Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.o
XOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/ - https://security.gentoo.org/glsa/202101-20 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://sourceware.org/bugzilla/show_bug.cgi?id=25620 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019 - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2020-6097 State: PUBLISHED Published: 2020-09-10T14:13:17 Last Updated: 2024-08-04T08:47:41.028Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: atftpd Problem Types: CWE-617 Description: An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029 - h
st Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00058.html - https://lists.debian.org/debian-lts-announce/2021/11/msg00014.html
CVE ID: CVE-2020-6098 State: PUBLISHED Published: 2020-07-28T21:12:50 Last Updated: 2024-08-04T08:47:41.220Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: freeDiameter Problem Types: CWE-191 Description: An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A specially crafted Diameter request can trigger a memory corruption resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1030
CVE ID: CVE-2020-6099 State: PUBLISHED Published: 2022-04-18T16:15:25.438Z Last Updated: 2025-04-15T19:04:54.355Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Graphisoft Products: BIMx Desktop Viewer Problem Types: CWE-680 Description: An exploitable code execution vulnerability exists in the file format parsing functionality of Graphisoft BIMx Desktop Viewer 2019.2.2328. A specially crafted file can cause a heap buffer overflow resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabi
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1032
CVE ID: CVE-2020-6100 State: PUBLISHED Published: 2020-07-20T20:22:47 Last Updated: 2024-08-04T08:47:41.172Z Vendors: n/a Products: AMD Problem Types: out of bounds write Description: An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. A specially crafted pixel shader can cause memory corruption vulnerability. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability potentially could be triggered from guest machines running virtualization environments (ie. VMware, qemu, VirtualBox etc.) in order to perform guest-to-host escape - as it was demonstrated before (TALOS-2018-0533, TALOS-2018-
VirtualBox etc.) in order to perform guest-to-host escape - as it was demonstrated before (TALOS-2018-0533, TALOS-2018-0568, etc.). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). This vulnerability was triggered from HYPER-V guest using RemoteFX feature leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1040
CVE ID: CVE-2020-6101 State: PUBLISHED Published: 2020-07-20T20:23:01 Last Updated: 2024-08-04T08:47:41.023Z Vendors: n/a Products: AMD Problem Types: out of bounds write Description: An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (u
R-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1041
CVE ID: CVE-2020-6102 State: PUBLISHED Published: 2020-07-20T21:00:39 Last Updated: 2024-08-04T08:47:41.017Z Vendors: n/a Products: AMD Problem Types: out-of-bounds write Description: An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser
PER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1042
CVE ID: CVE-2020-6103 State: PUBLISHED Published: 2020-07-20T21:00:51 Last Updated: 2024-08-04T08:47:41.083Z Vendors: n/a Products: AMD Problem Types: Out-of-bounds Write Description: An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser
PER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1043
CVE ID: CVE-2020-6104 State: PUBLISHED Published: 2020-10-15T14:47:38 Last Updated: 2024-08-04T08:47:41.109Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: F2FS-Tools Problem Types: CWE-125 Description: An exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause information disclosure resulting in a information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1046 - https
otes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1046 - https://security.gentoo.org/glsa/202101-26
CVE ID: CVE-2020-6105 State: PUBLISHED Published: 2020-10-15T14:48:07 Last Updated: 2024-08-04T08:47:41.090Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: F2fs-Tools Problem Types: CWE-73 Description: An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1047 - https://security.gentoo.or
ontainer: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1047 - https://security.gentoo.org/glsa/202101-26
CVE ID: CVE-2020-6106 State: PUBLISHED Published: 2020-10-15T14:48:33 Last Updated: 2024-08-04T08:47:41.193Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: F2fs-Tools Problem Types: CWE-131 Description: An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1048 - https://security.gentoo.org/glsa/202
References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1048 - https://security.gentoo.org/glsa/202101-26
CVE ID: CVE-2020-6107 State: PUBLISHED Published: 2020-10-15T14:45:08 Last Updated: 2024-08-04T08:47:41.223Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: F2fs-Tools Problem Types: CWE-253 Description: An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1049 - https://securi
VE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1049 - https://security.gentoo.org/glsa/202101-26
CVE ID: CVE-2020-6108 State: PUBLISHED Published: 2020-10-15T14:45:32 Last Updated: 2024-08-04T08:47:41.106Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: F2fs-Tools Problem Types: CWE-131 Description: An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause a heap buffer overflow resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1050 - https://security.gen
gram Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1050 - https://security.gentoo.org/glsa/202101-26
CVE ID: CVE-2020-6109 State: PUBLISHED Published: 2020-06-08T13:22:31 Last Updated: 2024-08-04T08:47:41.110Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Zoom Problem Types: CWE-22 Description: An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://ta
er or a group to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1055
CVE ID: CVE-2020-6110 State: PUBLISHED Published: 2020-06-08T13:22:34 Last Updated: 2024-08-04T08:47:41.068Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Zoom Problem Types: CWE-22 Description: An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to trigger this vulnerability. For the most severe effect, target user interaction is required. Ad
arget user or a group to trigger this vulnerability. For the most severe effect, target user interaction is required. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1056
CVE ID: CVE-2020-6111 State: PUBLISHED Published: 2020-12-03T12:29:54 Last Updated: 2024-08-04T08:47:41.084Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Allen-Bradley Problem Types: CWE-189 Description: An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B FRN 16.000, Series B FRN 15.002, Series B FRN 15.000, Series B FRN 14.000, Series B FRN 13.000, Series B FRN 12.000, Series B FRN 11.000 and Series B FRN 10.000. A specially crafted packet can cause a major error, resulting in a denial of service. An attacker can send a malicious packet
cially crafted packet can cause a major error, resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1057 - https://us-cert.cisa.gov/ics/advisories/icsa-21-047-02
CVE ID: CVE-2020-6112 State: PUBLISHED Published: 2020-09-17T12:23:02 Last Updated: 2024-08-04T08:47:41.197Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Nitro Pro Problem Types: CWE-823 Description: An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which allow for the decoder to write out of-bounds and cause memory corruption. This can result in code execution. A specially crafted image can be embedded insi
of-bounds and cause memory corruption. This can result in code execution. A specially crafted image can be embedded inside a PDF and loaded by a victim in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1062
CVE ID: CVE-2020-6113 State: PUBLISHED Published: 2020-09-17T12:23:13 Last Updated: 2024-08-04T08:47:41.110Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Nitro Pro Problem Types: CWE-190 Description: An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being all
to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1063
CVE ID: CVE-2020-6114 State: PUBLISHED Published: 2020-07-10T17:51:34 Last Updated: 2024-08-04T08:47:41.069Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a Products: Glacies IceHRM" Problem Types: CWE-89 Description: An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1067
CVE ID: CVE-2020-6115 State: PUBLISHED Published: 2020-09-17T12:19:21 Last Updated: 2024-08-04T08:47:41.116Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Nitro Pro Problem Types: CWE-416 Description: An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. While searching for an object identifier in a malformed document that is missing from the cross-reference table, the application will save a reference to the object’s cross-reference table entry inside a stack variable. If the referenced object identifier is not found, the application may resize the cross-refere
y inside a stack variable. If the referenced object identifier is not found, the application may resize the cross-reference table which can change the scope of its entry. Later when the application tries to reference cross-reference entry via the stack variable, the application will access memory belonging to the recently freed table causing a use-after-free condition. A specially crafted document can be delivered by an attacker and loaded by a victim in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1068
CVE ID: CVE-2020-6116 State: PUBLISHED Published: 2020-09-17T12:18:58 Last Updated: 2024-08-04T08:47:41.014Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Nitro Pro Problem Types: CWE-680 Description: An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colorspace, the application can miscalculate the size of a buffer when allocating space for its colors. When using this allocated buffer, the application can write outside its bounds and cause memory corruption which can lead to code execution. A specially
the application can write outside its bounds and cause memory corruption which can lead to code execution. A specially crafted document must be loaded by a victim in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1070
CVE ID: CVE-2020-6117 State: PUBLISHED Published: 2020-09-01T13:51:01 Last Updated: 2024-08-04T08:55:20.847Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: OS4ED" Problem Types: CWE-89 Description: SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bday parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1072
CVE ID: CVE-2020-6118 State: PUBLISHED Published: 2020-09-01T13:51:12 Last Updated: 2024-08-04T08:55:20.847Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: OS4ED" Problem Types: CWE-89 Description: SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bmonth parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1072
CVE ID: CVE-2020-6119 State: PUBLISHED Published: 2020-09-01T13:51:37 Last Updated: 2024-08-04T08:55:20.830Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: OS4Ed Problem Types: CWE-89 Description: SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The byear parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1072
CVE ID: CVE-2020-6120 State: PUBLISHED Published: 2020-09-01T13:56:36 Last Updated: 2024-08-04T08:55:20.849Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: OS4Ed Problem Types: CWE-89 Description: SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The fn parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1072
CVE ID: CVE-2020-6121 State: PUBLISHED Published: 2020-09-01T13:57:01 Last Updated: 2024-08-04T08:55:20.813Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: OS4Ed Problem Types: CWE-89 Description: SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The ln parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1072
CVE ID: CVE-2020-6122 State: PUBLISHED Published: 2020-09-01T13:57:15 Last Updated: 2024-08-04T08:55:20.792Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: OS4Ed Problem Types: CWE-89 Description: SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The mn parameter in the page CheckDuplicateStudent.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1072