Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12746 State: PUBLISHED Published: 2020-05-11T15:12:22 Last Updated: 2024-08-04T12:04:22.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) (Exynos chipsets) software. Attackers can bypass the Secure Bootloader protection mechanism via a heap-based buffer overflow to execute arbitrary code. The Samsung ID is SVE-2020-16712 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12747 State: PUBLISHED Published: 2020-05-11T15:15:57 Last Updated: 2024-08-04T12:04:22.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos980 9630 and Exynos990 9830 chipsets) software. The Bootloader has a heap-based buffer overflow because of the mishandling of specific commands. The Samsung IDs are SVE-2020-16981, SVE-2020-16991 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12748 State: PUBLISHED Published: 2020-05-11T15:25:45 Last Updated: 2024-08-04T12:04:22.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass the locked-state protection mechanism and designate a different preferred SIM card. The Samsung ID is SVE-2020-16594 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12749 State: PUBLISHED Published: 2020-05-11T15:30:44 Last Updated: 2024-08-04T12:04:22.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. The S.LSI Wi-Fi drivers have a buffer overflow. The Samsung ID is SVE-2020-16906 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12750 State: PUBLISHED Published: 2020-05-11T15:37:10 Last Updated: 2024-08-04T12:04:22.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via SPEN. The Samsung ID is SVE-2020-17019 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12751 State: PUBLISHED Published: 2020-05-11T15:39:21 Last Updated: 2024-08-04T12:04:22.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung ID is SVE-2020-16943 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12752 State: PUBLISHED Published: 2020-05-11T15:40:26 Last Updated: 2024-08-04T12:04:22.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-12753 State: PUBLISHED Published: 2020-05-11T15:45:20 Last Updated: 2024-08-04T12:04:22.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving raw_resources. The LG ID is LVE-SMP-200006 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/ - https://www.zdnet.com/article/new-cold-boot-attack-affects-seven-years-of-lg-android-smartphones/ - https://douevenknow.us/post/619763074822520832/an-el1el3-coldboot-vulnerabil
ts-seven-years-of-lg-android-smartphones/ - https://douevenknow.us/post/619763074822520832/an-el1el3-coldboot-vulnerability
CVE ID: CVE-2020-12754 State: PUBLISHED Published: 2020-05-11T15:47:05 Last Updated: 2024-08-04T12:04:22.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A crafted application can obtain control of device input via the window system service. The LG ID is LVE-SMP-170011 (May 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2020-12755 State: PUBLISHED Published: 2020-05-09T15:52:06 Last Updated: 2024-08-04T12:04:22.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option. This may lead to unintended KWallet storage of a password. Additional Analyst Notes: - CVE Program Container: References: - https://commits.kde.org/kio-extras/d813cef3cecdec9af1532a40d677a203ff979145
CVE ID: CVE-2020-12757 State: PUBLISHED Published: 2020-06-10T18:46:12 Last Updated: 2024-08-04T12:04:22.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
CVE ID: CVE-2020-12758 State: PUBLISHED Published: 2020-06-11T19:23:26 Last Updated: 2024-08-04T12:04:22.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md - https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md - https://github.com/hashicorp/consul/pull/7783
CVE ID: CVE-2020-12759 State: PUBLISHED Published: 2020-08-21T04:39:00 Last Updated: 2024-08-04T12:04:22.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/
CVE ID: CVE-2020-12760 State: PUBLISHED Published: 2020-05-11T15:54:33 Last Updated: 2024-08-04T12:04:22.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/ - https://www.opennms.c
ferences: - https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/ - https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/ - https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/ - https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 - https://issues.opennms.org/browse/NMS-12673
CVE ID: CVE-2020-12761 State: PUBLISHED Published: 2020-05-09T17:21:51 Last Updated: 2024-08-04T12:04:22.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many colors in its color map. Additional Analyst Notes: - CVE Program Container: References: - https://git.enlightenment.org/legacy/imlib2.git/commit/?id=c95f938ff1effaf91729c050a0f1c8684da4dd63
CVE ID: CVE-2020-12762 State: PUBLISHED Published: 2020-05-09T00:00:00.000Z Last Updated: 2025-11-03T19:25:29.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/json-c/json-c/pull/592 - https://github.com/rsyslog/libfastjson/issues/161 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI/ - https://usn.ubuntu.com/4360-1/ - https://lists.fedoraproject.org/archives/lis
essage/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI/ - https://usn.ubuntu.com/4360-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBR36IXYBHITAZFB5PFBJTED22WO5ONB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W226TSCJBEOXDUFVKNWNH7ETG7AR6MCS/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/05/msg00034.html - https://usn.ubuntu.com/4360-4/ - https://security.gentoo.org/glsa/202006-13 - https://lists.debian.org/debian-lts-announce/2020/07/msg00031.html - https://www.debian.org/security/2020/dsa-4741 - https://security.netapp.c
rg/debian-lts-announce/2020/07/msg00031.html - https://www.debian.org/security/2020/dsa-4741 - https://security.netapp.com/advisory/ntap-20210521-0001/ - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf - https://lists.debian.org/debian-lts-announce/2023/06/msg00023.html
CVE ID: CVE-2020-12763 State: PUBLISHED Published: 2020-05-13T14:01:47 Last Updated: 2024-08-04T12:04:22.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow in handling RTSP packets. This may result in remote code execution or denial of service. The issue is in the binary rtspd (in /sbin) when parsing a long "Authorization: Basic" RTSP header. Additional Analyst Notes: - CVE Program Container: References: - https://payatu.com/blog/munawwar/trendNet-wireless-camera-buffer-overflow-vulnerability
CVE ID: CVE-2020-12764 State: PUBLISHED Published: 2020-05-09T18:35:21 Last Updated: 2024-08-04T12:04:22.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BrunoBulle/GNUTeca3.8/blob/master/README.md
CVE ID: CVE-2020-12765 State: PUBLISHED Published: 2020-05-09T18:35:11 Last Updated: 2024-08-04T12:04:22.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Solis Miolo 2.0 allows index.php?module=install&action=view&item= Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BrunoBulle/Miolo_2.0/blob/master/README.md
CVE ID: CVE-2020-12766 State: PUBLISHED Published: 2020-05-09T18:34:59 Last Updated: 2024-08-04T12:04:22.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gnuteca 3.8 allows action=main:search:simpleSearch SQL Injection via the exemplaryStatusId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BrunoBulle/GNUTeca_3.8-SQL_Inj/blob/master/README.md
CVE ID: CVE-2020-12767 State: PUBLISHED Published: 2020-05-09T20:17:00 Last Updated: 2024-08-04T12:04:22.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libexif/libexif/issues/31 - https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html - https://usn.ubuntu.com/4358-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html - https://security.gentoo.org/glsa/202007-05
CVE ID: CVE-2020-12768 State: PUBLISHED Published: 2020-05-09T20:16:53 Last Updated: 2024-08-04T12:04:22.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d80b64ff297e40c2b6f7d7abc1b3eba70d22a068 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6 - https://bug
/?id=d80b64ff297e40c2b6f7d7abc1b3eba70d22a068 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6 - https://bugzilla.suse.com/show_bug.cgi?id=1171736#c3 - https://www.debian.org/security/2020/dsa-4699 - https://usn.ubuntu.com/4413-1/ - https://usn.ubuntu.com/4411-1/ - https://usn.ubuntu.com/4412-1/
CVE ID: CVE-2020-12769 State: PUBLISHED Published: 2020-05-09T20:16:45 Last Updated: 2024-08-04T12:04:22.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2020/2/3/559 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19b61392c5a852b4e8a0bf35aecb969983c5932d - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.17 - https://security.netapp.com/advisory/ntap-202006
5932d - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.17 - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html - https://usn.ubuntu.com/4391-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html
CVE ID: CVE-2020-12770 State: PUBLISHED Published: 2020-05-09T20:16:36 Last Updated: 2024-08-04T12:04:22.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2020/4/13/870 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83c6f2390040f188cc25b270b4befeb5628c1aee - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R54VC7B6MDYKP57AWC2HN7AUJYH62RKI/ - https://lists.fedoraproj
ves/list/package-announce%40lists.fedoraproject.org/message/R54VC7B6MDYKP57AWC2HN7AUJYH62RKI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ES5C6ZCMALBEBMKNNCTBSLLSYGFZG3FF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IO5XIQSRI747P4RVVTNX7TUPEOCF4OPU/ - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - https://www.debian.org/s
org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - https://www.debian.org/security/2020/dsa-4699 - https://usn.ubuntu.com/4413-1/ - https://usn.ubuntu.com/4411-1/ - https://usn.ubuntu.com/4412-1/ - https://usn.ubuntu.com/4419-1/ - https://usn.ubuntu.com/4414-1/
CVE ID: CVE-2020-12771 State: PUBLISHED Published: 2020-05-09T20:16:20 Last Updated: 2024-08-04T12:04:22.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00071.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html - https://usn.ubuntu.com/4463-1/ - https://usn.ubuntu.com/4465-1/ - https://usn.ubuntu.com
nnounce/2020/08/msg00019.html - https://usn.ubuntu.com/4463-1/ - https://usn.ubuntu.com/4465-1/ - https://usn.ubuntu.com/4462-1/ - https://usn.ubuntu.com/4483-1/ - https://usn.ubuntu.com/4485-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lkml.org/lkml/2020/4/26/87
CVE ID: CVE-2020-12772 State: PUBLISHED Published: 2020-05-12T19:36:54 Last Updated: 2024-08-04T12:04:22.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the (NT)LM hashes of the user are sent with the HTTP request. This allows an attacker to collect these hashes, crack them, and potentially compromise the computer. (ROAR can be configured for automatic access. Also, access can occur if the user clicks.) Additional Analyst Notes: - CVE Program
be configured for automatic access. Also, access can occur if the user clicks.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theart42/cves/blob/master/cve-2020-12772/CVE-2020-12772.md
CVE ID: CVE-2020-12773 State: PUBLISHED Published: 2020-06-08T07:20:18.866221Z Last Updated: 2024-09-17T04:09:35.498Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Realtek Products: ADSL/PON Modem SoC Problem Types: Security Misconfiguration Description: A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware, which allows attackers using a default password to execute arbitrary commands remotely via the build-in network monitoring tool. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3681-2a3f6-1.html
CVE ID: CVE-2020-12774 State: PUBLISHED Published: 2020-07-22T07:20:17.723570Z Last Updated: 2024-09-16T17:33:15.257Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: D-Link Products: DSL-7740C Problem Types: CWE-78 Description: D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3802-27204-1.html
CVE ID: CVE-2020-12775 State: PUBLISHED Published: 2022-03-01T01:55:17.625028Z Last Updated: 2024-09-16T22:35:31.057Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hicos Products: citizen certificate client-side component Problem Types: CWE-78 Description: Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt system or terminate service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-
terminate service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5695-421a7-1.html - https://moica.nat.gov.tw/rac_plugin.html
CVE ID: CVE-2020-12776 State: PUBLISHED Published: 2020-09-01T08:10:17.915961Z Last Updated: 2024-09-17T04:14:37.526Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: Openfind Products: Mail2000 Problem Types: Broken Access Control Description: Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html
CVE ID: CVE-2020-12777 State: PUBLISHED Published: 2020-08-10T02:45:38.090892Z Last Updated: 2024-09-17T03:22:24.335Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: Broken Access Control Description: A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3833-46ae7-1.html - https://github.com/Combodo/iTop/security/advisories/GHSA-88fq-r22m-64q2
CVE ID: CVE-2020-12778 State: PUBLISHED Published: 2020-08-10T02:45:38.492001Z Last Updated: 2024-09-17T01:26:51.771Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: Reflected XSS Description: Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3834-591e2-1.html - https://github.com/Combodo/iTop/security/advisories/GHSA-8vpf-8vjh-5fcv
CVE ID: CVE-2020-12779 State: PUBLISHED Published: 2020-08-10T02:45:38.893251Z Last Updated: 2024-09-16T16:27:55.266Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: Stored XSS Description: Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3835-e8e8f-1.html - https://github.com/Combodo/iTop/security/advisories/GHSA-qqrf-j8qv-g247
CVE ID: CVE-2020-12780 State: PUBLISHED Published: 2020-08-10T02:45:39.363087Z Last Updated: 2024-09-16T20:06:35.625Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: Security Misconfiguration Description: A security misconfiguration exists in Combodo iTop, which can expose sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3836-47d6c-1.html - https://github.com/Combodo/iTop/security/advisories/GHSA-97cw-cjxc-9x78
CVE ID: CVE-2020-12781 State: PUBLISHED Published: 2020-08-10T02:45:39.815408Z Last Updated: 2024-09-16T23:26:00.002Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-352 Description: Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3837-050db-1.html - https://github.com/Combodo/iTop/security/advisories/GHSA-34rq-vfmf-gg5v