Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35529 State: REJECTED Published: 2022-09-01T17:49:05 Last Updated: 2022-09-01T17:49:05 Description: No description available.
CVE ID: CVE-2020-35530 State: PUBLISHED Published: 2022-09-01T17:52:13 Last Updated: 2024-08-04T17:02:08.174Z Vendors: n/a Products: LibRaw Problem Types: CWE-787 Description: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/272 - https://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66a1eeb - https://lists.debian.org/debian-lts-announce/2022/09/msg00024.html
CVE ID: CVE-2020-35531 State: PUBLISHED Published: 2022-09-01T17:52:06 Last Updated: 2024-08-04T17:02:08.127Z Vendors: n/a Products: LibRaw Problem Types: CWE-125 Description: In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/270 - https://github.com/LibRaw/LibRaw/commit/d75af00681a74dcc8b929207eb895611a6eceb68 - https://lists.debian.org/debian-lts-announce/2022/09/msg00024.html
CVE ID: CVE-2020-35532 State: PUBLISHED Published: 2022-09-01T17:51:59 Last Updated: 2024-08-04T17:02:08.093Z Vendors: n/a Products: LibRaw Problem Types: CWE-125 Description: In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/271 - https://github.com/LibRaw/LibRaw/commit/5ab45b085898e379fedc6b113e2e82a890602b1e - https://lists.debian.org/debian-lts-announce/2022/09/msg00024.html
CVE ID: CVE-2020-35533 State: PUBLISHED Published: 2022-09-01T17:54:32 Last Updated: 2024-08-04T17:02:08.243Z Vendors: n/a Products: LibRaw Problem Types: CWE-125 Description: In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/273 - https://github.com/LibRaw/LibRaw/commit/a6937d4046a7c4742b683a04c8564605fd9be4fb - https://lists.debian.org/debian-lts-announce/2022/09/msg00024.html
CVE ID: CVE-2020-35534 State: PUBLISHED Published: 2022-09-01T17:54:28 Last Updated: 2024-08-04T17:02:08.125Z Vendors: n/a Products: LibRaw Problem Types: CWE-400 Description: In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/279 - https://github.com/LibRaw/LibRaw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8
CVE ID: CVE-2020-35535 State: PUBLISHED Published: 2022-09-01T17:54:23 Last Updated: 2024-08-04T17:02:07.985Z Vendors: n/a Products: LibRaw Problem Types: CWE-125 Description: In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/283 - https://github.com/LibRaw/LibRaw/commit/c243f4539233053466c1309bde606815351bee81
CVE ID: CVE-2020-35536 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-35537 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-35538 State: PUBLISHED Published: 2022-08-31T15:33:04 Last Updated: 2024-08-04T17:02:08.152Z Vendors: n/a Products: libjpeg-turbo Problem Types: CWE-476 Description: A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/441 - https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30
CVE ID: CVE-2020-35539 State: REJECTED Published: 2022-10-17T15:56:25.785Z Last Updated: 2025-02-13T15:46:13.923Z Description: No description available.
CVE ID: CVE-2020-35540 State: REJECTED Published: 2021-09-21T19:12:48 Last Updated: 2021-09-21T19:12:48 Description: No description available.
CVE ID: CVE-2020-35541 State: REJECTED Published: 2021-09-21T19:14:06 Last Updated: 2021-09-21T19:14:06 Description: No description available.
CVE ID: CVE-2020-35542 State: PUBLISHED Published: 2021-04-27T10:51:16 Last Updated: 2024-08-04T17:02:08.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field. This could be used for an XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=61
CVE ID: CVE-2020-35545 State: PUBLISHED Published: 2020-12-17T19:46:25 Last Updated: 2024-08-04T17:02:08.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Time-based SQL injection exists in Spotweb 1.4.9 via the query string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spotweb/spotweb/issues/629
CVE ID: CVE-2020-35546 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T15:20:22.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://support.lexmark.com - https://publications.lexmark.com/publications/security-alerts/CVE-2020-35546.pdf
CVE ID: CVE-2020-35547 State: PUBLISHED Published: 2021-01-29T06:27:08 Last Updated: 2024-08-04T17:02:08.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0016
CVE ID: CVE-2020-35548 State: PUBLISHED Published: 2020-12-18T08:46:00 Last Updated: 2024-08-04T17:02:08.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider allows attackers to cause a denial of service. The Samsung ID is SVE-2020-18629 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-35549 State: PUBLISHED Published: 2020-12-18T08:45:43 Last Updated: 2024-08-04T17:02:08.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establish itself as the default dialer, without user interaction. The Samsung ID is SVE-2020-19172 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-35550 State: PUBLISHED Published: 2020-12-18T08:45:32 Last Updated: 2024-08-04T17:02:08.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via StatusBar. The Samsung ID is SVE-2020-17888 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-35551 State: PUBLISHED Published: 2020-12-18T08:45:01 Last Updated: 2024-08-04T17:02:08.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-change attacks because an unauthorized RPMB write operation can be replayed, a related issue to CVE-2020-13799. The Samsung ID is SVE-2020-18100 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-35552 State: PUBLISHED Published: 2020-12-18T08:44:49 Last Updated: 2024-08-04T17:02:08.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chipsets) software. Attackers can obtain sensitive location information because the configuration file is incorrect. The Samsung ID is SVE-2020-18678 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-35553 State: PUBLISHED Published: 2020-12-18T08:44:36 Last Updated: 2024-08-04T17:09:13.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software. They allows attackers to cause a denial of service (unlock failure) by triggering a power-shortage incident that causes a false-positive attack detection. The Samsung ID is SVE-2020-19678 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-35554 State: PUBLISHED Published: 2020-12-18T08:44:17 Last Updated: 2024-08-04T17:09:13.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. There is a WebView SSL error-handler vulnerability. The LG ID is LVE-SMP-200026 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2020-35555 State: PUBLISHED Published: 2020-12-18T08:44:06 Last Updated: 2024-08-04T17:09:13.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 (December 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2020-35556 State: PUBLISHED Published: 2021-02-22T02:17:53 Last Updated: 2024-08-04T17:09:13.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.acronis.com - https://dl.managed-protection.com/u/cyberprotect/rn/15/user/en-US/AcronisCyberProtect15_relnotes.htm
CVE ID: CVE-2020-35557 State: PUBLISHED Published: 2021-02-16T15:16:06.296170Z Last Updated: 2024-09-16T17:42:40.485Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the account he should not have access to due to improper use of access validation. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VD
nnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VDE-2022-039
CVE ID: CVE-2020-35558 State: PUBLISHED Published: 2021-02-16T15:26:11.394978Z Last Updated: 2024-09-16T20:02:23.622Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde
ences: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VDE-2022-039
CVE ID: CVE-2020-35559 State: PUBLISHED Published: 2021-02-16T15:42:20 Last Updated: 2024-08-04T17:09:13.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35560 State: PUBLISHED Published: 2021-02-16T15:28:01 Last Updated: 2024-08-04T17:09:13.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35561 State: PUBLISHED Published: 2021-02-16T15:49:45.850093Z Last Updated: 2024-09-16T18:08:12.511Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VDE-2022-039
CVE ID: CVE-2020-35563 State: PUBLISHED Published: 2021-02-16T15:30:20 Last Updated: 2024-08-04T17:09:13.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into the page. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35564 State: PUBLISHED Published: 2021-02-16T15:35:21 Last Updated: 2024-08-04T17:09:13.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35565 State: PUBLISHED Published: 2021-02-16T15:47:27 Last Updated: 2024-08-04T17:09:13.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35566 State: PUBLISHED Published: 2021-02-16T15:40:07.656065Z Last Updated: 2024-09-16T22:31:00.471Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VDE-2022-039
CVE ID: CVE-2020-35567 State: PUBLISHED Published: 2021-02-16T15:45:56 Last Updated: 2024-08-04T17:09:13.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across instances. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35568 State: PUBLISHED Published: 2021-02-16T15:44:10.164584Z Last Updated: 2024-09-17T03:48:34.741Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories
: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VDE-2022-039
CVE ID: CVE-2020-35569 State: PUBLISHED Published: 2021-02-16T15:37:53 Last Updated: 2024-08-04T17:09:13.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/de-de/advisories/vde-2021-003
CVE ID: CVE-2020-35570 State: PUBLISHED Published: 2021-02-16T15:23:53.959468Z Last Updated: 2024-09-16T19:51:23.987Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing. Additional Analyst Notes: - CVE Program Container: References: - https://mbconnectline.com/security-advice/ - https://cert.vde.com/en/advisories/VDE-2021-003 - https://cert.vde.com/en/advisories/VDE-2022-039
CVE ID: CVE-2020-35571 State: PUBLISHED Published: 2021-02-22T02:23:53 Last Updated: 2024-08-04T17:09:13.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=27768
CVE ID: CVE-2020-35572 State: PUBLISHED Published: 2021-02-09T17:55:56 Last Updated: 2024-08-04T17:09:13.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adminer through 4.7.8 allows XSS via the history parameter to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/adminer/news/ - https://sourceforge.net/p/adminer/bugs-and-features/775/
CVE ID: CVE-2020-35573 State: PUBLISHED Published: 2020-12-20T04:53:41 Last Updated: 2024-08-04T17:09:13.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac - https://lists.debian.org/debian-lts-announce/2020/12/msg00031.html - https://security.gentoo.org/glsa/202107-08
CVE ID: CVE-2020-35575 State: PUBLISHED Published: 2020-12-26T02:02:45 Last Updated: 2024-08-04T17:09:13.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.t
1HP, WR945N, WR949N, and WRD4300 devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - https://static.tp-link.com/2020/202012/20201214/wa901ndv5_eu_3_16_9_up_boot%28201211%29.zip - https://pastebin.com/F8AuUdck - http://packetstormsecurity.com/files/163274/TP-Link-TL-WR841N-Command-Injection.html
CVE ID: CVE-2020-35576 State: PUBLISHED Published: 2021-01-25T00:00:00 Last Updated: 2024-08-04T17:09:14.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - https://jvn.jp/en/vu/JVNVU92444096/ - https://www.tp-link.com/jp/support/download/tl-wr841n/v13/#Firmware
CVE ID: CVE-2020-35577 State: PUBLISHED Published: 2021-02-18T13:43:31 Last Updated: 2024-08-04T17:09:14.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number). Additional Analyst Notes: - CVE Program Container: References: - https://www.endalia.com/en/software/ - https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-35577
CVE ID: CVE-2020-35578 State: PUBLISHED Published: 2021-01-13T20:19:50 Last Updated: 2024-08-04T17:09:14.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://www.nagios.com/products/security/ - http://packetstormsecurity.com/files/160948/Nagios-XI-5.7.x-Remote-Code-Execution.html - http://packetstormsecurity.com/files/162207
tstormsecurity.com/files/160948/Nagios-XI-5.7.x-Remote-Code-Execution.html - http://packetstormsecurity.com/files/162207/Nagios-XI-Remote-Code-Execution.html