Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-24052 State: PUBLISHED Published: 2020-08-21T14:25:50 Last Updated: 2024-08-04T15:05:11.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition (DTD) in an XML request. Additional Analyst Notes: - CVE Program Container: References: - https://ioactive.com/moog-exo-series-multiple-vulnerabilities/ - https://ioac.tv/3hy1xu6
CVE ID: CVE-2020-24053 State: PUBLISHED Published: 2020-08-21T14:27:05 Last Updated: 2024-08-04T15:05:11.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols. Additional Analyst Notes: - CVE Program Container: References: - https://ioactive.com/moog-exo-series-multiple-vulnerabilities/ - https://ioac.tv/3hy1xu6
CVE ID: CVE-2020-24054 State: PUBLISHED Published: 2020-08-21T14:28:06 Last Updated: 2024-08-04T15:05:11.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments; however, this can be circumvented using special shell variables, such as '${IFS}'. As a result, an attacker can execute arbitrary commands as 'root' on the units. Additional Analyst Notes: - CVE Program Container: References: - https://
ute arbitrary commands as 'root' on the units. Additional Analyst Notes: - CVE Program Container: References: - https://ioactive.com/moog-exo-series-multiple-vulnerabilities/ - https://ioac.tv/3hy1xu6
CVE ID: CVE-2020-24055 State: PUBLISHED Published: 2020-08-21T14:29:22 Last Updated: 2024-08-04T15:05:11.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service implemented in the binary executable '/usr/sbin/DM' that listens on port TCP 6666. The service is vulnerable to a stack buffer overflow. It is worth noting that this service does not require any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/ - https://ioac.tv/2Nbc40h
CVE ID: CVE-2020-24056 State: PUBLISHED Published: 2020-08-21T14:30:26 Last Updated: 2024-08-04T15:05:11.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD Verint_FW_0_42units. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols. Additional Analyst Notes: - CVE Program Container: References: - https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/ - https://ioac.tv/2Nbc40h
CVE ID: CVE-2020-24057 State: PUBLISHED Published: 2020-08-21T14:31:41 Last Updated: 2024-08-04T15:05:11.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on the unit. This endpoint is vulnerable to a command injection. An authenticated attacker can leverage this issue to execute arbitrary commands as 'root'. Additional Analyst Notes: - CVE Program Container: References: - https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/ - https://ioac.tv/2Nbc40h
CVE ID: CVE-2020-24061 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-09-12T17:39:02.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40sadikul.islam/kasda-kw5515-cross-site-scripting-html-injection-e6cb9f65ae89?sk=5e1ea8e1cba8dbeaff7f9cd710808354 - https://github.com/0xadik/CVEs/tree/main/CVE-2020-24061
CVE ID: CVE-2020-24063 State: PUBLISHED Published: 2020-11-10T20:05:08 Last Updated: 2024-08-04T15:05:11.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CantoDAM/Canto-Wordpress-Plugin - https://www.canto.com/integrations/wordpress/ - https://wordpress.org/plugins/canto/#developers - https://gist.github.com/Hakooraevil/264cb21034f946eee62371e9111c36bb
CVE ID: CVE-2020-24074 State: PUBLISHED Published: 2020-09-09T14:02:15 Last Updated: 2024-08-04T15:05:11.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kn007/silk-v3-decoder/issues/62 - https://github.com/kn007/silk-v3-decoder/commit/d216599502662db01c07cc0dfd95ff1f1eaaea02
CVE ID: CVE-2020-24075 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T19:26:16.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.laborator.co/kb/kalium/kalium-changelog/#version-3-0-4-jun-23-2020
CVE ID: CVE-2020-24085 State: PUBLISHED Published: 2021-01-20T20:20:25 Last Updated: 2024-08-04T15:05:11.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/b3550b48f30ad9fef86c5b5c664487aaf6f52787
CVE ID: CVE-2020-24088 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:38:01.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MmMapIoSpace routine in Foxconn Live Update Utility 2.1.6.26, allows local attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://blog.rewolf.pl/blog/?p=1630 - http://dronesec.pw/blog/2018/05/17/dell-supportassist-local-privilege-escalation/ - https://github.com/rjt-gupta/CVE-2020-24088
CVE ID: CVE-2020-24089 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T14:56:22.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rjt-gupta/CVE-2020-24089
CVE ID: CVE-2020-24102 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-04T15:05:11.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/%40prizmant/hacking-punkbuster-e22e6cf2f36e
CVE ID: CVE-2020-24104 State: PUBLISHED Published: 2020-08-30T21:31:56 Last Updated: 2024-08-04T15:05:11.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wireless.htm SET2 parameter. Additional Analyst Notes: - CVE Program Container: References: - http://n0hat.blogspot.com/2020/07/stored-cross-site-scripting-xss-at-pix.html
CVE ID: CVE-2020-24113 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T19:55:53.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fuo.fi/CVE-2020-24113/
CVE ID: CVE-2020-24115 State: PUBLISHED Published: 2020-08-31T13:32:02 Last Updated: 2024-08-04T15:05:11.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40th3cyb3rc0p/cve-2020-24115-use-of-hardcoded-credentials-in-source-code-leads-to-admin-panel-access-77e5028ec9af - https://systemweakness.com/cve-2020-24115-use-of-hardcoded-credentials-in-source-code-leads-to-admin-panel-access-77e5028ec9af
CVE ID: CVE-2020-24119 State: PUBLISHED Published: 2021-05-14T20:32:49 Last Updated: 2024-08-04T15:05:11.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/upx/upx/issues/388 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSQRO7YC72PSYDQG4PQLQYXZTZE3B4YV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JE54WKVU7MATB4WZD3MJFBAHFRJ3NTQX/ - https://cwe.mitre.org/data/definitions/126.html
CVE ID: CVE-2020-24130 State: PUBLISHED Published: 2021-08-20T19:27:28 Last Updated: 2024-08-04T15:05:11.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ponzu-cms/ponzu/issues/352
CVE ID: CVE-2020-24133 State: PUBLISHED Published: 2021-07-14T21:18:39 Last Updated: 2024-08-04T15:05:11.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or carry out denial of service (DOS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/122.html - https://github.com/radareorg/radare2-extras/pull/255 - https://github.com/radareorg/radare2-extras/pull/255/commits/4a8b24475549ff10bdf6d07fd4b5f6c1cc6246ea - https://github.com/radareorg/radare2-extras/pull/255/commi
s/pull/255/commits/4a8b24475549ff10bdf6d07fd4b5f6c1cc6246ea - https://github.com/radareorg/radare2-extras/pull/255/commits/9f6a221433964d9b14f3ed78bc9fb059395b893b
CVE ID: CVE-2020-24135 State: PUBLISHED Published: 2021-04-07T15:01:34 Last Updated: 2024-08-04T15:05:11.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vedees/wcms/issues/9 - https://github.com/secwx/research/blob/main/cve/CVE-2020-24135.md
CVE ID: CVE-2020-24136 State: PUBLISHED Published: 2021-04-07T15:00:10 Last Updated: 2024-08-04T15:05:11.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vedees/wcms/issues/12 - https://github.com/secwx/research/blob/main/cve/CVE-2020-24136.md
CVE ID: CVE-2020-24137 State: PUBLISHED Published: 2021-04-07T15:05:46 Last Updated: 2024-08-04T15:05:11.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the path parameter to wex/cssjs.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vedees/wcms/issues/7 - https://github.com/secwx/research/blob/main/cve/CVE-2020-24137.md
CVE ID: CVE-2020-24138 State: PUBLISHED Published: 2021-04-07T14:57:36 Last Updated: 2024-08-04T15:05:11.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vedees/wcms/issues/10 - https://github.com/secwx/research/blob/main/cve/CVE-2020-24138.md
CVE ID: CVE-2020-24139 State: PUBLISHED Published: 2021-04-07T15:03:05 Last Updated: 2024-08-04T15:05:11.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vedees/wcms/issues/8 - https://github.com/secwx/research/blob/main/cve/CVE-2020-24139.md
CVE ID: CVE-2020-24140 State: PUBLISHED Published: 2021-04-07T15:04:33 Last Updated: 2024-08-04T15:05:11.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vedees/wcms/issues/11 - https://github.com/secwx/research/blob/main/cve/CVE-2020-24140.md
CVE ID: CVE-2020-24141 State: PUBLISHED Published: 2021-07-07T13:34:10 Last Updated: 2024-08-04T15:05:11.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services Additional Analyst Notes: - CVE Program Container: References: - https://github.com/secwx/research/blob/main/cve/CVE-2020-24141.md
CVE ID: CVE-2020-24142 State: PUBLISHED Published: 2021-07-07T13:35:05 Last Updated: 2024-08-04T15:05:11.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services Additional Analyst Notes: - CVE Program Container: References: - https://github.com/secwx/research/blob/main/cve/CVE-2020-24142.md
CVE ID: CVE-2020-24143 State: PUBLISHED Published: 2021-07-07T13:35:50 Last Updated: 2024-08-04T15:05:11.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/secwx/research/blob/main/cve/CVE-2020-24143.md
CVE ID: CVE-2020-24144 State: PUBLISHED Published: 2021-07-07T13:37:20 Last Updated: 2024-08-04T15:05:11.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation. Additional Analyst Notes: - CVE Program Container: References: - https://ru.wordpress.org/plugins/media-file-organizer/ - https://github.com/secwx/research/blob/main/cve/CVE-2020-24144.md
CVE ID: CVE-2020-24145 State: PUBLISHED Published: 2021-07-07T13:37:59 Last Updated: 2024-08-04T15:05:11.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cm-download-manager/#developers - https://github.com/secwx/research/blob/main/cve/CVE-2020-24145.md
CVE ID: CVE-2020-24146 State: PUBLISHED Published: 2021-07-07T13:38:45 Last Updated: 2024-08-04T15:05:11.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cm-download-manager/#developers - https://github.com/secwx/research/blob/main/cve/CVE-2020-24146.md
CVE ID: CVE-2020-24147 State: PUBLISHED Published: 2021-07-07T13:39:17 Last Updated: 2024-08-04T15:05:11.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-smart-import/#developers - https://github.com/secwx/research/blob/main/cve/CVE-2020-24147.md
CVE ID: CVE-2020-24148 State: PUBLISHED Published: 2021-07-07T13:39:54 Last Updated: 2024-08-04T15:05:11.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/import-xml-feed/#developers - https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md
CVE ID: CVE-2020-24149 State: PUBLISHED Published: 2021-07-07T13:40:46 Last Updated: 2024-08-04T15:05:11.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/podcast-importer-secondline/#developers - https://github.com/secwx/research/blob/main/cve/CVE-2020-24149.md
CVE ID: CVE-2020-24158 State: PUBLISHED Published: 2020-09-03T16:09:02 Last Updated: 2024-08-04T15:05:11.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: 360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. It is a dual-core browser owned by Beijing Qihoo Technology. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2105401
CVE ID: CVE-2020-24159 State: PUBLISHED Published: 2020-09-03T16:09:37 Last Updated: 2024-08-04T15:05:11.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions. This affects Guangzhou NetEase Youdao Dictionary 8.9.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2104833
CVE ID: CVE-2020-24160 State: PUBLISHED Published: 2020-09-03T16:10:07 Last Updated: 2024-08-04T15:05:11.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2105395
CVE ID: CVE-2020-24161 State: PUBLISHED Published: 2020-09-03T16:10:37 Last Updated: 2024-08-04T15:05:11.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2105403
CVE ID: CVE-2020-24162 State: PUBLISHED Published: 2020-09-03T16:11:19 Last Updated: 2024-08-04T15:05:11.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2105399
CVE ID: CVE-2020-24164 State: PUBLISHED Published: 2020-09-11T05:49:06 Last Updated: 2024-08-04T15:05:11.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ptaoussanis/nippy/issues/130
CVE ID: CVE-2020-24165 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-08-04T15:05:11.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/qemu/+bug/1863025 - https://pastebin.com/iqCbjdT8 - https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html - https://security.netapp.com/advisory/ntap-20231006-0012/
CVE ID: CVE-2020-24175 State: PUBLISHED Published: 2021-02-22T15:59:20 Last Updated: 2024-08-04T15:05:11.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows attackers to execute arbitrary code via a crafted archive file, related to filename handling. Additional Analyst Notes: - CVE Program Container: References: - http://yz1.com - https://gist.github.com/illikainen/315a420a9c28cbe882e16b8eba40b2e1 - https://gist.github.com/illikainen/ced14e08e00747fef613ba619bb25bb4 - https://illikainen.dev/advisories/014-yz1-izarc