: PUBLISHED Published: 2021-02-03T16:49:20 Last Updated: 2024-08-04T15:49:05.426Z Vendors: n/a Products: Realtek RTL8195A Wi-Fi Module Problem Types: CWE-126 Description: The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, _rt_md5_hmac_veneer() or _rt_hmac_sha1_veneer(), resulting in a stack buffer over-read which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the
vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE ID: CVE-2020-25854 State: PUBLISHED Published: 2021-02-03T16:49:08 Last Updated: 2024-08-04T15:49:05.429Z Vendors: n/a Products: Realtek RTL8195A Wi-Fi Module Problem Types: CWE-121 Description: The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, rt_arc4_crypt_veneer() or _AES_UnWRAP_veneer(), resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attack
an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE ID: CVE-2020-25855 State: PUBLISHED Published: 2021-02-03T16:49:05 Last Updated: 2024-08-04T15:49:05.976Z Vendors: n/a Products: Realtek RTL8195A Wi-Fi Module Problem Types: CWE-121 Description: The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for a memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to explo
t, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE ID: CVE-2020-25856 State: PUBLISHED Published: 2021-02-03T16:49:02 Last Updated: 2024-08-04T15:49:05.936Z Vendors: n/a Products: Realtek RTL8195A Wi-Fi Module Problem Types: CWE-121 Description: The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order
-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE ID: CVE-2020-25857 State: PUBLISHED Published: 2021-02-03T16:48:59 Last Updated: 2024-08-04T15:49:05.909Z Vendors: n/a Products: Realtek RTL8195A Wi-Fi Module Problem Types: CWE-121 Description: The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK. Additional Analyst
ting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE ID: CVE-2020-25858 State: PUBLISHED Published: 2020-10-15T15:11:50 Last Updated: 2024-08-04T15:49:06.010Z Vendors: n/a Products: Qualcomm QCMAP Problem Types: CWE-476 Description: The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return value of a strstr() or strchr() call in the Tokenizer() function. An attacker who invokes the web interface with a crafted URL can crash the process, causing denial of service. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers. Additional Analyst Notes: - CVE Program Container: References: - http://vdoo.com/blog/qualco
e hotspots and LTE routers. Additional Analyst Notes: - CVE Program Container: References: - http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities
CVE ID: CVE-2020-25859 State: PUBLISHED Published: 2020-10-15T15:12:56 Last Updated: 2024-08-04T15:49:06.305Z Vendors: n/a Products: Qualcomm QCMAP Problem Types: CWE-78 Description: The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers. Additional Analyst Notes: -
MAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers. Additional Analyst Notes: - CVE Program Container: References: - http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities
CVE ID: CVE-2020-25860 State: PUBLISHED Published: 2020-12-21T17:23:27 Last Updated: 2024-08-04T15:49:05.940Z Vendors: n/a Products: Pengutronix RAUC Problem Types: CWE-367 Description: The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv - https://www.vdoo.com/blog/cve-2020
References: - https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv - https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework
CVE ID: CVE-2020-25862 State: PUBLISHED Published: 2020-10-06T14:41:25 Last Updated: 2024-08-04T15:49:06.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changing the handling of the invalid 0xFFFF checksum. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-12.html - https://gitlab.com/wireshark/wireshark/-/issues/16816 - https://gitlab.com/wireshark/wireshark/-/commit/7f3fe6164a68b76d9988c4253b24d43f498f1753 - https://lists.fedoraproject.org/archives/list/package-
ark/wireshark/-/commit/7f3fe6164a68b76d9988c4253b24d43f498f1753 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.debian.org
urity-announce/2020-11/msg00038.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-25863 State: PUBLISHED Published: 2020-10-06T14:43:03 Last Updated: 2024-08-04T15:49:06.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of invalid MIME parts. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-11.html - https://gitlab.com/wireshark/wireshark/-/issues/16741 - https://gitlab.com/wireshark/wireshark/-/commit/5803c7b87b3414cdb8bf502af50bb406ca774482 - https://lists.fedoraproject.org/archives
lab.com/wireshark/wireshark/-/commit/5803c7b87b3414cdb8bf502af50bb406ca774482 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://li
g/opensuse-security-announce/2020-11/msg00038.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-25864 State: PUBLISHED Published: 2021-04-20T13:07:21 Last Updated: 2024-08-04T15:49:05.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 - https://security.gentoo.org/glsa/202208-09
CVE ID: CVE-2020-25866 State: PUBLISHED Published: 2020-10-06T14:42:38 Last Updated: 2024-08-04T15:49:06.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2020-13.html - https://gitlab.com/wireshark/wireshark/-/issues/16866 - https://gitlab.com/wireshark/wireshark/-/commit/4a948
-13.html - https://gitlab.com/wireshark/wireshark/-/issues/16866 - https://gitlab.com/wireshark/wireshark/-/commit/4a948427100b6c109f4ec7b4361f0d2aec5e5c3f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00
rg/opensuse-security-announce/2020-11/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html - https://www.oracle.com/security-alerts/cpujan2021.html
CVE ID: CVE-2020-25867 State: PUBLISHED Published: 2020-10-07T20:55:32 Last Updated: 2024-08-04T15:49:05.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thomasfady/CVE-2020-25867
CVE ID: CVE-2020-25868 State: PUBLISHED Published: 2021-07-07T13:42:38 Last Updated: 2024-08-04T15:49:06.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (temporary loss of service). Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/security_bulletins.htm - https://docs.pexip.com/admin/security_bulletins.htm#CVE-2020-25868
CVE ID: CVE-2020-25869 State: PUBLISHED Published: 2020-09-27T20:40:25 Last Updated: 2024-08-04T15:49:06.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T260485 - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html - https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor