Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-27409 State: PUBLISHED Published: 2020-12-04T15:26:32 Last Updated: 2024-08-04T16:18:43.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Responsive-Design/commit/edca0855e7bc27d5b28dcb2d16f057ada865e282#diff-5f88e2ce4cd96451df7580911120b4b2 - https://github.com/OS4ED/openSIS-Responsive-Design/compare/ver7.4...V7.5 - https://insinuator.net/2020/10/opensis-vulnerabilities/
CVE ID: CVE-2020-27413 State: PUBLISHED Published: 2021-12-07T13:35:24 Last Updated: 2024-08-04T16:18:43.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application. Additional Analyst Notes: - CVE Program Container: References: - http://maharashtra.com - http://mahavitaran.com - https://play.google.com/store/apps/details?id=com.msedcl.app&utm_source=APKdownloadMirror.com - https://cvewalkthrough.com/cve-2020-27413-mahavitaran-android-application-clear-text-password-storage/
CVE ID: CVE-2020-27414 State: PUBLISHED Published: 2021-12-02T03:08:13 Last Updated: 2024-08-04T16:18:43.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header, MITM or browser history. Additional Analyst Notes: - CVE Program Container: References: - https://cvewalkthrough.com/cve-2020-27414-mahavitaran-android-application-insecure-communication-of-sensitive-dat/
CVE ID: CVE-2020-27416 State: PUBLISHED Published: 2021-12-08T18:36:50 Last Updated: 2024-08-04T16:18:43.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.msedcl.app&hl=en&gl=US - https://cvewalkthrough.com/cve-2021-41716-mahavitaran-android-application-account-take-over-via-otp-fixation/
CVE ID: CVE-2020-27418 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T19:23:40.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fedora.com - https://patchwork.freedesktop.org/patch/356372/
CVE ID: CVE-2020-27422 State: PUBLISHED Published: 2020-11-16T15:49:10 Last Updated: 2024-08-04T16:18:44.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account. Additional Analyst Notes: - CVE Program Container: References: - https://www.anuko.com/time-tracker/index.htm - https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html
CVE ID: CVE-2020-27423 State: PUBLISHED Published: 2020-11-16T15:45:52 Last Updated: 2024-08-04T16:18:43.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160052/Anuko-Time-Tracker-1.19.23.5311-Missing-Rate-Limiting.html
CVE ID: CVE-2020-27428 State: PUBLISHED Published: 2022-01-05T23:37:45 Last Updated: 2024-08-04T16:18:43.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LLK/scratch-svg-renderer/commit/7c74ec7de3254143ec3c557677f5355a90a3d07f
CVE ID: CVE-2020-27449 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T19:16:09.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugbounty.zoho.com/bb/#/bug/101000003619211 - https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002
CVE ID: CVE-2020-27459 State: PUBLISHED Published: 2020-11-16T14:55:49 Last Updated: 2024-08-04T16:18:43.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nugmubs/chronoforums-cve/wiki/Stored-XSS-Vulnerability-in-Chronoforum-v2.0.11-%28Joomla-plugin%29
CVE ID: CVE-2020-27461 State: PUBLISHED Published: 2021-08-20T18:10:53 Last Updated: 2024-08-04T16:18:43.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the Settings Panel>Import website function. Additional Analyst Notes: - CVE Program Container: References: - https://www.seopanel.org/ - https://sourceforge.net/projects/seopanel/files/seopanel.v.4.6.0.zip/download - https://www.exploit-db.com/exploits/48862
CVE ID: CVE-2020-27464 State: PUBLISHED Published: 2021-08-20T18:10:54 Last Updated: 2024-08-04T16:18:44.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/
CVE ID: CVE-2020-27466 State: PUBLISHED Published: 2021-08-20T18:10:56 Last Updated: 2024-08-04T16:18:44.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/
CVE ID: CVE-2020-27467 State: PUBLISHED Published: 2022-02-22T20:59:55 Last Updated: 2024-08-04T16:18:44.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ceng-yildirim/LFI-processwire
CVE ID: CVE-2020-27478 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-04T16:18:44.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf11505a7 allows a remote attacker to execute arbitrary code via a crafted script to the search bar feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/simplcommerce/SimplCommerce/issues/943
CVE ID: CVE-2020-27481 State: PUBLISHED Published: 2020-11-12T13:47:40 Last Updated: 2024-08-04T16:18:44.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/0xx7/a7aaa8b0515139cf7e30c808c8d54070
CVE ID: CVE-2020-27483 State: PUBLISHED Published: 2020-11-16T20:59:35 Last Updated: 2024-08-04T16:18:43.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided for the stack value duplication instruction, DUP. The offset is unchecked and memory prior to the start of the execution stack can be read and treated as a TVM object. A successful exploit could use the vulnerability to leak runtime
ecution stack can be read and treated as a TVM object. A successful exploit could use the vulnerability to leak runtime information such as the heap handle or pointer for a number of TVM context variables. Some reachable values may be controlled enough to forge a TVM object on the stack, leading to possible remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0007.md
CVE ID: CVE-2020-27484 State: PUBLISHED Published: 2020-11-16T20:59:25 Last Updated: 2024-08-04T16:18:44.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction. This a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities
32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md
CVE ID: CVE-2020-27485 State: PUBLISHED Published: 2020-11-16T20:59:16 Last Updated: 2024-08-04T16:18:44.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check the index provided when accessing the local variable in the LGETV and LPUTV instructions. This provides the ability to both read and write memory outside the bounds of the TVM context allocation. It can be leveraged to construct a use-after-free
ead and write memory outside the bounds of the TVM context allocation. It can be leveraged to construct a use-after-free scenario, leading to a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0005.md
CVE ID: CVE-2020-27486 State: PUBLISHED Published: 2020-11-16T20:59:06 Last Updated: 2024-08-04T16:18:44.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the string length provided in the data section of the PRG file. It allocates memory for the string immediately, and then copies the string into the TVM object by using a function similar to strcpy. This copy can exceed the length of the allocated string d
ing into the TVM object by using a function similar to strcpy. This copy can exceed the length of the allocated string data and overwrite heap data. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0006.md
CVE ID: CVE-2020-27488 State: PUBLISHED Published: 2021-01-13T19:06:54 Last Updated: 2024-08-04T16:18:44.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device's firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoo
occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur. Additional Analyst Notes: - CVE Program Container: References: - https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/ - https://www.loxone.com/dede/sicherheit-cloud-dns/ - https://www.loxone.com/enen/security-cloud-dns/ - https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/
CVE ID: CVE-2020-27507 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T18:37:35.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kamailio/kamailio/issues/2503 - https://github.com/kamailio/kamailio/commit/ada3701d22b1fd579f06b4f54fa695fa988e685f - https://lists.debian.org/debian-lts-announce/2023/05/msg00030.html
CVE ID: CVE-2020-27508 State: PUBLISHED Published: 2020-12-11T15:13:30 Last Updated: 2024-08-04T16:18:44.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/pull/11263 - https://github.com/frappe/frappe/pull/11262
CVE ID: CVE-2020-27509 State: PUBLISHED Published: 2022-06-26T12:33:43 Last Updated: 2024-08-04T16:18:44.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an account takeover by intercepting the HTTP Post request when sending an email and injecting a specially crafted XSS payload in the 'subject' field. The payload executes when the recipient logs into their mailbox. Additional Analyst Notes: - CVE Program Container: References: - http://galaxkey.com - https://medium.com/%40tomhulme_74888/persistent-cross-site-scripting-leading-to-full-account-takeover-on-galaxkey-v5-6-11-4-8b
//medium.com/%40tomhulme_74888/persistent-cross-site-scripting-leading-to-full-account-takeover-on-galaxkey-v5-6-11-4-8bf96be35b54
CVE ID: CVE-2020-27511 State: PUBLISHED Published: 2021-06-21T19:22:37 Last Updated: 2024-08-04T16:18:44.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags. Additional Analyst Notes: - CVE Program Container: References: - http://prototypejs.org/ - https://github.com/prototypejs/prototype/blob/dee2f7d8611248abce81287e1be4156011953c90/src/prototype/lang/string.js#L283 - https://github.com/yetingli/PoCs/blob/main/CVE-2020-27511/Prototype.md
CVE ID: CVE-2020-27514 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T19:15:16.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in delete function in admin.api.TemplateController in ZrLog version 2.1.15, allows remote attackers to delete arbitrary files and cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/94fzb/zrlog/issues/66
CVE ID: CVE-2020-27515 State: PUBLISHED Published: 2020-12-26T01:55:43 Last Updated: 2024-08-04T16:18:44.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/savsofts/savsoftquiz_v5 - https://savsoftquiz.com/ - https://www.exploit-db.com/exploits/49208
CVE ID: CVE-2020-27518 State: PUBLISHED Published: 2021-05-04T13:46:07 Last Updated: 2024-08-04T16:18:44.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService component. A low privilege user could leverage several openvpn options to execute code as root/SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - http://windscribe.com - https://jeffs.sh/CVEs/CVE-2020-27518.txt
CVE ID: CVE-2020-27519 State: PUBLISHED Published: 2021-04-30T13:16:08 Last Updated: 2024-08-04T16:18:44.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pritunl/pritunl-client-electron/commit/c0aeb159351e5e99d752c27b87133eca299bdfce - https://github.com/pritunl/pritunl-client-e
nl/pritunl-client-electron/commit/c0aeb159351e5e99d752c27b87133eca299bdfce - https://github.com/pritunl/pritunl-client-electron/commit/87ceeae9b8ee415541d7d71de10675e699a76e5e - https://github.com/pritunl/pritunl-client-electron/commit/87ceeae9b8ee415541d7d71de10675e699a76e5e#diff-5c6a264bee3576f2a147b8db70332e9a16dd43d073782cf6d32a372abb22b899
CVE ID: CVE-2020-27523 State: PUBLISHED Published: 2020-11-11T14:23:42 Last Updated: 2024-08-04T16:18:44.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, display_name, browser_name, and operation_system parameter during the authentication process. This may crash the server and force Solstice-Pod to reboot, which leads to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=EGW_M1MqAG0 - https://twitter.com/Kevin2600/status/1316261149403275264 - https://documentation.mersive.com/content/topics/genera
AG0 - https://twitter.com/Kevin2600/status/1316261149403275264 - https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htm - https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.html
CVE ID: CVE-2020-27524 State: PUBLISHED Published: 2020-11-11T14:20:56 Last Updated: 2024-08-04T16:18:44.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the services. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=BQUVgAdhwQs - https://twitter.com/Kevin2600/status/1316380576593571840 - https://tiger-team-1337.blogspot.com/2020/10/audi-a7-2014-mmi-mishandles-format.html
CVE ID: CVE-2020-27533 State: PUBLISHED Published: 2020-10-22T14:53:02 Last Updated: 2024-08-04T16:18:45.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dedetech/issues/issues/16 - http://packetstormsecurity.com/files/159772/DedeCMS-5.8-Cross-Site-Scripting.html
CVE ID: CVE-2020-27534 State: PUBLISHED Published: 2020-12-30T22:28:10 Last Updated: 2024-08-04T16:18:44.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moby/buildkit/pull/1462 - https://github.com/moby/moby/pull/40877 - http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes/ - https://golang.org/pkg/io/ioutil/#TempDir - https://golang.org/pkg/os/#TempDi
://docs.docker.com/engine/release-notes/ - https://golang.org/pkg/io/ioutil/#TempDir - https://golang.org/pkg/os/#TempDir
CVE ID: CVE-2020-27539 State: PUBLISHED Published: 2021-01-25T20:26:41 Last Updated: 2024-08-04T16:18:44.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. AgentUpdater service has a self-written HTTP parser and builder. HTTP parser has a heap buffer overflow (OOB write). In default configuration camera parses responses only from HTTPS URLs from config file, so vulnerable code is unreachable and one more bug required to reach it. Additional Analyst Notes: - CVE Program Container: References: - https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707
CVE ID: CVE-2020-27540 State: PUBLISHED Published: 2021-01-25T20:17:20 Last Updated: 2024-08-04T16:18:44.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads firmware update configuration from SD card file vc\version.json. fw-sign parameter and from this configuration is directly inserted into a bash command. Firmware update is run automatically if there is special file on the inserted SD card. Additional Analyst Notes: - CVE Program Container: References: - https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707