Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rogram Container: References: - https://usn.ubuntu.com/4467-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1808510 - https://www.debian.org/security/2020/dsa-4760
CVE ID: CVE-2020-12830 State: PUBLISHED Published: 2020-10-27T19:32:52 Last Updated: 2024-08-04T12:04:22.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114
CVE ID: CVE-2020-12831 State: PUBLISHED Published: 2020-05-13T17:42:36 Last Updated: 2024-08-04T12:04:22.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
before any sensitive information is present in the file Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1830805 - https://github.com/FRRouting/frr/pull/6383
CVE ID: CVE-2020-12832 State: PUBLISHED Published: 2020-05-13T17:52:37 Last Updated: 2024-08-04T12:04:22.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2302759 - https://wordpress.org/plugins/simple-file-list/#developers - https://ctulhu.me/2020/05/16/cve-2020-12832/
CVE ID: CVE-2020-12834 State: PUBLISHED Published: 2020-05-15T16:14:49 Last Updated: 2024-08-04T12:04:22.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup (or factory reset). Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2020-12834/
CVE ID: CVE-2020-12835 State: PUBLISHED Published: 2020-05-20T13:01:05 Last Updated: 2024-08-04T12:04:22.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - http://seclists.org/fulldisclosure/2020/May/38 - http://packetstormsecurity.com/files/157772/Protection-Licen
st-blog/ - http://seclists.org/fulldisclosure/2020/May/38 - http://packetstormsecurity.com/files/157772/Protection-Licensing-Toolkit-ReadyAPI-3.2.5-Code-Execution-Deserialization.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-039.txt
CVE ID: CVE-2020-12837 State: PUBLISHED Published: 2020-09-24T15:15:43 Last Updated: 2024-08-04T12:04:22.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must be used. Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12838 State: PUBLISHED Published: 2020-09-24T15:18:44 Last Updated: 2024-08-04T12:04:22.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php. Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12839 State: PUBLISHED Published: 2020-09-24T15:16:51 Last Updated: 2024-08-04T12:04:23.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php. Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12840 State: PUBLISHED Published: 2020-09-24T15:14:13 Last Updated: 2024-08-04T12:04:22.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12841 State: PUBLISHED Published: 2020-09-24T15:13:38 Last Updated: 2024-08-04T12:04:22.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12842 State: PUBLISHED Published: 2020-09-24T15:17:57 Last Updated: 2024-08-04T12:04:22.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php. Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12843 State: PUBLISHED Published: 2020-09-24T15:20:01 Last Updated: 2024-08-04T12:04:23.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV must be used. Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-12845 State: PUBLISHED Published: 2020-07-27T22:56:01 Last Updated: 2024-08-04T12:04:22.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cherokee/webserver/releases - http://cherokee-project.com/downloads.html - htt
ntainer: References: - https://github.com/cherokee/webserver/releases - http://cherokee-project.com/downloads.html - https://github.com/cherokee/webserver/issues/1242 - https://security.gentoo.org/glsa/202012-09
CVE ID: CVE-2020-12846 State: PUBLISHED Published: 2020-06-03T16:21:20 Last Updated: 2024-08-04T12:04:22.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution. Additional Analyst Notes: - CVE Program Containe
/zimbra/data/tmp/upload/, leaving it open to possible remote execution. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3
CVE ID: CVE-2020-12847 State: PUBLISHED Published: 2020-06-04T19:21:23 Last Updated: 2024-08-04T12:04:22.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is possible to configure a few engines to be used by the mailer application to send emails. If the user selects the “sendmail” option as the default one, the web application offers to edit the full path where the sendmail binary is hosted.
ndmail” option as the default one, the web application offers to edit the full path where the sendmail binary is hosted. Since there is no restriction in place while editing this value, an attacker authenticated as an administrator user could force the web application into executing any arbitrary binary. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12848 State: PUBLISHED Published: 2020-06-05T13:00:25 Last Updated: 2024-08-04T12:04:22.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed. Additional Analyst Notes: - CVE Progr
e actions that were not available with the public share link can now be performed. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12849 State: PUBLISHED Published: 2020-06-05T12:52:29 Last Updated: 2024-08-04T12:04:22.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-
-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12850 State: PUBLISHED Published: 2020-06-11T01:56:57 Last Updated: 2024-08-04T12:04:22.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the appliance, the user pydio is responsible for running all the services and binaries that are contained in the Pydio Cells web application package, such as mysqld, cells, among others. This user has privileges restricted to run those service
s web application package, such as mysqld, cells, among others. This user has privileges restricted to run those services and nothing more. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12851 State: PUBLISHED Published: 2020-06-04T19:17:30 Last Updated: 2024-08-04T12:04:22.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in the targeted user folders. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http:/
ity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12852 State: PUBLISHED Published: 2020-06-04T19:11:43 Last Updated: 2024-08-04T12:04:22.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating its checksum and signature with the provided public key and finally replacing the current application binary. To complete the update process, the application’s service or appliance needs to be restarted. An attacker with administrator a
plete the update process, the application’s service or appliance needs to be restarted. An attacker with administrator access can leverage the software update feature to force the application to download a custom binary that will replace current Pydio Cells binary. When the server or service is eventually restarted the attacker will be able to execute code under the privileges of the user running the application. In the Pydio Cells enterprise appliance this is with the privileges of the user named “pydio”. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulner
ps://www.coresecurity.com/advisories - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12853 State: PUBLISHED Published: 2020-06-04T19:07:19 Last Updated: 2024-08-04T12:04:22.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal folders or accessible cells. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities - http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE ID: CVE-2020-12854 State: PUBLISHED Published: 2020-07-15T19:04:14 Last Updated: 2024-08-04T12:04:22.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution vulnerability was identified in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can invoke code execution upon uploading a carefully crafted JPEG file as part of the profile avatar. Additional Analyst Notes: - CVE Program Container: References: - https://seczetta.com - http://packetstormsecurity.com/files/158434/SecZetta-NEProfile-3.3.11-Remote-Code-Execution.html
CVE ID: CVE-2020-12855 State: PUBLISHED Published: 2020-08-26T18:49:04 Last Updated: 2024-08-04T12:04:22.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/158965/SecZetta-NEProfile-3.3.11-Host-Header-Injection.html
CVE ID: CVE-2020-12856 State: PUBLISHED Published: 2020-05-18T03:35:36 Last Updated: 2024-08-04T12:04:22.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing - https://github.com/alwentiu/COVIDSafe-CVE-2020-12856/blob/master/README.md - https://covidsafe
VEC27U/edit?usp=sharing - https://github.com/alwentiu/COVIDSafe-CVE-2020-12856/blob/master/README.md - https://covidsafe.watch/issue-register/cve-2020-12856-long-term-tracking-and-possibly-enables-other-bluetooth-based-attack-vectors
CVE ID: CVE-2020-12857 State: PUBLISHED Published: 2020-05-18T04:02:31 Last Updated: 2024-08-04T12:04:22.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe. Additional Analyst Notes: - CVE Program Container: References: - https://www.health.gov.au/resources/apps-and-tools/covidsafe-app - https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing - https://covidsafe.watch/issue-register/cve-2020-12857-tempid-identifier-was-static
CVE ID: CVE-2020-12858 State: PUBLISHED Published: 2020-05-18T04:07:46 Last Updated: 2024-08-04T12:04:22.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons. Additional Analyst Notes: - CVE Program Container: References: - https://www.health.gov.au/resources/apps-and-tools/covidsafe-app - https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing
CVE ID: CVE-2020-12859 State: PUBLISHED Published: 2020-05-18T04:16:00 Last Updated: 2024-08-04T12:04:22.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by observing cleartext payload data. This allows re-identification of devices, especially less common phone models or those in low-density situations. Additional Analyst Notes: - CVE Program Container: References: - https://www.health.gov.au/resources/apps-and-tools/covidsafe-app - https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing
CVE ID: CVE-2020-12860 State: PUBLISHED Published: 2020-05-18T04:20:34 Last Updated: 2024-08-04T12:04:22.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name. Additional Analyst Notes: - CVE Program Container: References: - https://www.health.gov.au/resources/apps-and-tools/covidsafe-app - https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing
CVE ID: CVE-2020-12861 State: PUBLISHED Published: 2020-06-24T00:00:00 Last Updated: 2024-08-04T12:04:22.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080. Additional Analyst Notes: - CVE Program Container: References: - https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html - https://securitylab.github.com/advisories/GHSL-2020-075-libsane - https://usn.ubuntu.com/4470-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html - http://lists.opensuse.org/opensuse-secu
/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00003.html - http://packetstormsecurity.com/files/172841/SANE-Backends-Memory-Corruption-Code-Execution.html
CVE ID: CVE-2020-12862 State: PUBLISHED Published: 2020-06-24T12:52:54 Last Updated: 2024-08-04T12:11:19.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082. Additional Analyst Notes: - CVE Program Container: References: - https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html - https://securitylab.github.com/advisories/GHSL-2020-075-libsane - https://lists.debian.org/debian-lts-announce/2020/08/msg00029.html - https://usn.ubuntu.com/4470-1/ -
020-075-libsane - https://lists.debian.org/debian-lts-announce/2020/08/msg00029.html - https://usn.ubuntu.com/4470-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00003.html
CVE ID: CVE-2020-12863 State: PUBLISHED Published: 2020-06-24T12:52:51 Last Updated: 2024-08-04T12:11:18.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-083. Additional Analyst Notes: - CVE Program Container: References: - https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html - https://securitylab.github.com/advisories/GHSL-2020-075-libsane - https://lists.debian.org/debian-lts-announce/2020/08/msg00029.html - https://usn.ubuntu.com/4470-1/ -