Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13777 State: PUBLISHED Published: 2020-06-04T07:01:07 Last Updated: 2024-08-04T12:25:16.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. Additional Analyst Notes: - CVE Program Container: References: - https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03 - https://www.deb
otes: - CVE Program Container: References: - https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03 - https://www.debian.org/security/2020/dsa-4697 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMB3UGI5H5RCFRU6OGRPMNUCNLJGEN7Y/ - https://security.gentoo.org/glsa/202006-01 - https://usn.ubuntu.com/4384-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DS
//lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DSJHK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RTXZOXC4MHTFE2HKY6IAZMF2WHD2WMV/ - https://security.netapp.com/advisory/ntap-20200619-0004/
CVE ID: CVE-2020-13778 State: PUBLISHED Published: 2020-10-19T12:54:26 Last Updated: 2024-08-04T12:25:16.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2020100091 - https://github.com/theguly/exploits/blob/master/CVE-2020-13778.py - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
CVE ID: CVE-2020-13782 State: PUBLISHED Published: 2020-06-03T16:23:19 Last Updated: 2024-08-04T12:25:16.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174 - https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/
CVE ID: CVE-2020-13783 State: PUBLISHED Published: 2020-06-03T16:23:09 Last Updated: 2024-08-04T12:25:16.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174 - https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/
CVE ID: CVE-2020-13784 State: PUBLISHED Published: 2020-06-03T16:23:00 Last Updated: 2024-08-04T12:25:16.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174 - https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/
CVE ID: CVE-2020-13785 State: PUBLISHED Published: 2020-06-03T16:22:52 Last Updated: 2024-08-04T12:25:16.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174 - https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/
CVE ID: CVE-2020-13786 State: PUBLISHED Published: 2020-06-03T16:22:45 Last Updated: 2024-08-04T12:25:16.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174 - https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/
CVE ID: CVE-2020-13787 State: PUBLISHED Published: 2020-06-03T16:22:36 Last Updated: 2024-08-04T12:25:16.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174 - https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/
CVE ID: CVE-2020-13788 State: PUBLISHED Published: 2020-07-15T20:04:57 Last Updated: 2024-08-04T12:25:16.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/goharbor/harbor/releases - https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788 - https://www.youtube.com/watch?v=v8Isqy4yR3Q
CVE ID: CVE-2020-13790 State: PUBLISHED Published: 2020-06-03T18:56:05 Last Updated: 2024-08-04T12:25:16.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433 - https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a - https://usn.ubuntu.com/4386-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/ - https://l
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html - https://security.gentoo.org/glsa/202010-03
CVE ID: CVE-2020-13791 State: PUBLISHED Published: 2020-06-04T15:24:53 Last Updated: 2024-08-04T12:25:16.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00706.html - https://www.openwall.com/lists/oss-security/2020/06/04/1 - https://security.netapp.com/advisory/ntap-20200717-0001/ - https://security.gentoo.org/glsa/202011-09
CVE ID: CVE-2020-13792 State: PUBLISHED Published: 2020-06-03T19:32:45 Last Updated: 2024-08-04T12:25:16.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://blog.overfl0wed.com/web/lfi/info_disclosure/2020/03/30/PlayTube-LFI-to-Info-Disclosure-Writeup.html
CVE ID: CVE-2020-13793 State: PUBLISHED Published: 2020-08-06T18:56:12 Last Updated: 2024-08-04T12:25:16.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1 - https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite/
CVE ID: CVE-2020-13794 State: PUBLISHED Published: 2020-09-29T20:17:10 Last Updated: 2024-08-04T12:25:16.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/goharbor/harbor/releases - https://github.com/goharbor/harbor/security/advisories/GHSA-q9p8-33wc-h432 - https://www.cybereagle.io/blog/cve-2020-13794/
CVE ID: CVE-2020-13795 State: PUBLISHED Published: 2020-06-03T21:49:16 Last Updated: 2024-08-04T12:25:16.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/commit/88b41c7665ac7181be063b7a541dded7b207d9e7 - http://packetstormsecurity.com/files/157940/Navigate-CMS-2.8.7-Directory-Traversal.html
CVE ID: CVE-2020-13796 State: PUBLISHED Published: 2020-06-03T21:49:01 Last Updated: 2024-08-04T12:25:16.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4
CVE ID: CVE-2020-13797 State: PUBLISHED Published: 2020-06-03T21:48:53 Last Updated: 2024-08-04T12:25:16.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4
CVE ID: CVE-2020-13798 State: PUBLISHED Published: 2020-06-03T21:48:43 Last Updated: 2024-08-04T12:25:16.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4
CVE ID: CVE-2020-13799 State: PUBLISHED Published: 2020-11-18T21:12:40 Last Updated: 2024-08-04T12:25:16.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemented by storage devices from multiple vendors to assist host systems in securing trusted firmware. Several scenarios have been identified in which the RPMB state may be affected by an attacker without the knowledge of the trusted compo
s have been identified in which the RPMB state may be affected by an attacker without the knowledge of the trusted component that uses the RPMB feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/231329 - https://www.kb.cert.org/vuls/id/231329 - https://www.westerndigital.com/support/productsecurity/wdc-20008-replay-attack-vulnerabilities-rpmb-protocol-applications
CVE ID: CVE-2020-13800 State: PUBLISHED Published: 2020-06-04T15:23:08 Last Updated: 2024-08-04T12:25:16.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html - https://www.openwall.com/lists/oss-security/2020/06/04/2 - https://security.netapp.com/advisory/ntap-20200717-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html - https://usn.ubuntu.com/4467-1/ - h
-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html - https://usn.ubuntu.com/4467-1/ - https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800 - https://security.gentoo.org/glsa/202011-09
CVE ID: CVE-2020-13802 State: PUBLISHED Published: 2020-09-02T16:30:27 Last Updated: 2024-08-04T12:25:16.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/159027/Rebar3-3.13.2-Command-Injection.html - https://vuln.be/post/rebar3-command-injection/ - https://github.com/vulnbe/poc-rebar3.git
CVE ID: CVE-2020-13803 State: PUBLISHED Published: 2020-06-04T14:33:19 Last Updated: 2024-08-04T12:25:16.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows signature validation bypass via a modified file or a file with non-standard signatures. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13804 State: PUBLISHED Published: 2020-06-04T14:38:57 Last Updated: 2024-08-04T12:25:16.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plugin. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13805 State: PUBLISHED Published: 2020-06-04T14:40:22 Last Updated: 2024-08-04T12:25:16.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13806 State: PUBLISHED Published: 2020-06-04T14:47:20 Last Updated: 2024-08-04T12:25:16.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has a use-after-free because of JavaScript execution after a deletion or close operation. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13807 State: PUBLISHED Published: 2020-06-04T14:48:28 Last Updated: 2024-08-04T12:25:16.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has circular reference mishandling that causes a loop. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13808 State: PUBLISHED Published: 2020-06-04T14:53:00 Last Updated: 2024-08-04T12:25:16.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via crafted cross-reference stream data. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13809 State: PUBLISHED Published: 2020-06-04T14:50:21 Last Updated: 2024-08-04T12:25:16.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via long strings in the content stream. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13810 State: PUBLISHED Published: 2020-06-04T14:55:29 Last Updated: 2024-08-04T12:25:16.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature validation bypass via a modified file or a file with non-standard signatures. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13811 State: PUBLISHED Published: 2020-06-04T15:26:09 Last Updated: 2024-08-04T12:25:16.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Studio Photo before 3.6.6.922. It has an out-of-bounds write via a crafted TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13812 State: PUBLISHED Published: 2020-06-04T15:28:39 Last Updated: 2024-08-04T12:25:16.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13813 State: PUBLISHED Published: 2020-06-04T15:33:01 Last Updated: 2024-08-04T12:25:16.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto366_3.6.6.916.exe is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13814 State: PUBLISHED Published: 2020-06-04T15:36:36 Last Updated: 2024-08-04T12:25:16.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13815 State: PUBLISHED Published: 2020-06-04T15:37:14 Last Updated: 2024-08-04T12:25:16.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-13816 State: REJECTED Published: 2020-06-05T15:26:10 Last Updated: 2020-06-05T15:26:10 Description: No description available.
CVE ID: CVE-2020-13817 State: PUBLISHED Published: 2020-06-04T12:31:55.000Z Last Updated: 2025-05-05T17:07:58.872Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://
ictim's ntpd instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - https://security.gentoo.org/glsa/202007-12 - https://www.oracle.com/security-alerts/cpujan2022.html - http://support.ntp.org/bin/view/Main/NtpBug3596 - https://bugs.ntp.org/show_bug.cgi?id=3596 - https://security.netapp.com/advisory/ntap-20200625-0004/
CVE ID: CVE-2020-13818 State: PUBLISHED Published: 2020-06-04T12:51:17 Last Updated: 2024-08-04T12:25:16.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me-complete.html - https://www.zerodayinitiative.com/advisories/ZDI-20-691/
CVE ID: CVE-2020-13819 State: PUBLISHED Published: 2020-08-05T13:37:16 Last Updated: 2024-08-04T12:25:16.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://gtacknowledge.extremenetworks.com - https://gtacknowledge.extremenetworks.com/articles/Solution/000051136 - https://documentation.extremenetworks.com/release_notes/netsight/XMC_8.5.0_Release_Notes.pdf
CVE ID: CVE-2020-13820 State: PUBLISHED Published: 2020-08-03T16:22:57 Last Updated: 2024-08-04T12:25:16.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://gtacknowledge.extremenetworks.com - https://gtacknowledge.extremenetworks.com/articles/Solution/000051136 - https://documentation.extremenetworks.com/release_notes/netsight/XMC_8.5.0_Release_Notes.pdf - https://medium.com/%400x00crash/xss-reflected-in-extreme-management-center-8-4-1-24-cve-2020-13820-c6febe951219
CVE ID: CVE-2020-13821 State: PUBLISHED Published: 2020-08-26T15:23:46 Last Updated: 2024-08-04T12:25:16.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator's account of the Broker. Additional Analyst Notes: - CVE Program Container: References: - https://payatu.com/advisory/hivemq-mqtt-broker---xss-over-mqtt - https://www.hivemq.com/blog/hivemq-4-3-3-released/
CVE ID: CVE-2020-13822 State: PUBLISHED Published: 2020-06-04T14:01:53 Last Updated: 2024-08-04T12:25:16.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/elliptic - https://github.com/indutny/elliptic/issues/226 - https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/ - https://medium.com/%40herman_10687/malleability-attack-why-it-m
- https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/ - https://medium.com/%40herman_10687/malleability-attack-why-it-matters-7b5f59fb99a4