Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-14023 State: PUBLISHED Published: 2020-09-22T17:35:58 Last Updated: 2024-08-04T12:32:14.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS. Additional Analyst Notes: - CVE Program Container: References: - https://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14023-Server%20Side%20Request%20Forgery-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14024 State: PUBLISHED Published: 2020-09-22T17:39:20 Last Updated: 2024-08-04T12:32:14.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuration, or (4) any GET Parameter in the /default URL of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master
tainer: References: - https://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14024-Multiple%20XSS-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14025 State: PUBLISHED Published: 2020-09-22T17:41:28 Last Updated: 2024-08-04T12:32:14.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as installing new modules or changing a password. Additional Analyst Notes: - CVE Program Container: References: - https://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14025-Cross-Site%20Request%20Forgery-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14026 State: PUBLISHED Published: 2020-09-22T17:32:28 Last Updated: 2024-08-04T12:32:14.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export. Additional Analyst Notes: - CVE Program Container: References: - https://www.ozeki.hu/index.php?owpn=231 - https://www.ozeki.hu/index.php?ow_page_number=1017&downloadaction=email&download_product_id=1&os=windows&dpath=%2Fattachments%2F702%2Finstallwindows_1590575794_OzekiNG-SMS-Gateway_4.17.6.zip&dname=Ozeki+NG+SMS+Gateway+v4.17.6&dsize=+
Fattachments%2F702%2Finstallwindows_1590575794_OzekiNG-SMS-Gateway_4.17.6.zip&dname=Ozeki+NG+SMS+Gateway+v4.17.6&dsize=+%2817.8+MB%29&platform=Windows - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14026-Formula%20Injection-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14027 State: PUBLISHED Published: 2020-09-22T17:23:31 Last Updated: 2024-08-04T12:32:14.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, that can be leveraged by attackers to enable MySQL Load Data Local (rogue MySQL server) attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14027-MySQL%20LOAD%20DATA%20LOCAL%20INFILE%20Attack-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14028 State: PUBLISHED Published: 2020-09-22T17:21:26 Last Updated: 2024-08-04T12:32:14.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14028-Arbitary%20File%20Write-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14029 State: PUBLISHED Published: 2020-09-18T17:14:04 Last Updated: 2024-08-04T12:32:14.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files. Additional Analyst Notes: - CVE Program Container: References: - http://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14029-XXE-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14030 State: PUBLISHED Published: 2020-09-29T13:08:12 Last Updated: 2024-08-04T12:32:14.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14030-RCE%20via%20.NET%20Deserialization-Ozeki%20SMS%20G
tps://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14030-RCE%20via%20.NET%20Deserialization-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14031 State: PUBLISHED Published: 2020-09-22T17:19:05 Last Updated: 2024-08-04T12:32:14.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folder. Because the product usually runs as NT AUTHORITY\SYSTEM, the only files that will not be deleted are those currently being run by the system and/or files that have special security attributes (e.g., Windows Defender files). Additional Analyst Notes: - CVE Program Container: References: - http://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclo
- CVE Program Container: References: - http://www.ozeki.hu/index.php?owpn=231 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14031-Arbitary%20File%20Delete-Ozeki%20SMS%20Gateway
CVE ID: CVE-2020-14032 State: PUBLISHED Published: 2021-07-23T10:13:07 Last Updated: 2024-08-04T12:32:14.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.asrock.com/support/index.us.asp?cat=BIOS - https://dannyodler.medium.com/attacking-the-golden-ring-on-amd-mini-pc-b7bfb217b437
CVE ID: CVE-2020-14033 State: PUBLISHED Published: 2020-06-15T16:11:14 Last Updated: 2024-08-04T12:32:14.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_streaming_rtsp_parse_sdp in plugins/janus_streaming.c has a Buffer Overflow via a crafted RTSP server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/meetecho/janus-gateway/blob/v0.10.0/plugins/janus_streaming.c#L6117 - https://github.com/meetecho/janus-gateway/blob/v0.10.0/plugins/janus_streaming.c#L6166 - https://github.com/meetecho/janus-gateway/pull/2229
CVE ID: CVE-2020-14034 State: PUBLISHED Published: 2020-06-15T16:10:34 Last Updated: 2024-08-04T12:32:14.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_get_codec_from_pt in utils.c has a Buffer Overflow via long value in an SDP Offer packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/meetecho/janus-gateway/blob/v0.10.0/utils.c#L381 - https://github.com/meetecho/janus-gateway/blob/v0.10.0/utils.c#L401 - https://github.com/meetecho/janus-gateway/pull/2229
CVE ID: CVE-2020-14039 State: PUBLISHED Published: 2020-07-17T15:43:33 Last Updated: 2024-08-04T12:32:14.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/golang-announce - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html
use-security-announce/2020-07/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w - https://security.netapp.com/advisory/ntap-20200731-0005/
CVE ID: CVE-2020-14040 State: PUBLISHED Published: 2020-06-17T19:22:31 Last Updated: 2024-08-04T12:32:14.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#
ext/transform.String. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/golang-announce/bXVeAmGOqz0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
CVE ID: CVE-2020-14042 State: PUBLISHED Published: 2020-08-25T14:43:48 Last Updated: 2024-08-04T12:32:14.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Codiad/Codiad/blob/master/README.md - https://github.com/Codiad/Codiad/issues/1122 - htt
eferences: - https://github.com/Codiad/Codiad/blob/master/README.md - https://github.com/Codiad/Codiad/issues/1122 - https://advisory.checkmarx.net/advisory/CX-2020-4278
CVE ID: CVE-2020-14043 State: PUBLISHED Published: 2020-08-24T15:34:43 Last Updated: 2024-08-04T12:32:14.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins to make a vulnerable request without them knowing and result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors." Additional Analyst Notes: - CVE Program Conta
tates "Codiad is no longer under active maintenance by core contributors." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Codiad/Codiad/blob/master/README.md - https://github.com/Codiad/Codiad/issues/1122 - https://advisory.checkmarx.net/advisory/CX-2020-4279
CVE ID: CVE-2020-14044 State: PUBLISHED Published: 2020-08-24T15:34:08 Last Updated: 2024-08-04T12:32:14.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Codiad/Codiad/blob/master/
ibutors." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Codiad/Codiad/blob/master/README.md - https://github.com/Codiad/Codiad/issues/1122 - https://advisory.checkmarx.net/advisory/CX-2020-4280
CVE ID: CVE-2020-14048 State: PUBLISHED Published: 2020-06-12T01:41:42 Last Updated: 2024-08-04T12:32:14.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/on-premises/readme.html - https://gitlab.com/eLeN3Re/CVE-2020-14048
CVE ID: CVE-2020-14049 State: PUBLISHED Published: 2020-06-22T17:27:35 Last Updated: 2024-08-04T12:32:14.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this issue exists because of an incomplete fix for CVE-2019-12569. Additional Analyst Notes: - CVE Program Container: References: - https://www.viber.com/en/security/ - https://jeffs.sh/CVEs/CVE-2020-14049.txt
CVE ID: CVE-2020-14054 State: PUBLISHED Published: 2020-06-15T15:50:54 Last Updated: 2024-08-04T12:32:14.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to bypass admin authentication via a SQL injection attack that uses the User Name or Password field on the login page. Additional Analyst Notes: - CVE Program Container: References: - http://www.hemayate.com/?page_id=3683
CVE ID: CVE-2020-14055 State: PUBLISHED Published: 2020-07-01T16:10:29 Last Updated: 2024-08-04T12:32:14.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding. Additional Analyst Notes: - CVE Program Container: References: - https://www.monstaftp.com/notes/ - https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191211-01_Monsta_FTP_Stored_XSS
CVE ID: CVE-2020-14056 State: PUBLISHED Published: 2020-07-01T16:06:43 Last Updated: 2024-08-04T12:32:14.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services. Additional Analyst Notes: - CVE Program Container: References: - https://www.monstaftp.com/notes/ - https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-02_Monsta_FTP_Server-Side_Request_Forgery
CVE ID: CVE-2020-14057 State: PUBLISHED Published: 2020-07-01T16:13:42 Last Updated: 2024-08-04T12:32:14.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to gain remote code execution in common deployments. Additional Analyst Notes: - CVE Program Container: References: - https://www.monstaftp.com/notes/ - https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-01_Monsta_FTP_Arbitrary_File_Read_and_Write
CVE ID: CVE-2020-14058 State: PUBLISHED Published: 2020-06-30T18:30:56 Last Updated: 2024-08-04T12:32:14.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v5/ch
error string. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v5/changesets/squid-5-c6d1a4f6a2cbebceebc8a3fcd8f539ceb7b7f723.patch - http://www.squid-cache.org/Versions/v4/changesets/squid-4-93f5fda134a2a010b84ffedbe833d670e63ba4be.patch - http://www.squid-cache.org/Advisories/SQUID-2020_6.txt - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3RG5FGSTCAYVIJPJHIY3MRZ7NFT6HDO7/ - https://security.netapp.com/advisory/ntap-20210312-0001/
CVE ID: CVE-2020-14059 State: PUBLISHED Published: 2020-06-30T18:23:39 Last Updated: 2024-08-04T12:32:14.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v5/changesets/squid-5-7a5af8db8e0377c06ed9ffbdcb1334389c7cd8ab.patch - http://www.squid-cache.org/Advisories/SQUID-2020_5.txt - https://security.netapp.com/advisory/n
cb1334389c7cd8ab.patch - http://www.squid-cache.org/Advisories/SQUID-2020_5.txt - https://security.netapp.com/advisory/ntap-20210312-0001/
CVE ID: CVE-2020-14060 State: PUBLISHED Published: 2020-06-14T20:46:47 Last Updated: 2024-08-04T12:32:14.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/2688 - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - https://www.oracle.com/security-al
w-54cd0d6e8062 - https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200702-0003/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-14061 State: PUBLISHED Published: 2020-06-14T19:42:39.000Z Last Updated: 2025-08-27T20:33:05.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-y
ner: - CISA ADP Vulnrichment: References: - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2698 - https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200702-0003/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-14062 State: PUBLISHED Published: 2020-06-14T19:42:22 Last Updated: 2024-08-04T12:32:14.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2). Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2704 - https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - https://www.oracle.com/secur
databind/issues/2704 - https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200702-0003/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-14063 State: PUBLISHED Published: 2020-07-21T17:12:21 Last Updated: 2024-08-04T12:32:14.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/tc-custom-javascript/#developers - https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-cus
/tc-custom-javascript/#developers - https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/
CVE ID: CVE-2020-14064 State: PUBLISHED Published: 2020-07-15T19:11:02 Last Updated: 2024-08-04T12:32:14.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.icewarp.com/download-premise/server/ - https://github.com/networksecure/Icewarp_incorrect_access_control
CVE ID: CVE-2020-14065 State: PUBLISHED Published: 2020-07-15T19:12:01 Last Updated: 2024-08-04T12:32:14.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space. Additional Analyst Notes: - CVE Program Container: References: - https://www.icewarp.com/download-premise/server/ - https://github.com/networksecure/icewarp_unlimited_file_upload