Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
.apache.org%3E - https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E - https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%
eeper.apache.org%3E - https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thr
f4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E - https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E - https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a
issues.solr.apache.org%3E - https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220210-0002/
CVE ID: CVE-2020-13957 State: PUBLISHED Published: 2020-10-13T18:28:52 Last Updated: 2024-08-04T12:32:14.343Z Vendors: n/a Products: Apache Solr Problem Types: Remote Code Execution Description: Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.us.apache.org/mod_mbox/www-announce/202010.mbox
lyst Notes: - CVE Program Container: References: - https://mail-archives.us.apache.org/mod_mbox/www-announce/202010.mbox/%3CCAECwjAWCVLoVaZy%3DTNRQ6Wk9KWVxdPRiGS8NT%2BPHMJCxbbsEVg%40mail.gmail.com%3E - https://lists.apache.org/thread.html/r226c1112bb41e7cd427862d875eff9877a20a40242c2542f4dd39e4a%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r4ca8ba5980d9049cf3707798aa3116ee76c1582f171ff452ad2ca75e%40%3Cissues.lucene.apache.org%3E - https://security.netapp.com/advisory/ntap-20201023-0002/ - https://lists.apache.org/thread.html/r8b1782d42d0a4ce573495d5d9345ad328d652c68c411ccdb245c57e3%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r1c783d3d81b
d5d9345ad328d652c68c411ccdb245c57e3%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r1c783d3d81ba62f3381a17a4d6c826f7dead3a132ba42349c90df075%40%3Ccommits.lucene.apache.org%3E - https://lists.apache.org/thread.html/r7512ae552cd9d14ab8b1bc0a7e95f2ec52ae85364f068d4034398ede%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r9d7356f209ee30d702b6a921c866564eb2e291b126640c7ab70feea7%40%3Ccommits.lucene.apache.org%3E - https://lists.apache.org/thread.html/r5557641fcf5cfd99260a7037cfbc8788fb546b72c98a900570edaa2e%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r3d1e24a73e6bffa1d6534e1f34c8f5cbd9999495e7d933640f4fa0ed%40%3Cissues.
che.org%3E - https://lists.apache.org/thread.html/r3d1e24a73e6bffa1d6534e1f34c8f5cbd9999495e7d933640f4fa0ed%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r13a728994c60be5b5a7049282b5c926dac1fc6a9a0b2362f6adfa573%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r2f8d33a4de07db9459fb2a98a1cd39747066137636b53f84a13e5628%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r853fdc6d0b91d5e01a26c7bd5becb044ad775a231703d634ca5d55c9%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r2236fdf99ac3efbfc36c2df96d3a88f822baa6f45e13fec7ff558e34%40%3Cdev.bigtop.apache.org%3E - https://lists.apache.org/thread.html/r99
ac3efbfc36c2df96d3a88f822baa6f45e13fec7ff558e34%40%3Cdev.bigtop.apache.org%3E - https://lists.apache.org/thread.html/r999f828e6e37d9e825e207471cbfd2681c3befcd7f3abd59ed87c0d5%40%3Cissues.bigtop.apache.org%3E - https://lists.apache.org/thread.html/rb1de6ba50a468e9baff32a249edaa08f6bcec7dd7cc208e25e6b48c8%40%3Cissues.bigtop.apache.org%3E - https://lists.apache.org/thread.html/rf1a32f00017e83ff29a74be2de02e28e4302dddb5f14c624e297a8c0%40%3Cdev.bigtop.apache.org%3E - https://lists.apache.org/thread.html/r2a6600fe9afd502c04d26fd112823ec3f3c3ad1b4a289d10567a78a0%40%3Cdev.bigtop.apache.org%3E - https://lists.apache.org/thread.html/r3da9895cea476bcee2557531bebd4e8f6f367dc3ea900a65e2f51cd8%40%3Cissues
ache.org%3E - https://lists.apache.org/thread.html/r3da9895cea476bcee2557531bebd4e8f6f367dc3ea900a65e2f51cd8%40%3Cissues.bigtop.apache.org%3E - https://lists.apache.org/thread.html/rb2f1c7fd3d3ea719dfac4706a80e6affddecae8663dda04e1335347f%40%3Ccommits.bigtop.apache.org%3E - https://lists.apache.org/thread.html/r622a043c2890327f8a4aea16b131e8a7137a282a004614369fceb224%40%3Cdev.bigtop.apache.org%3E - https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2020-13958 State: PUBLISHED Published: 2020-11-17T15:17:57 Last Updated: 2024-08-04T12:32:14.471Z Vendors: n/a Products: Apache OpenOffice Problem Types: Protection Mechanism Failure Description: A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd13f900331622
alyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd13f90033162276b0ccae63bea2d3d89cdaf355%40%3Cannounce.openoffice.apache.org%3E
CVE ID: CVE-2020-13959 State: PUBLISHED Published: 2021-03-10T08:00:19.000Z Last Updated: 2025-02-13T16:27:31.176Z Vendors: Apache Software Foundation Products: Apache Velocity Tools Problem Types: CWE-79 Description: The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phi
nd the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E - https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E - https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E - https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72%40%3Cannounc
che.org%3E - https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/03/10/2 - https://lists.debian.org/debian-lts-announce/2021/03/msg00021.html - https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7%40%3Cuser.velocity.apache.org%3E - https://security.gentoo.org/glsa/202107-52
CVE ID: CVE-2020-13960 State: PUBLISHED Published: 2020-06-08T19:26:41 Last Updated: 2024-08-04T12:32:14.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses (and also offer Internet services such as HTTP) for names that otherwise would have had an NXDOMAIN error, by registering a subdomain of the domain.name domain name. Additional Analyst Notes: - CVE Program Container: References: - https://harigovind.org/articles/who-is-hijacking-my-nxdomains/
CVE ID: CVE-2020-13961 State: PUBLISHED Published: 2020-06-19T16:29:37 Last Updated: 2024-08-04T12:32:14.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/183045 - https://github.com/strapi/strapi/releases/tag/v3.0.2 - https://
://exchange.xforce.ibmcloud.com/vulnerabilities/183045 - https://github.com/strapi/strapi/releases/tag/v3.0.2 - https://github.com/strapi/strapi/pull/6599
CVE ID: CVE-2020-13962 State: PUBLISHED Published: 2020-06-08T23:14:10 Last Updated: 2024-08-04T12:32:14.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mumble-voip/mumble/pull/4032 - https://bugreports.qt.io/browse/QTBUG-83450 - https://gith
ferences: - https://github.com/mumble-voip/mumble/pull/4032 - https://bugreports.qt.io/browse/QTBUG-83450 - https://github.com/mumble-voip/mumble/issues/3679 - https://security.gentoo.org/glsa/202007-18 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
CVE ID: CVE-2020-13963 State: PUBLISHED Published: 2021-03-21T20:57:32 Last Updated: 2024-08-04T12:32:14.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account). Additional Analyst Notes: - CVE Program Container: References: - https://forum.soplanning.org/viewforum.php?f=8 - https://labs.integrity.pt/advisories/cve-2020-13963/ - https://cwe.mitre.org/data/definitions/321.html
CVE ID: CVE-2020-13964 State: PUBLISHED Published: 2020-06-09T02:45:35 Last Updated: 2024-08-04T12:32:14.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 - https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19 - https://github.com/roundcube/roundcubemail/releases/tag/1.3.12 - https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 - https://www
oundcubemail/releases/tag/1.3.12 - https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 - https://www.debian.org/security/2020/dsa-4700 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/
CVE ID: CVE-2020-13965 State: PUBLISHED Published: 2020-06-09T02:45:24.000Z Last Updated: 2025-10-21T23:35:42.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 - https://github.com/roundcube/roundcubemail/releases/tag/1.3.12 - https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 - https://github.com/roundcube
ttps://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3 - https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 - https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 - https://www.debian.org/security/2020/dsa-4700 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/ - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube
CVE ID: CVE-2020-13968 State: PUBLISHED Published: 2020-12-23T17:19:58 Last Updated: 2024-08-04T12:32:14.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter. Additional Analyst Notes: - CVE Program Container: References: - http://crk.com.br/produtos/ - https://github.com/r3naissance/nse/blob/master/http-vuln-cve2020-13968.nse
CVE ID: CVE-2020-13969 State: PUBLISHED Published: 2020-12-23T17:20:03 Last Updated: 2024-08-04T12:32:14.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. This is path-independent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r3naissance/nse/blob/master/http-vuln-cve2020-13969.nse
CVE ID: CVE-2020-13970 State: PUBLISHED Published: 2020-07-28T20:24:16 Last Updated: 2024-08-04T12:32:14.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server. Additional Analyst Notes: - CVE Program Container: References: - https://www.shopware.com/en/changelog/#6-2-3 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020
CVE ID: CVE-2020-13971 State: PUBLISHED Published: 2020-07-28T20:22:44 Last Updated: 2024-08-04T12:32:14.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.shopware.com/en/changelog/#6-2-3 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020
CVE ID: CVE-2020-13972 State: PUBLISHED Published: 2020-09-03T14:36:41 Last Updated: 2024-08-04T12:32:14.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951. Additional Analyst Notes: - CVE Program Container: References: - http://burninatorsec.blogspot.com/2020/09/cve-2020-13972-xss-via-ssrf-in.html
CVE ID: CVE-2020-13973 State: PUBLISHED Published: 2020-06-09T03:51:10 Last Updated: 2024-08-04T12:32:14.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OWASP/json-sanitizer/pull/20
CVE ID: CVE-2020-13974 State: PUBLISHED Published: 2020-06-09T04:06:41 Last Updated: 2024-08-04T12:32:14.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html - https://usn.ubuntu.com/4427-1/ - https://usn.ubuntu.com/4439-1/ - https://usn.ubuntu.com/4440-1/ -
20-07/msg00008.html - https://usn.ubuntu.com/4427-1/ - https://usn.ubuntu.com/4439-1/ - https://usn.ubuntu.com/4440-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html - https://usn.ubuntu.com/4483-1/ - https://usn.ubuntu.com/4485-1/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae - https://lkml.org/lkml/2020/3/22/482 - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad0bf9ce93fa40b667eccd3306783f4db4b932b
CVE ID: CVE-2020-13976 State: PUBLISHED Published: 2020-06-09T13:07:18 Last Updated: 2024-11-18T17:28:39.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it refers to an old software version, requires administrative privileges, and does not provide access beyond that already available to administrative users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
ready available to administrative users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://svn.dd-wrt.com/ticket/7039
CVE ID: CVE-2020-13977 State: PUBLISHED Published: 2020-06-09T13:06:56 Last Updated: 2024-08-04T12:32:14.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408. Additional Analyst Notes: - CVE Program Container: References: - https://anhtai.me/nagios-core-4-4-5-url-injection/ - https://www.nagios.org/projects/nagios-core/history/4x/ - https://github.com
nhtai.me/nagios-core-4-4-5-url-injection/ - https://www.nagios.org/projects/nagios-core/history/4x/ - https://github.com/sawolf/nagioscore/tree/url-injection-fix - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEVVFSOK7DOYJJWDAFQCEQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J5MZDFWU46ZWXMJO64U3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6DXVTXQH3AOJ4WQVKJUE/
CVE ID: CVE-2020-13978 State: PUBLISHED Published: 2020-06-09T13:06:47 Last Updated: 2024-08-27T19:49:00.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication that the Edit Chunk feature was intended to prevent an administrator from using PHP's exec feature Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/464
CVE ID: CVE-2020-13980 State: PUBLISHED Published: 2020-06-09T13:44:50 Last Updated: 2024-08-04T12:32:14.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you are still required to be logged into the admin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencart/opencart/issues/7974
CVE ID: CVE-2020-13983 State: REJECTED Published: 2020-07-10T15:23:26 Last Updated: 2020-07-10T15:23:26 Description: No description available.
CVE ID: CVE-2020-13984 State: PUBLISHED Published: 2020-12-11T21:34:10 Last Updated: 2024-08-04T12:32:14.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when processing IPv6 extension headers in ext_hdr_options_process in net/ipv6/uip6.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01