Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8275 State: PUBLISHED Published: 2021-01-06T20:58:54 Last Updated: 2024-08-04T09:56:28.264Z Vendors: n/a Products: Citrix Secure Mail for Android Problem Types: CWE-284 Description: Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX286763
CVE ID: CVE-2020-8276 State: PUBLISHED Published: 2020-11-09T14:05:23 Last Updated: 2024-08-04T09:56:28.301Z Vendors: n/a Products: https://github.com/brave/brave-core Problem Types: CWE-312 Description: The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in l
rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1024668
CVE ID: CVE-2020-8277 State: PUBLISHED Published: 2020-11-19T00:32:13 Last Updated: 2025-04-30T22:24:27.745Z Vendors: NodeJS Products: Node Problem Types: CWE-400 Description: A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1033107 - https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/ - https://lists.fedoraproject.org
ts/1033107 - https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/ - https://security.gentoo.org/glsa/202012-11 - https://security.gentoo.org/glsa/202101-07 - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/ - https://lists.fedoraproject.org/archives/list/package-announce%40
roject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-8278 State: PUBLISHED Published: 2020-11-19T00:32:35 Last Updated: 2024-08-04T09:56:28.280Z Vendors: n/a Products: Nextcloud Social Problem Types: CWE-284 Description: Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/921717 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-042
CVE ID: CVE-2020-8279 State: PUBLISHED Published: 2020-11-19T00:32:22 Last Updated: 2024-08-04T09:56:28.267Z Vendors: n/a Products: Nextcloud Social Problem Types: CWE-295 Description: Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/915585 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-043
CVE ID: CVE-2020-8280 State: PUBLISHED Published: 2021-01-06T20:59:57 Last Updated: 2024-08-04T09:56:28.301Z Vendors: n/a Products: Nextcloud Contacts Problem Types: CWE-79 Description: A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/998422 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-044
CVE ID: CVE-2020-8281 State: PUBLISHED Published: 2021-01-06T20:58:09 Last Updated: 2024-08-04T09:56:28.324Z Vendors: n/a Products: Nextcloud Contacts Problem Types: CWE-79 Description: A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/894876 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-045
CVE ID: CVE-2020-8282 State: PUBLISHED Published: 2020-12-14T19:41:42 Last Updated: 2024-08-04T09:56:28.276Z Vendors: n/a Products: EdgePower Problem Types: CWE-352 Description: A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where, due to missing CSRF protections, an attacker would have been able to perform unauthorized remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-advisory-bulletin-016-016/40c1d33d-785e-44d5-8e6c-56a8addef1bc
CVE ID: CVE-2020-8283 State: PUBLISHED Published: 2020-12-14T19:40:18 Last Updated: 2024-08-04T09:56:28.332Z Vendors: n/a Products: Citrix Virtual Apps and Desktops Problem Types: CWE-269 Description: An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX285059
CVE ID: CVE-2020-8284 State: PUBLISHED Published: 2020-12-14T19:38:26 Last Updated: 2024-08-04T09:56:28.316Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-200 Description: A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1040166 - https://curl.se/docs/CVE-2020-8284.html - https://lists.fedoraproject.org/archives/
ps://hackerone.com/reports/1040166 - https://curl.se/docs/CVE-2020-8284.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ - https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ - https://security.gentoo.org/glsa/202012-14 - https://www.debian.org/security/2021/dsa-4881 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210122-0007/ - https://support.apple.com/kb/HT212325 - https://support.apple.com/kb/HT212326
.netapp.com/advisory/ntap-20210122-0007/ - https://support.apple.com/kb/HT212325 - https://support.apple.com/kb/HT212326 - https://support.apple.com/kb/HT212327 - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-8285 State: PUBLISHED Published: 2020-12-14T19:39:04 Last Updated: 2024-08-04T09:56:28.307Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-674 Description: curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1045844 - https://github.com/curl/curl/issues/6255 - https://curl.se/docs/CVE-2020-8285.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ - https://lists.debian.org/debian-lts-announc
nounce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ - https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ - https://security.gentoo.org/glsa/202012-14 - https://www.debian.org/security/2021/dsa-4881 - http://seclists.org/fulldisclosure/2021/Apr/51 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210122-0007/ - https://support.apple.com/kb/HT212325 - https://support.apple.com/kb/HT212326 - https://support.apple.com/kb/HT212327 - https://lists.apache.org/thread.html/rf4c02
ps://support.apple.com/kb/HT212326 - https://support.apple.com/kb/HT212327 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-8286 State: PUBLISHED Published: 2020-12-14T19:39:28 Last Updated: 2024-11-15T15:30:03.757Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-295 Description: curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1048457 - https://curl.se/docs/CVE-2020-8286.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ - https://lists.debian.org/debian-lts-announce/2020/12/m
sts.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ - https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ - https://security.gentoo.org/glsa/202012-14 - https://www.debian.org/security/2021/dsa-4881 - http://seclists.org/fulldisclosure/2021/Apr/51 - http://seclists.org/fulldisclosure/2021/Apr/50 - http://seclists.org/fulldisclosure/2021/Apr/54 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210122-0007/ - https://support.apple.com/kb/HT212325 - https://support.apple.com/kb/HT21232
y.netapp.com/advisory/ntap-20210122-0007/ - https://support.apple.com/kb/HT212325 - https://support.apple.com/kb/HT212326 - https://support.apple.com/kb/HT212327 - https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-8287 State: PUBLISHED Published: 2021-01-06T00:00:00 Last Updated: 2025-04-30T22:24:29.487Z Vendors: NodeJS Products: Node Problem Types: CWE-444 Description: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1002188 - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - https://www.debian.org/security/2021/dsa-4826 - https://lis
.org/en/blog/vulnerability/january-2021-security-releases/ - https://www.debian.org/security/2021/dsa-4826 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/ - https://security.gentoo.org/glsa/202101-07 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://security.netapp.com/advisory/ntap-20210212-0003/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://lists.debian.org/debian-lts-announce/2022/12/msg00009.html
CVE ID: CVE-2020-8288 State: PUBLISHED Published: 2021-01-21T19:13:16 Last Updated: 2024-08-04T09:56:28.391Z Vendors: n/a Products: Rocket.Chat server Problem Types: CWE-79 Description: The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/899954 - https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/ - https://docs.rocket.chat/guides/security/security-updates
CVE ID: CVE-2020-8289 State: PUBLISHED Published: 2020-12-27T01:20:50 Last Updated: 2024-08-04T09:56:28.315Z Vendors: n/a Products: Backblaze Problem Types: CWE-295 Description: Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/818853 - https://youtu.be/W0THXbcX5V8 - https://github.com/geffner/CVE-2020-8289/blob/master/README.md - https://www.backblaze.com
ttps://youtu.be/W0THXbcX5V8 - https://github.com/geffner/CVE-2020-8289/blob/master/README.md - https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/ - http://seclists.org/fulldisclosure/2020/Dec/57 - http://seclists.org/fulldisclosure/2020/Dec/58
CVE ID: CVE-2020-8290 State: PUBLISHED Published: 2020-12-27T01:22:39 Last Updated: 2024-08-04T09:56:28.299Z Vendors: n/a Products: Backblaze Problem Types: CWE-269 Description: Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/818857 - https://youtu.be/OpC6neWd2aM - https://github.com/geffner/CVE-2020-8290/blob/master/README.md
CVE ID: CVE-2020-8291 State: PUBLISHED Published: 2021-10-18T12:48:17 Last Updated: 2024-08-04T09:56:28.388Z Vendors: n/a Products: Rocket.Chat server Problem Types: CWE-79 Description: A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RocketChat/Rocket.Chat/pull/19854
CVE ID: CVE-2020-8292 State: PUBLISHED Published: 2021-01-21T19:13:28 Last Updated: 2024-08-04T09:56:28.322Z Vendors: n/a Products: Rocket.Chat server Problem Types: CWE-79 Description: Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rocket.chat/guides/security/security-updates - https://hackerone.com/reports/962902
CVE ID: CVE-2020-8293 State: PUBLISHED Published: 2021-01-26T16:33:25 Last Updated: 2024-08-04T09:56:28.329Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-400 Description: A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1018146 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-001
CVE ID: CVE-2020-8294 State: PUBLISHED Published: 2021-02-03T16:42:57 Last Updated: 2024-08-04T09:56:28.335Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-79 Description: A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1023787 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-002
CVE ID: CVE-2020-8295 State: PUBLISHED Published: 2021-01-26T17:10:36 Last Updated: 2024-08-04T09:56:28.330Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-400 Description: A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/812754 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-003
CVE ID: CVE-2020-8296 State: PUBLISHED Published: 2021-03-03T17:40:33 Last Updated: 2024-08-04T09:56:28.293Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-257 Description: Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/867164 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-006 - https://github.com/nextcloud/server/pull/21037 - https://github.com/nextcloud/server/issues/17439 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/
CVE ID: CVE-2020-8297 State: PUBLISHED Published: 2021-02-23T18:28:59 Last Updated: 2024-08-04T09:56:28.323Z Vendors: n/a Products: Nextcloud Deck Problem Types: CWE-639 Description: Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/882258 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-007 - https://github.com/nextcloud/deck/pull/1976
CVE ID: CVE-2020-8298 State: PUBLISHED Published: 2021-03-04T19:09:22 Last Updated: 2024-08-04T09:56:28.345Z Vendors: n/a Products: fs-path Problem Types: CWE-77 Description: fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/324491 - https://github.com/pillys/fs-path/pull/6 - https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7
CVE ID: CVE-2020-8299 State: PUBLISHED Published: 2021-06-16T13:08:22 Last Updated: 2024-08-04T09:56:28.408Z Vendors: n/a Products: Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP Edition Problem Types: CWE-400 Description: Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance. Additional Analyst Notes
Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX297155
CVE ID: CVE-2020-8300 State: PUBLISHED Published: 2021-06-16T13:08:16 Last Updated: 2024-08-04T09:56:28.314Z Vendors: n/a Products: Citrix ADC, Citrix Gateway Problem Types: CWE-284 Description: Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX297155
CVE ID: CVE-2020-8315 State: PUBLISHED Published: 2020-01-28T18:35:58 Last Updated: 2024-08-04T09:56:28.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue39401
CVE ID: CVE-2020-8316 State: PUBLISHED Published: 2020-04-14T21:05:19.630359Z Last Updated: 2024-09-16T18:43:36.192Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Vantage Problem Types: CWE-200 Description: A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-30401
CVE ID: CVE-2020-8317 State: PUBLISHED Published: 2020-07-24T16:10:25.529317Z Last Updated: 2024-09-17T00:10:49.213Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Drivers Management Problem Types: CWE-426 Description: A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_190088.html
CVE ID: CVE-2020-8318 State: PUBLISHED Published: 2020-04-14T21:05:20.039847Z Last Updated: 2024-09-16T22:56:31.781Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: LenovoSystemUpdatePlugin for Lenovo System Interface Foundation Problem Types: Privilege escalation Description: A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version that could allow an authenticated user to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-30401