Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ers/". Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04049en_us
CVE ID: CVE-2020-7197 State: PUBLISHED Published: 2020-10-26T15:09:19 Last Updated: 2024-08-04T09:25:48.146Z Vendors: n/a Products: HPE 3PAR StoreServ Management and Core Software Media Problem Types: remote authentication bypass Description: SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* Upgrade to HPE 3PAR StoreServ Management Console 3.7.1.1 or later. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hp
nt Console 3.7.1.1 or later. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04045en_us
CVE ID: CVE-2020-7198 State: PUBLISHED Published: 2020-11-06T14:14:04 Last Updated: 2024-08-04T09:25:48.555Z Vendors: n/a Products: HP OneView; HPE Synergy Composer; HPE Synergy Composer 2 Problem Types: remote escalation of privilege Description: There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to version 5.5 of OneView, Composer, or Composer2. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04047en_us
CVE ID: CVE-2020-7199 State: PUBLISHED Published: 2020-12-02T00:41:38 Last Updated: 2024-08-04T09:25:48.417Z Vendors: n/a Products: HPE Edgeline Infrastructure Management Software Problem Types: remote authentication bypass Description: A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/publi
e configuration. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04063en_us
CVE ID: CVE-2020-7200 State: PUBLISHED Published: 2020-12-18T22:14:48 Last Updated: 2024-08-04T09:25:48.917Z Vendors: n/a Products: HPE Systems Insight Manager (SIM) Problem Types: remote code execution Description: A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04068en_us - http://packetstormsecurity.com/files/161721/HPE-Systems-Insight-Manager-AMF-Deserialization-Remote-Code-Execution.html
CVE ID: CVE-2020-7201 State: PUBLISHED Published: 2020-12-18T22:20:30 Last Updated: 2024-08-04T09:25:47.861Z Vendors: n/a Products: HPE StoreEver MSL Tape Libraries; HPE StoreEver 1/8 G2 Tape Autoloaders Problem Types: remote cross-site request forgery (csrf) Description: A potential security vulnerability has been identified in the HPE StoreEver MSL2024 Tape Library and HPE StoreEver 1/8 G2 Tape Autoloaders. The vulnerability could be remotely exploited to allow Cross-site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04075en_us
CVE ID: CVE-2020-7202 State: PUBLISHED Published: 2021-01-05T14:08:28 Last Updated: 2024-08-04T09:25:48.181Z Vendors: n/a Products: HPE ProLiant Servers, Apollo Products, Converged Systems, and Synergy Compute Modules with Integrated Lights-Out 5 (iLO 5), or Integrated Lights-Out 4 (iLO 4) Problem Types: Remote disclosure of information Description: A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/disp
formation. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04069en_us
CVE ID: CVE-2020-7203 State: PUBLISHED Published: 2020-12-18T22:17:53 Last Updated: 2024-08-04T09:25:47.489Z Vendors: n/a Products: iLO Amplifier Pack Problem Types: remote code execution Description: A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70. The vulnerability could be exploited to allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04067en_us
CVE ID: CVE-2020-7205 State: PUBLISHED Published: 2020-07-30T17:27:10 Last Updated: 2024-08-04T09:25:48.501Z Vendors: n/a Products: HP Intelligent Provisioning, HPE ProLiant BL460c Gen9 Server Blade, HPE ProLiant BL660c Gen9 Server, HPE ProLiant DL180 Gen9 Server, HPE ProLiant DL60 Gen9 Server, HPE ProLiant DL80 Gen9 Server , HPE ProLiant ML110 Gen9 Server, HPE ProLiant ML150 Gen9 Server, HPE ProLiant XL740f Gen9 Server, HPE ProLiant XL750f Gen9 Server, HPE Apollo 4200 Gen9 Server, HPE ProLiant DL20 Gen9 Server, HPE ProLiant DL560 Gen9 Server, HPE ProLiant ML30 Gen9 Server, HPE ProLiant ML350 Gen9 Server, HPE ProLiant XL170r Gen9 Server, HPE ProLiant XL190r Gen9 Server, HPE ProLiant XL230a G
HPE ProLiant ML350 Gen9 Server, HPE ProLiant XL170r Gen9 Server, HPE ProLiant XL190r Gen9 Server, HPE ProLiant XL230a Gen9 Server, HPE ProLiant XL250a Gen9 Server, HPE ProLiant XL260a Gen9 Server, HPE ProLiant XL450 Gen9 Server, HPE ProLiant XL730f Gen9 Server, ProLiant SE2160w Gen9 Server, HPE ProLiant m510 Server Cartridge, HPE ProLiant m710x Server Blade, HPE ProLiant BL460c Gen10 Server Blade, HPE ProLiant DL360 Gen10 Server, HPE ProLiant DL380 Gen10 Server, HPE ProLiant DL560 Gen10 Server, HPE ProLiant DL580 Gen10 Server, HPE ProLiant ML110 Gen10 Server, HPE ProLiant MicroServer Gen10, HPE Synergy 480 Gen10 Compute Module, HPE Synergy 660 Gen10 Compute Module, HPE ProLiant DL180 Gen10
MicroServer Gen10, HPE Synergy 480 Gen10 Compute Module, HPE Synergy 660 Gen10 Compute Module, HPE ProLiant DL180 Gen10 Server, HPE ProLiant DL160 Gen10 Server, HPE ProLiant DL120 Gen10 Server, HPE ProLiant XL270d Gen9 Special Server, HPE ProLiant DL385 Gen10 Server, HPE Synergy 660 Gen9 Compute Module, HPE Synergy 480 Gen9 Compute Module, HPE ProLiant WS460c Gen9 Graphics Server Blade, HP ProLiant DL580 Gen8 Server, HPE Synergy 620 Gen9 Compute Module, HPE ProLiant ML350 Gen10 Server, HPE ProLiant DL580 Gen9 Server, HPE ProLiant DL360 Gen9 Server, HPE ProLiant XL170r Gen10 Server, HPE Cloudline CL2100 Gen10 Server, HPE Cloudline CL2200 Gen10 Server, HPE Cloudline CL3100 Gen9 Server, HPE Clo
Server, HPE Cloudline CL2100 Gen10 Server, HPE Cloudline CL2200 Gen10 Server, HPE Cloudline CL3100 Gen9 Server, HPE Cloudline CL3150 Gen10 Server (AMD), HPE ProLiant ML10 Gen9 Server, HPE ProLiant DL120 Gen9 Server, HPE ProLiant DL380 Gen9 Server, HPE Service Pack for ProLiant, HPE ProLiant DL160 Gen9 Server, HPE ProLiant XL270d Gen10 Server, HPE Cloudline CL5800 Gen9 Server, HPE Cloudline CL5200 Gen9 Server, HPE Cloudline CL4100 Gen10 Server, HPE Cloudline CL3100 Gen10 Server, HPE Apollo 4200 Gen10 Server, HPE ProLiant DL325 Gen10 Server, HPE ProLiant ML30 Gen10 Server, HPE ProLiant DL20 Gen10 Server, HPE StoreEasy 1000 Storage Gen9, HPE StoreEasy 1000 Storage Gen10, HPE SimpliVity 380 Gen
PE ProLiant DL20 Gen10 Server, HPE StoreEasy 1000 Storage Gen9, HPE StoreEasy 1000 Storage Gen10, HPE SimpliVity 380 Gen10, HPE SimpliVity 2600 Gen10, HPE Cloudline CL2600 Gen10 Server, HPE Cloudline CL2800 Gen10 Server, HPE ProLiant e910 Server Blade, HPE ProLiant m750 Server Blade, HPE ProLiant m710x-L Server Blade, HPE Cloudline CL5800 Gen10 Server, HPE ProLiant MicroServer Gen10 Plus, HPE ProLiant XL450 Gen10 Server, HPE ProLiant XL230k Gen10 Server, HPE ProLiant XL190r Gen10 Server, HPE SmartStart Scripting Toolkit Software, HPE Apollo 2000 Gen10 Plus System, HPE ProLiant DL385 Gen10 Plus server, HPE ProLiant DL325 Gen10 Plus server, HPE ProLiant DX385 Gen10 Plus server, HPE ProLiant XL
ant DL385 Gen10 Plus server, HPE ProLiant DL325 Gen10 Plus server, HPE ProLiant DX385 Gen10 Plus server, HPE ProLiant XL220n Gen10 Plus Server, HPE ProLiant XL290n Gen10 Plus Server, HPE Synergy 480 Gen10 Plus Compute Module, HPE ProLiant XL925g Gen10 Plus 1U 4-node Configure-to-order Server, HPE ProLiant e910t Server Blade Problem Types: local arbitrary code execution Description: A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability could be locally exploited to allow arbitrary code execution during the boot process. **Note:** This vulnerability is related to using insmod in GRUB2 in t
arbitrary code execution during the boot process. **Note:** This vulnerability is related to using insmod in GRUB2 in the specific impacted HPE product and HPE is addressing this issue. HPE has made the following software updates and mitigation information to resolve the vulnerability in Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. HPE provided latest Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting Toolkit which includes the GRUB2 patch to resolve this vulnerability. These new boot images will update GRUB2 and the Forbidden Signature Database (DBX). After the DBX is updated, users will not be able to boot to the older IP, SPP or Scri
orbidden Signature Database (DBX). After the DBX is updated, users will not be able to boot to the older IP, SPP or Scripting ToolKit with Secure Boot enabled. HPE have provided a standalone DBX update tool to work with Microsoft Windows, and supported Linux Operating Systems. These tools can be used to update the Forbidden Signature Database (DBX) from within the OS. **Note:** This DBX update mitigates the GRUB2 issue with insmod enabled, and the "Boot Hole" issue for HPE signed GRUB2 applications. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04020en_us
CVE ID: CVE-2020-7206 State: PUBLISHED Published: 2020-07-17T21:16:11 Last Updated: 2024-08-04T09:25:48.459Z Vendors: n/a Products: nagios-plugins-ilo Problem Types: remote code injection Description: HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HewlettPackard/nagios-plugins-hpilo/commit/7617b2736a95c7f354198f092febe37e7005c677
CVE ID: CVE-2020-7207 State: PUBLISHED Published: 2020-11-05T20:14:32 Last Updated: 2024-08-04T09:25:48.465Z Vendors: n/a Products: HPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360 Gen10 Server; HPE ProLiant DL380 Gen10 Server; HPE ProLiant DL560 Gen10 Server; HPE ProLiant DL580 Gen10 Server; HPE ProLiant ML110 Gen10 Server; HPE ProLiant XL230k Gen10 Server; HPE Synergy 480 Gen10 Compute Module; HPE Synergy 660 Gen10 Compute Module; HPE ProLiant DL180 Gen10 Server; HPE ProLiant DL160 Gen10 Server; HPE ProLiant DL120 Gen10 Server; HPE ProLiant XL190r Gen10 Server; HPE ProLiant ML350 Gen10 Server; HPE ProLiant XL170r Gen10 Server; HPE Apollo 2000 System; HPE Apollo 4500 System; HPE P
HPE ProLiant ML350 Gen10 Server; HPE ProLiant XL170r Gen10 Server; HPE Apollo 2000 System; HPE Apollo 4500 System; HPE ProLiant XL270d Gen10 Server; HPE Apollo 4200 Gen10 Server; HPE ProLiant e910 Server Blade; HPE ProLiant XL450 Gen10 Server; HPE ProLiant XL230k Gen10 Server - bad oid Problem Types: local elevation of privilege Description: A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers li
ssue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04002en_us
CVE ID: CVE-2020-7208 State: PUBLISHED Published: 2020-02-12T23:23:52 Last Updated: 2024-08-04T09:25:48.078Z Vendors: n/a Products: LinuxKI Problem Types: XSS Description: LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2
CVE ID: CVE-2020-7209 State: PUBLISHED Published: 2020-02-12T23:24:07 Last Updated: 2024-08-04T09:25:47.978Z Vendors: n/a Products: LinuxKI Problem Types: Remote Code Execution Description: LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2 - http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.html - http://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.html
CVE ID: CVE-2020-7210 State: PUBLISHED Published: 2020-01-23T12:24:25 Last Updated: 2024-08-04T09:25:47.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/vulnerability-lab/advisories/index.html - https://sec-consult.com/en/blog/advisories/cross-site-request-forgery-csrf-in-umbraco-cms/ - http://seclists.org/fulldisclosure/2020/Jan/33 - https://seclists.org/bugtraq/2020/Jan/35 - http://packetstormsecurity.com/files/156062/Umbraco-CMS-8.2.2-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-7211 State: PUBLISHED Published: 2020-01-21T16:12:33 Last Updated: 2024-08-04T09:25:48.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4 - http://www.openwall.com/lists/oss-security/2020/01/17/2 - https://security-tracker.debian.org/tracker/CVE-2020-7211
CVE ID: CVE-2020-7212 State: PUBLISHED Published: 2020-03-06T19:14:54 Last Updated: 2024-08-04T09:25:48.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to co
also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/urllib3/urllib3/blob/master/CHANGES.rst - https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a - https://pypi.org/project/urllib3/1.25.8/
CVE ID: CVE-2020-7213 State: PUBLISHED Published: 2020-01-21T16:26:36 Last Updated: 2024-08-04T09:25:48.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a parallels_updates.xml file on the http://update.parallels.com web site. Additional Analyst Notes: - CVE Program Container: References: - https://parallels.com - http://almorabea.net/cves/cve-2020-7213.txt - http://almorabea.net/en/2020/01/19/write-up-for-the-parallel-vulnerability-cve-2020-7213/
CVE ID: CVE-2020-7215 State: PUBLISHED Published: 2020-01-20T05:32:30 Last Updated: 2024-08-04T09:25:48.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 before 8.10.1134(MR4). External system configuration data (used for third party integrations such as DVR systems) were logged in the Command Centre event trail. Any authenticated operator with the 'view events' privilege could see the full configuration, including cleartext usernames and passwords, under the event details of a Modified DVR System event. Additional Analyst Notes: - CVE Program Container: References
s, under the event details of a Modified DVR System event. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/cve-2020-7215
CVE ID: CVE-2020-7216 State: PUBLISHED Published: 2020-02-05T14:34:25 Last Updated: 2024-08-04T09:25:48.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00005.html - https://bugzilla.suse.com/show_bug.cgi?id=1160905
CVE ID: CVE-2020-7217 State: PUBLISHED Published: 2020-02-10T21:32:25 Last Updated: 2024-08-04T09:25:48.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1160906 - https://www.suse.com/security/cve/CVE-2020-7217/ - https://github.com/openSUSE/wicked/releases - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00011.html
CVE ID: CVE-2020-7218 State: PUBLISHED Published: 2020-01-31T12:26:44 Last Updated: 2024-08-04T09:25:48.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/nomad/ - https://github.com/hashicorp/nomad/issues/7002
CVE ID: CVE-2020-7219 State: PUBLISHED Published: 2020-01-31T12:39:17 Last Updated: 2024-08-04T09:25:48.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul/ - https://github.com/hashicorp/consul/issues/7159
CVE ID: CVE-2020-7220 State: PUBLISHED Published: 2020-01-23T17:41:28 Last Updated: 2024-08-04T09:25:47.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#132-january-22nd-2020
CVE ID: CVE-2020-7221 State: PUBLISHED Published: 2020-02-04T16:57:00 Last Updated: 2024-08-04T09:25:48.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2020/q1/55 - https://bugzilla.suse.com/show_bug.cgi?id=1160868 - https://github.com/Ma
s: - https://seclists.org/oss-sec/2020/q1/55 - https://bugzilla.suse.com/show_bug.cgi?id=1160868 - https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618
CVE ID: CVE-2020-7222 State: PUBLISHED Published: 2020-01-17T23:40:39 Last Updated: 2024-08-04T09:25:48.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (ability to see every option but not modify them). Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/amcrest-2520ac0018r-login-bypass.html
CVE ID: CVE-2020-7224 State: PUBLISHED Published: 2020-04-16T17:26:45 Last Updated: 2024-08-04T09:25:48.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the parameters could allow unauthorized third-party libraries to load. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/security_bulletin_article.html - https://docs.aviatrix.com/#security-bulletin - https://docs.aviatrix.com/HowTos/security_bulletin_article.html#article-avxsb-00001
CVE ID: CVE-2020-7226 State: PUBLISHED Published: 2020-01-24T14:17:16 Last Updated: 2024-08-04T09:25:48.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc36b75cabb4d700b48035d15ad8b8c2712bb32123572a1bdaec2510a%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/re04e4f8f0d0953
8035d15ad8b8c2712bb32123572a1bdaec2510a%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/re04e4f8f0d095387fb6b0ff9016a0af8c93f42e1de93b09298bfa547%40%3Ccommits.ws.apache.org%3E - https://lists.apache.org/thread.html/rfa4647c58e375996e62a9094bffff6dc350ec311ba955b430e738945%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/r380781f5b489cb3c818536cd3b3757e806bfe0bca188591e0051ac03%40%3Ccommits.ws.apache.org%3E - https://lists.apache.org/thread.html/re7f46c4cc29a4616e0aa669c84a0eb34832e83a8eef05189e2e59b44%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/r209de85beae4d257d27fc577e3a3e97039bdb4c2dc6f4a8e5a5a5811%40%3Ccommits.tomee.apache.org%3E - ht