Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
aproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/ - https://www.debian.org/security/2020/dsa-4694 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/ - https://www.synology.com/security/advisory/Synology_SA_20_12 - https://usn.ubuntu.com/4374-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html - https://security.netapp.com/advisory/ntap-20200702-0006/ - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc - https://lists.debian.org/
y/ntap-20200702-0006/ - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc - https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
CVE ID: CVE-2020-12663 State: PUBLISHED Published: 2020-05-19T13:48:46 Last Updated: 2024-08-04T12:04:22.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Additional Analyst Notes: - CVE Program Container: References: - https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt - http://www.openwall.com/lists/oss-security/2020/05/19/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/ - https://www.debian.org/security/2020/dsa-4694 - https://lists.fedoraproject.org/archives/list/package-a
HGO3TUD32LCIQ/ - https://www.debian.org/security/2020/dsa-4694 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/ - https://usn.ubuntu.com/4374-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc - https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
CVE ID: CVE-2020-12666 State: PUBLISHED Published: 2020-05-05T21:06:59 Last Updated: 2024-08-04T12:04:22.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-macaron/macaron/releases/tag/v1.3.7 - https://github.com/go-macaron/macaron/issues/198 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QEUOHRC4EN4WZ66EVFML2UCV7ZQ63XZ/
CVE ID: CVE-2020-12667 State: PUBLISHED Published: 2020-05-19T00:00:00 Last Updated: 2024-08-04T12:04:22.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/ - https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html - http://www.openwall.com/lists/oss-security/2020/05/
- https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html - http://www.openwall.com/lists/oss-security/2020/05/19/2 - http://cyber-security-group.cs.tau.ac.il/# - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76Y4FITMOH6RVPWAANGV7NB2ZHPJJGDQ/ - https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
CVE ID: CVE-2020-12668 State: PUBLISHED Published: 2021-02-19T22:33:55 Last Updated: 2024-08-04T12:04:22.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HubSpot/jinjava/compare/jinjava-2.5.3...jinjava-2.5.4 - https://github.com/HubSpot/jinjava/pull/426/commits/5dfa5b87318744a4d020b66d5f7747acc36b213b - https://github.com/HubSpot/jinjava/pull/435/commits/1b9aaa4b420c58b4a301cf4b7d
dfa5b87318744a4d020b66d5f7747acc36b213b - https://github.com/HubSpot/jinjava/pull/435/commits/1b9aaa4b420c58b4a301cf4b7d26207f1c8d1165 - https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.5.4 - https://securitylab.github.com/advisories/GHSL-2020-072-hubspot_jinjava
CVE ID: CVE-2020-12669 State: PUBLISHED Published: 2020-05-06T18:30:41 Last Updated: 2024-08-04T12:04:22.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/commit/c1b530f58f6f01081ddbeaa2092ef308c3ec2727 - https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/11.0.4/
CVE ID: CVE-2020-12670 State: PUBLISHED Published: 2020-10-12T15:56:28 Last Updated: 2024-08-04T12:04:22.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email. Additional Analyst Notes: - CVE Program Container: References: - https://www.webmin.com/security.html
CVE ID: CVE-2020-12672 State: PUBLISHED Published: 2020-05-06T02:47:51 Last Updated: 2024-08-04T12:04:22.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19025 - https://lists.debian.org/debian-lts-announce/2020/06/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00012.html - https://security.gentoo.org/glsa/202209-19
CVE ID: CVE-2020-12673 State: PUBLISHED Published: 2020-08-12T15:18:13 Last Updated: 2024-08-04T12:04:22.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - https://www.openwall.com/lists/oss-security/2020/08/12/2 - https://www.debian.org/security/2020/dsa-4745 - https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html - https://usn.ubuntu.com/4456-1/ - https://usn.ubuntu.com/4456-2/ - http://lists.opensuse.org/opensuse-security-announce/2020-08
//usn.ubuntu.com/4456-1/ - https://usn.ubuntu.com/4456-2/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00059.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/ - https://security.gentoo.org/glsa/202009-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/
CVE ID: CVE-2020-12674 State: PUBLISHED Published: 2020-08-12T15:20:29 Last Updated: 2024-08-04T12:04:22.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - https://www.openwall.com/lists/oss-security/2020/08/12/3 - https://www.debian.org/security/2020/dsa-4745 - https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html - https://usn.ubuntu.com/4456-1/ - https://usn.ubuntu.com/4456-2/ - http://lists.opensuse.org/opensuse-security-announce/20
ttps://usn.ubuntu.com/4456-1/ - https://usn.ubuntu.com/4456-2/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00059.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/ - https://security.gentoo.org/glsa/202009-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/
CVE ID: CVE-2020-12675 State: PUBLISHED Published: 2020-05-29T15:52:06 Last Updated: 2024-08-04T12:04:22.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/mappress-google-maps-for-wordpress/#developers - https://blog.alertlogic.com/alert-logic-threat-research-team-identifies-new-vu
s-google-maps-for-wordpress/#developers - https://blog.alertlogic.com/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress/
CVE ID: CVE-2020-12676 State: PUBLISHED Published: 2020-10-02T19:40:33 Last Updated: 2024-08-04T12:04:22.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack". Additional Analyst Notes: - CVE Program Container: References: - https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf - https://github.com/SAMLRaider/SAMLRaider - http://seclists.org/fulldisclosure/2020/Oct/1 - https://compass-security.com/fileadmin/Research/Advisories/2020-06_CSNC-2020-002_Fusio
s.org/fulldisclosure/2020/Oct/1 - https://compass-security.com/fileadmin/Research/Advisories/2020-06_CSNC-2020-002_FusionAuth_Signature_Exclusion_Attack.txt - http://packetstormsecurity.com/files/159454/FusionAuth-SAMLv2-0.2.3-Message-Forging.html
CVE ID: CVE-2020-12677 State: PUBLISHED Published: 2020-05-14T17:34:03 Last Updated: 2024-08-04T12:04:22.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3, 2018 SP1 - 2018.2 prior to 2018.2.3, 2018 SP2 - 2018.3 prior to 2018.3.7, 2019 - 2019.0 prior to 2019.0.3, 2019.1 - 2019.1 prior to 2019.1.2, and 2019.2 - 2019.2 prior to 2019.2.2. Additional Analyst Notes: - CVE Program Container: Refe
2019.1 prior to 2019.1.2, and 2019.2 - 2019.2 prior to 2019.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://community.progress.com/s/article/MOVEit-Automation-Cross-Site-Scripting-Vulnerability-XSS-May-2020 - https://docs.ipswitch.com/MOVEit/Automation2018/ReleaseNotes/en/index.htm#33958.htm - https://docs.ipswitch.com/MOVEit/Automation2018SP1/ReleaseNotes/en/index.htm#33958.htm - https://docs.ipswitch.com/MOVEit/Automation2018SP2/ReleaseNotes/en/index.htm#33958.htm - https://docs.ipswitch.com/MOVEit/Automation2019/ReleaseNotes/en/index.htm#33958.htm - https://docs.ipswitch.com/MOVEit/Automation2019_1/ReleaseNotes/en/index.htm#33958.htm - https://docs.ipswitch.c
58.htm - https://docs.ipswitch.com/MOVEit/Automation2019_1/ReleaseNotes/en/index.htm#33958.htm - https://docs.ipswitch.com/MOVEit/Automation2019_2/ReleaseNotes/en/index.htm#33958.htm
CVE ID: CVE-2020-12678 State: REJECTED Published: 2020-05-06T22:47:12 Last Updated: 2020-05-06T22:47:12 Description: No description available.
CVE ID: CVE-2020-12679 State: PUBLISHED Published: 2020-05-07T16:36:31 Last Updated: 2024-08-04T12:04:22.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/kampji/5ade2d15817650a725aa89fa2e6e4752
CVE ID: CVE-2020-12680 State: PUBLISHED Published: 2020-05-08T12:02:43 Last Updated: 2024-08-04T12:04:22.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and thus a request such as fetchChromePasswords or fetchCredentials will succeed. NOTE: some third parties have stated that this is "not a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/t
hat this is "not a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/taviso/status/1258448515912491026 - https://medium.com/%40knikolenko/avira-free-antivirus-password-collector-83452fa7f943
CVE ID: CVE-2020-12681 State: PUBLISHED Published: 2021-07-26T11:31:36 Last Updated: 2024-08-04T12:04:22.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied. Additional Analyst Notes: - CVE Program Container: References: - https://www.3xlogic.com/products/access-control/infinias-ethernet-enabled-integrated-door-controller-eidc - https://www.3xlogic.com/sites/www.3xlogic.com/files/media/2020-08/INF_RN_infinias_eIDC32_V3.9_Firmware%20Release_08142020.pdf
CVE ID: CVE-2020-12683 State: PUBLISHED Published: 2020-05-07T15:59:59 Last Updated: 2024-08-04T12:04:22.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Katyshop2 before 2.12 has multiple stored XSS issues. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-001 - https://sourceforge.net/p/katyshop2/code/ci/8c6fb8d8df410e34b704e567805308d820ca5eae/
CVE ID: CVE-2020-12684 State: PUBLISHED Published: 2020-07-15T19:09:41 Last Updated: 2024-08-04T12:04:22.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer), as used in i-net HelpDesk and other products, when XML input containing a reference to an external entity is processed by a weakly configured XML parser. Additional Analyst Notes: - CVE Program Container: References: - https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases - https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_20.4
CVE ID: CVE-2020-12685 State: PUBLISHED Published: 2020-05-15T16:53:55 Last Updated: 2024-08-04T12:04:22.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://www.interchangecommerce.org - https://www.interchangecommerce.org/i/dev/news?mv_arg=00064
CVE ID: CVE-2020-12687 State: PUBLISHED Published: 2020-05-07T15:15:36 Last Updated: 2024-08-04T12:04:22.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users (including administrators) from the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SerpicoProject/Serpico/commit/0b8600414976a5ad733604c7b1428071baf239c2 - https://github.com/SerpicoProject/Serpico/releases/tag/1.3.3
CVE ID: CVE-2020-12689 State: PUBLISHED Published: 2020-05-06T23:43:20 Last Updated: 2024-08-04T12:04:22.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://se
ely grant that user global admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://security.openstack.org/ossa/OSSA-2020-004.html - https://bugs.launchpad.net/keystone/+bug/1872735 - https://www.openwall.com/lists/oss-security/2020/05/06/5 - http://www.openwall.com/lists/oss-security/2020/05/07/2 - https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E - https://usn.ubuntu.com/4480-1/
CVE ID: CVE-2020-12690 State: PUBLISHED Published: 2020-05-06T23:43:10 Last Updated: 2024-08-04T12:04:22.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access. Additional Analyst Notes: - CVE Program Container: References: - https://security.openstack
unintended escalated access. Additional Analyst Notes: - CVE Program Container: References: - https://security.openstack.org/ossa/OSSA-2020-005.html - https://bugs.launchpad.net/keystone/+bug/1873290 - https://www.openwall.com/lists/oss-security/2020/05/06/6 - http://www.openwall.com/lists/oss-security/2020/05/07/3 - https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E - https://usn.ubuntu.com/4480-1/ - https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2020-12691 State: PUBLISHED Published: 2020-05-06T23:43:01 Last Updated: 2024-08-04T12:04:22.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. Additional Analyst Notes: - CVE Program Container: Reference
ch can effectively grant that user global admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://security.openstack.org/ossa/OSSA-2020-004.html - https://www.openwall.com/lists/oss-security/2020/05/06/5 - https://bugs.launchpad.net/keystone/+bug/1872733 - http://www.openwall.com/lists/oss-security/2020/05/07/2 - https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E - https://usn.ubuntu.com/4480-1/ - https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2020-12692 State: PUBLISHED Published: 2020-05-06T23:42:42 Last Updated: 2024-08-04T12:04:22.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times. Additional Analyst Notes: - CVE Program Container: References: - https://security.openstack.org/ossa/OSSA-2020-003.html - https://bugs.launchpad.net/keystone/+bug/1872737 - https://www.openwall.com/lists/oss-security/2020/05/06/4 - http://www.openwall.com/lists/oss
net/keystone/+bug/1872737 - https://www.openwall.com/lists/oss-security/2020/05/06/4 - http://www.openwall.com/lists/oss-security/2020/05/07/1 - https://usn.ubuntu.com/4480-1/
CVE ID: CVE-2020-12693 State: PUBLISHED Published: 2020-05-21T22:27:05 Last Updated: 2024-08-04T12:04:22.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php?id=236 - https://lists.schedmd.com/pipermail/slurm-announce/2020/000036.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3RGQB3EW
000036.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3RGQB3EWDLOLTSPAJPPWZEPQK3O3AUH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNL5E5SK4WP6M3DKU4IKW2NPQD2XTZ4Y/ - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00063.html - https://www.debian.org/security/2021/dsa-4841 - https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html
CVE ID: CVE-2020-12695 State: PUBLISHED Published: 2020-06-08T16:45:04 Last Updated: 2024-08-04T12:04:22.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.callstranger.com - https://www.kb.cert.org/vuls/id/339275 - http://www.openwall.com/lists/oss-security/2020/06/08/2 - https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-univers