Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
age/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/ - https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html - https://security.gentoo.org/glsa/202101-18 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20201023-0001/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
CVE ID: CVE-2020-26117 State: PUBLISHED Published: 2020-09-27T03:30:25 Last Updated: 2024-08-04T15:49:07.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0 - https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e - https://github.com/TigerVNC/tigervnc/commit/
hub.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e - https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba - https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb - https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b - https://bugzilla.opensuse.org/show_bug.cgi?id=1176733 - https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.html
CVE ID: CVE-2020-26118 State: PUBLISHED Published: 2021-01-11T14:53:26 Last Updated: 2024-08-04T15:49:07.089Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system. Additional Analyst Notes: - CVE Program Contai
a an authenticated attacker to execute commands on the underlying system. Additional Analyst Notes: - CVE Program Container: References: - https://support.smartbear.com/collaborator/docs/server/index.html - https://support.smartbear.com/collaborator/docs/general-info/version-history/ver-13/ver-13-0.html - https://support.smartbear.com/collaborator/docs/general-info/whats-new.html
CVE ID: CVE-2020-26120 State: PUBLISHED Published: 2020-09-27T20:07:52 Last Updated: 2024-08-04T15:49:07.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T262213 - https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea - htt
s://phabricator.wikimedia.org/T262213 - https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-26121 State: PUBLISHED Published: 2020-09-27T20:08:00 Last Updated: 2024-08-04T15:49:07.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can leverage this to force a wiki to have a page with a disallowed title. Additional Analyst Notes: - CVE Program Container: References: - ht
force a wiki to have a page with a disallowed title. Additional Analyst Notes: - CVE Program Container: References: - https://commons.wikimedia.org/w/index.php?oldid=454609892#File:Wiki.png - https://phabricator.wikimedia.org/T262628 - https://gerrit.wikimedia.org/r/q/Ib852a96afc4dca10516d0510e69c10f9892b351b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
CVE ID: CVE-2020-26122 State: PUBLISHED Published: 2020-12-07T15:34:55 Last Updated: 2024-08-04T15:49:07.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism, the attacker who obtains the administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC. Additional Analyst Notes: - CVE Program Container: References: - https:
rrent verification mechanism to upgrade the BMC. Additional Analyst Notes: - CVE Program Container: References: - https://en.inspur.com/en/2487134/index.html - https://en.inspur.com/en/security_bulletins/security_advisory2/2543921/index.html
CVE ID: CVE-2020-26124 State: PUBLISHED Published: 2020-10-02T08:28:03 Last Updated: 2024-08-04T15:49:07.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d - https://www.openmediavault.org/?p=2797 - http://pac
ult/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d - https://www.openmediavault.org/?p=2797 - http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html
CVE ID: CVE-2020-26129 State: PUBLISHED Published: 2020-11-16T15:09:55 Last Updated: 2024-08-04T15:49:07.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-26130 State: PUBLISHED Published: 2020-10-28T00:00:00 Last Updated: 2024-08-04T15:49:07.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenTFTPServerMT.exe or the OpenTFTPServerSP.exe binary. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/tftp-server/ - https://github.com/an0ry/advisories - https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26130.md
CVE ID: CVE-2020-26131 State: PUBLISHED Published: 2020-10-28T00:00:00 Last Updated: 2024-08-04T15:49:07.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenDHCPServer.exe (Regular) or the OpenDHCPLdap.exe (LDAP Based) binary. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/dhcpserver/ - https://github.com/an0ry/advisories - https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26131.md
CVE ID: CVE-2020-26132 State: PUBLISHED Published: 2020-10-28T00:00:00 Last Updated: 2024-08-04T15:49:07.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the HomeDNSServer.exe binary. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/dnsserver/ - https://github.com/an0ry/advisories - https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26132.md
CVE ID: CVE-2020-26133 State: PUBLISHED Published: 2020-10-28T00:00:00 Last Updated: 2024-08-04T15:49:07.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the DualServer.exe binary. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/dhcp-dns-server/ - https://github.com/an0ry/advisories - https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26133.md
CVE ID: CVE-2020-26134 State: PUBLISHED Published: 2020-10-02T08:29:04 Last Updated: 2024-08-04T15:49:07.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode. Additional Analyst Notes: - CVE Program Container: References: - https://livehelperchat.com/3.44v-security-update-and-few-other-bits-586a.html - https://github.com/LiveHelperChat/livehelperchat/commit/a131b937dd6a87271ed1c0c8b8deb8710cf78f58 - https://github.com/rekter0/exploits/tree/master/CVE-2020-26134
CVE ID: CVE-2020-26135 State: PUBLISHED Published: 2020-10-02T08:29:28 Last Updated: 2024-08-04T15:49:07.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - https://livehelperchat.com/3.44v-security-update-and-few-other-bits-586a.html - https://github.com/LiveHelperChat/livehelperchat/commit/a131b937dd6a87271ed1c0c8b8deb8710cf78f58 - https://github.com/rekter0/exploits/tree/master/CVE-2020-26134 - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26136 State: PUBLISHED Published: 2021-06-08T19:37:45 Last Updated: 2024-08-04T15:49:07.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/cve-2020-26136
CVE ID: CVE-2020-26137 State: PUBLISHED Published: 2020-09-29T00:00:00 Last Updated: 2024-08-04T15:49:07.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue39603 - https://github.com/urllib3/urllib3/pull/1800 - https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b - https://usn.ubuntu.com/4570-1/ - https://lists.debian.org/debian-
lib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b - https://usn.ubuntu.com/4570-1/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
CVE ID: CVE-2020-26138 State: PUBLISHED Published: 2021-06-08T17:35:06 Last Updated: 2024-08-04T15:49:07.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/cve-2020-26138
CVE ID: CVE-2020-26139 State: PUBLISHED Published: 2021-05-11T19:37:55 Last Updated: 2024-08-04T15:49:07.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcE
Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26140 State: PUBLISHED Published: 2021-05-11T19:34:42 Last Updated: 2024-08-04T15:49:07.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMM
sory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26141 State: PUBLISHED Published: 2021-05-11T19:42:11 Last Updated: 2024-08-04T15:49:07.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - ht
ls.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26142 State: PUBLISHED Published: 2021-05-11T19:41:14 Last Updated: 2024-08-04T15:49:07.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/li
ttps://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26143 State: PUBLISHED Published: 2021-05-11T19:36:38 Last Updated: 2024-08-04T15:49:07.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blo
oSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26144 State: PUBLISHED Published: 2021-05-11T19:33:04 Last Updated: 2024-08-04T15:49:07.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.c
s://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26145 State: PUBLISHED Published: 2021-05-11T19:35:10 Last Updated: 2024-08-04T15:49:07.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/
://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
CVE ID: CVE-2020-26146 State: PUBLISHED Published: 2021-05-11T19:39:07 Last Updated: 2024-08-04T15:49:07.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/co
k by design. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26147 State: PUBLISHED Published: 2021-05-11T19:40:19 Last Updated: 2024-08-04T15:49:07.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - htt
er: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu - https://www.fragattacks.com - https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md - http://www.openwall.com/lists/oss-security/2021/05/11/12 - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html - https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf - https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
CVE ID: CVE-2020-26148 State: PUBLISHED Published: 2020-09-29T18:48:41 Last Updated: 2024-08-04T15:49:07.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) via a malformed Markdown document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mity/md4c/issues/130
CVE ID: CVE-2020-26149 State: PUBLISHED Published: 2020-09-30T12:05:31 Last Updated: 2024-08-04T15:49:07.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nats-io/nats.deno/compare/v1.0.0-8...v1.0.0-9 - https://github.com/nats-io/nats.ws/commit/0a37ac2a411ff63f0707cda69a268c5fc4079eb7 - http://www.openwall.com/lists/oss-security/2020/09/30/3