Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13160 State: PUBLISHED Published: 2020-06-09T16:36:17 Last Updated: 2024-08-04T12:11:19.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.anydesk.com/changelog.txt - https://devel0pment.de/?p=1881 - http://packetstormsecurity.com/files/158291/AnyDesk-GUI-Format-String-Write.html - http://packetstormsecurity.com/files/161628/AnyDesk-5.5.2-Remote-Code-Execution.html
CVE ID: CVE-2020-13162 State: PUBLISHED Published: 2020-06-16T19:41:18.000Z Last Updated: 2025-05-05T17:08:09.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/?atype=sa - https://twitter.com/sepcali/status/1262551597990711296 - http://seclists.org/fulldisclosure/2020/Jun/25 - https://www.redtimmy
//twitter.com/sepcali/status/1262551597990711296 - http://seclists.org/fulldisclosure/2020/Jun/25 - https://www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/ - http://packetstormsecurity.com/files/158117/Pulse-Secure-Client-For-Windows-Local-Privilege-Escalation.html - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44503 - https://twitter.com/gsepcali/status/1262551597990711296 - https://twitter.com/gsepcali/status/1272927080909623297 - http://seclists.org/fulldisclosure/2020/Sep/15 - http://packetstormsecurity.com/files/159065/Pulse-Secure-Windows-Client-Privilege-Escalation.html
CVE ID: CVE-2020-13163 State: PUBLISHED Published: 2020-05-19T21:22:57 Last Updated: 2024-08-04T12:11:19.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ConradIrwin/em-imap/issues/25 - https://securitylab.github.com/advisories/GHSL-2020-095-conradirwin-em-imap
CVE ID: CVE-2020-13164 State: PUBLISHED Published: 2020-05-19T21:26:42 Last Updated: 2024-08-04T12:11:19.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory graph on a filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16476 - https://www.wireshark.org/security/wnpa-sec-2020-08.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e6e98eab8e5e0bbc982cfdc808f2469
c-2020-08.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e6e98eab8e5e0bbc982cfdc808f2469d7cab6c5a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5UOISPQTRCZGQLKBVXEDL72AEXEHS425/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNV3EYL4JBWCR22TJO3PH7ADUVS5RWSU/ - https://security.gentoo.org/glsa/202007-13 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2020-13166 State: PUBLISHED Published: 2020-05-19T19:29:59 Last Updated: 2024-08-04T12:11:19.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/ - http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html
CVE ID: CVE-2020-13167 State: PUBLISHED Published: 2020-05-19T19:29:41 Last Updated: 2024-08-04T12:11:19.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
CVE ID: CVE-2020-13168 State: PUBLISHED Published: 2020-10-02T08:34:03 Last Updated: 2024-08-04T12:11:19.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysaid.com/product/on-premise/latest-release - https://github.com/lodestone-security/CVEs/tree/master/CVE-2020-13168
CVE ID: CVE-2020-13169 State: PUBLISHED Published: 2020-09-17T17:40:15 Last Updated: 2024-08-04T12:11:19.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges (takeover of administrator account). Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-1_release_notes.htm#NewFeaturesOrion
CVE ID: CVE-2020-13170 State: PUBLISHED Published: 2020-06-11T19:41:25 Last Updated: 2024-08-04T12:11:19.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md - https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md - https://github.com/hashicorp/consul/pull/8068
CVE ID: CVE-2020-13173 State: PUBLISHED Published: 2020-05-28T21:05:33 Last Updated: 2024-08-04T12:11:19.421Z Vendors: n/a Products: PCoIP Standard Agent for Windows, PCoIP Graphics Agent for Windows Problem Types: Information Disclosure, Privilege Escalation Description: Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, which allows an attacker to intercept sensitive information or possibly elevate privileges via pre-installing an application which acquires that named pipe. Additional Analyst Notes: - CVE Program Container: References: - https://adviso
lication which acquires that named pipe. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/55/
CVE ID: CVE-2020-13174 State: PUBLISHED Published: 2020-08-11T17:31:57 Last Updated: 2024-08-04T12:11:19.389Z Vendors: n/a Products: - Management Console Problem Types: CWE-1021 Description: The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/58/
CVE ID: CVE-2020-13175 State: PUBLISHED Published: 2020-08-11T17:40:37 Last Updated: 2024-08-04T12:11:19.554Z Vendors: n/a Products: - Cloud Access Connector - Cloud Access Connector Legacy Problem Types: CWE-98 Description: The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/59/
CVE ID: CVE-2020-13176 State: PUBLISHED Published: 2020-08-11T17:40:55 Last Updated: 2024-08-04T12:11:19.402Z Vendors: n/a Products: - Cloud Access Connector - Cloud Access Connector Legacy Problem Types: CWE-79 Description: The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application. Additional Analyst Notes: - CVE Program C
which is executed when an administrator views the logs within the application. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/59/
CVE ID: CVE-2020-13177 State: PUBLISHED Published: 2020-08-11T17:47:23 Last Updated: 2024-08-04T12:11:19.387Z Vendors: n/a Products: - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows Problem Types: CWE-427 Description: The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded paths for certain Windows binaries, which allows an attacker to gain elevated privileges via execution of a malicious binary placed in the system path. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/60/
CVE ID: CVE-2020-13178 State: PUBLISHED Published: 2020-08-11T17:50:43 Last Updated: 2024-08-04T12:11:19.416Z Vendors: n/a Products: - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows Problem Types: CWE-345 Description: A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly validate the signature of an external binary, which could allow an attacker to gain elevated privileges via execution in the context of the PCoIP Agent process. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/60/
CVE ID: CVE-2020-13179 State: PUBLISHED Published: 2020-08-11T18:06:27 Last Updated: 2024-08-04T12:11:19.479Z Vendors: n/a Products: - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows Problem Types: CWE-200 Description: Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in server memory, which may allow an attacker to read confidential information from a memory dump via forcing a crashing during the single sign-on procedure. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/60/
CVE ID: CVE-2020-13183 State: PUBLISHED Published: 2020-08-17T20:31:06 Last Updated: 2024-08-04T12:11:19.444Z Vendors: n/a Products: Teradici PCoIP Management Console Problem Types: Reflected Cross Site Scripting Description: Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user is exposed to a malicious payload. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/63/
CVE ID: CVE-2020-13185 State: PUBLISHED Published: 2021-02-11T15:10:16 Last Updated: 2024-08-04T12:11:19.426Z Vendors: n/a Products: - Cloud Access Connector - Cloud Access Connector Legacy Problem Types: CWE-288 Description: Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/69/
CVE ID: CVE-2020-13186 State: PUBLISHED Published: 2021-02-11T15:14:48 Last Updated: 2024-08-04T12:11:19.410Z Vendors: n/a Products: - Cloud Access Connector - Cloud Access Connector Legacy Problem Types: CWE-352 Description: An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.teradici.com/security-advisories/70/
CVE ID: CVE-2020-13187 State: REJECTED Published: 2021-01-22T21:43:42 Last Updated: 2021-01-22T21:43:42 Description: No description available.
CVE ID: CVE-2020-13188 State: REJECTED Published: 2021-01-22T21:43:42 Last Updated: 2021-01-22T21:43:42 Description: No description available.
CVE ID: CVE-2020-13189 State: REJECTED Published: 2021-01-22T21:43:42 Last Updated: 2021-01-22T21:43:42 Description: No description available.
CVE ID: CVE-2020-13190 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13191 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13192 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13193 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13194 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13195 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13196 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13197 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13198 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13199 State: REJECTED Published: 2021-01-22T21:43:43 Last Updated: 2021-01-22T21:43:43 Description: No description available.
CVE ID: CVE-2020-13200 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13201 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13202 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13203 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13204 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13205 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13206 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13207 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13208 State: REJECTED Published: 2021-01-22T21:43:44 Last Updated: 2021-01-22T21:43:44 Description: No description available.
CVE ID: CVE-2020-13209 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13210 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13211 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13212 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13213 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13214 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13215 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13216 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13217 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13218 State: REJECTED Published: 2021-01-22T21:43:45 Last Updated: 2021-01-22T21:43:45 Description: No description available.
CVE ID: CVE-2020-13219 State: REJECTED Published: 2021-01-22T21:43:46 Last Updated: 2021-01-22T21:43:46 Description: No description available.
CVE ID: CVE-2020-13220 State: REJECTED Published: 2021-01-22T21:43:46 Last Updated: 2021-01-22T21:43:46 Description: No description available.
CVE ID: CVE-2020-13221 State: REJECTED Published: 2021-01-22T21:43:46 Last Updated: 2021-01-22T21:43:46 Description: No description available.
CVE ID: CVE-2020-13222 State: REJECTED Published: 2021-01-22T21:43:46 Last Updated: 2021-01-22T21:43:46 Description: No description available.
CVE ID: CVE-2020-13223 State: PUBLISHED Published: 2020-06-10T18:45:28 Last Updated: 2024-08-04T12:11:19.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault/ - https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
CVE ID: CVE-2020-13224 State: PUBLISHED Published: 2020-06-17T12:13:36 Last Updated: 2024-08-04T12:11:19.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC230 devices through 1.3.1 build 200401, NC250 devices through 1.3.1 build 200401, NC260 devices through 1.5.3 build_200401, and NC450 devices through 1.5.4 build 200401 have a Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - http://packetstormsecurity.com/files/158115/TP-LINK-Cloud-Cameras-NCXXX-Stack-Overflow.html
CVE ID: CVE-2020-13225 State: PUBLISHED Published: 2020-05-20T03:05:27 Last Updated: 2024-08-04T12:11:19.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/3025 - https://www.youtube.com/watch?v=SpFmM03Jl40
CVE ID: CVE-2020-13226 State: PUBLISHED Published: 2020-05-20T11:42:27 Last Updated: 2024-08-04T12:11:19.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/WSO2+Security+Vulnerability+Management+Process - https://docs.wso2.com/display/Security/Security+Advisories - https://github.com/wso2/product-apim/issues/7677 - https://github.com/wso2/docs-apim/issues/816
CVE ID: CVE-2020-13227 State: PUBLISHED Published: 2020-06-02T13:52:28 Last Updated: 2024-08-04T12:11:19.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wrongsid3 - https://pasteboard.co/J9eF12G.png - https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.md
CVE ID: CVE-2020-13228 State: PUBLISHED Published: 2020-06-02T13:51:45 Last Updated: 2024-08-04T12:11:19.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wrongsid3 - https://pasteboard.co/J9eE2GQ.png - https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.md - http://packetstormsecurity.com/files/158062/Sysax-MultiServer-6.90-Cross-Site-Scripting.html
CVE ID: CVE-2020-13229 State: PUBLISHED Published: 2020-06-02T13:44:11 Last Updated: 2024-08-04T12:11:19.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wrongsid3 - https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.md
CVE ID: CVE-2020-13230 State: PUBLISHED Published: 2020-05-20T13:40:45 Last Updated: 2024-08-04T12:11:19.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/3343 - https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.
.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
CVE ID: CVE-2020-13231 State: PUBLISHED Published: 2020-05-20T13:54:08 Last Updated: 2024-08-04T12:11:19.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11 - https://github.com/Cacti/cacti/issues/3342 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO/