Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25172 State: PUBLISHED Published: 2020-11-06T16:09:16.397700Z Last Updated: 2024-09-16T18:39:05.515Z Vendors: B. Braun Melsungen AG Products: OnlineSuite Problem Types: CWE-23 Description: A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01
CVE ID: CVE-2020-25173 State: PUBLISHED Published: 2021-01-26T12:45:53.081700Z Last Updated: 2024-09-16T20:47:12.070Z Vendors: Reolink Products: RLC-4XX series, RLC-5XX series, RLN-X10 series Problem Types: CWE-321 Description: An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02
CVE ID: CVE-2020-25174 State: PUBLISHED Published: 2020-11-06T16:08:41.727185Z Last Updated: 2024-09-17T00:16:15.836Z Vendors: B. Braun Melsungen AG Products: OnlineSuite Problem Types: CWE-427 Description: A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01
CVE ID: CVE-2020-25175 State: PUBLISHED Published: 2020-12-14T16:36:24 Last Updated: 2024-08-04T15:26:09.534Z Vendors: n/a Products: GE Healthcare Imaging and Ultrasound Products Problem Types: CWE-523 Description: GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-343-01
CVE ID: CVE-2020-25176 State: PUBLISHED Published: 2022-03-18T18:00:31.000Z Last Updated: 2025-04-16T17:59:33.248Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ISaGRAF Runtime Problem Types: CWE-23 Description: Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution. Additional Analyst Notes: - CVE
cker to traverse an application’s directory, which could lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
CVE ID: CVE-2020-25177 State: PUBLISHED Published: 2020-12-01T14:54:39 Last Updated: 2024-08-04T15:26:10.177Z Vendors: n/a Products: WECON PLC Editor Problem Types: CWE-121 Description: WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-310-01
CVE ID: CVE-2020-25178 State: PUBLISHED Published: 2022-03-18T18:00:30.000Z Last Updated: 2025-04-16T17:59:55.844Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ISaGRAF Runtime Problem Types: CWE-319 Description: ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
enticated attacker to upload, read, and delete files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
CVE ID: CVE-2020-25179 State: PUBLISHED Published: 2020-12-14T16:12:36 Last Updated: 2024-08-04T15:26:09.485Z Vendors: n/a Products: GE Healthcare Imaging and Ultrasound Products Problem Types: CWE-497 Description: GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-20-343-01
CVE ID: CVE-2020-25180 State: PUBLISHED Published: 2022-03-18T18:00:33.000Z Last Updated: 2025-04-16T16:41:46.019Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Rockwell Automation Products: ISaGRAF Runtime Problem Types: CWE-321 Description: Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISa
) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
CVE ID: CVE-2020-25181 State: PUBLISHED Published: 2020-12-01T14:54:45 Last Updated: 2024-08-04T15:26:09.804Z Vendors: n/a Products: WECON PLC Editor Problem Types: CWE-122 Description: WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-310-01
CVE ID: CVE-2020-25182 State: PUBLISHED Published: 2022-03-18T18:00:30.000Z Last Updated: 2025-04-16T17:59:44.664Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ISaGRAF Runtime Problem Types: CWE-427 Description: Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.g
ws systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
CVE ID: CVE-2020-25183 State: PUBLISHED Published: 2020-12-14T19:18:44 Last Updated: 2025-05-22T19:34:29.069Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Medtronic Products: Smart Model 25000 Patient Reader Problem Types: CWE-287 Description: Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an attacker to use another mobile device or malicious application on the patient’s smartphone to authenticate to the patient’s Medtronic Smart Reader, fooling the devi
icious application on the patient’s smartphone to authenticate to the patient’s Medtronic Smart Reader, fooling the device into believing it is communicating with the original Medtronic smart phone application when executed within range of Bluetooth communication. Additional Analyst Notes: - CVE Program Container: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01
CVE ID: CVE-2020-25184 State: PUBLISHED Published: 2022-03-18T18:00:32.000Z Last Updated: 2025-04-16T17:59:21.555Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ISaGRAF Runtime Problem Types: CWE-256 Description: Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA AD
se the user passwords, resulting in information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
CVE ID: CVE-2020-25185 State: PUBLISHED Published: 2020-11-21T05:35:48 Last Updated: 2024-08-04T15:26:09.789Z Vendors: n/a Products: IP150 Problem Types: CWE-120 Description: The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02
CVE ID: CVE-2020-25186 State: PUBLISHED Published: 2020-10-22T20:09:29 Last Updated: 2024-08-04T15:26:09.785Z Vendors: n/a Products: WECON Technology Co., Ltd (WECON) LeviStudioU Problem Types: IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE Description: An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-238-03
CVE ID: CVE-2020-25187 State: PUBLISHED Published: 2020-12-14T19:18:52 Last Updated: 2025-05-22T19:37:12.795Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Medtronic Products: Smart Model 25000 Patient Reader Problem Types: CWE-122 Description: Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the MCL Smart Patient Reader, potentially leading to control of the device Additional Analyst Notes: - CVE Program Container: R
Smart Patient Reader, potentially leading to control of the device Additional Analyst Notes: - CVE Program Container: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-smart-security-vulnerability-patch.html - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-345-01
CVE ID: CVE-2020-25188 State: PUBLISHED Published: 2020-10-14T12:47:54 Last Updated: 2024-08-04T15:26:10.202Z Vendors: n/a Products: LAquis SCADA Problem Types: CWE-125 Description: An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the application due to an out-of-bounds read vulnerability on the LAquis SCADA (Versions prior to 4.3.1.870). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-02 - https://www.zerodayinitiative.com/advisories/ZDI-20-1244/
CVE ID: CVE-2020-25189 State: PUBLISHED Published: 2020-11-21T16:58:42 Last Updated: 2024-08-04T15:26:09.806Z Vendors: n/a Products: IP150 Problem Types: CWE-121 Description: The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02
CVE ID: CVE-2020-25190 State: PUBLISHED Published: 2020-12-23T14:07:56.166255Z Last Updated: 2024-09-16T21:08:02.611Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MOXA Products: NPort IAW5000A-I/O Problem Types: CWE-319 Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE ID: CVE-2020-25191 State: PUBLISHED Published: 2020-12-11T01:46:58 Last Updated: 2024-08-04T15:26:10.150Z Vendors: n/a Products: CompactRIO Problem Types: CWE-732 Description: Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboot the CompactRIO (Driver versions prior to 20.5) remotely. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-338-01
CVE ID: CVE-2020-25192 State: PUBLISHED Published: 2020-12-23T14:08:28.438482Z Last Updated: 2024-09-16T22:41:28.665Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: MOXA Products: NPort IAW5000A-I/O Problem Types: CWE-200 Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE ID: CVE-2020-25193 State: PUBLISHED Published: 2022-03-18T18:00:35.000Z Last Updated: 2025-04-16T16:41:25.123Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GE Products: Reason RT43X Clocks Problem Types: CWE-321 Description: By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03 - https://www.gegridsolutions.com/app/Downloa
t: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03 - https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430&type=21&file=5
CVE ID: CVE-2020-25194 State: PUBLISHED Published: 2020-12-23T14:08:17.398380Z Last Updated: 2024-09-16T18:29:02.424Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MOXA Products: NPort IAW5000A-I/O Problem Types: CWE-269 Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE ID: CVE-2020-25195 State: PUBLISHED Published: 2020-12-15T19:38:02 Last Updated: 2024-08-04T15:26:10.231Z Vendors: n/a Products: Host Engineering H0-ECOM100 Module, Host Engineering H2-ECOM100 Module, Host Engineering H4-ECOM100 Module Problem Types: CWE-20 Description: The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-345-02
CVE ID: CVE-2020-25196 State: PUBLISHED Published: 2020-12-23T14:08:41.583756Z Last Updated: 2024-09-17T00:37:03.186Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MOXA Products: NPort IAW5000A-I/O Problem Types: CWE-307 Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE ID: CVE-2020-25197 State: PUBLISHED Published: 2022-03-18T18:00:34.000Z Last Updated: 2025-04-16T16:41:36.185Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GE Products: Reason RT43X Clocks Problem Types: CWE-94 Description: A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03 - https://www.gegridsolutions.com/app/Downl
ent: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03 - https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430&type=21&file=5
CVE ID: CVE-2020-25198 State: PUBLISHED Published: 2020-12-23T14:08:23.404844Z Last Updated: 2024-09-17T00:11:38.801Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MOXA Products: NPort IAW5000A-I/O Problem Types: CWE-384 Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE ID: CVE-2020-25199 State: PUBLISHED Published: 2020-12-09T16:12:36 Last Updated: 2024-08-04T15:33:04.387Z Vendors: n/a Products: WECON Technology Co., Ltd LeviStudioU Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists within the WECON LeviStudioU Release Build 2019-09-21 and prior when processing project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under the privileges of the application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-238-03
CVE ID: CVE-2020-25200 State: PUBLISHED Published: 2020-10-01T17:36:58 Last Updated: 2024-11-18T16:02:31.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
at this is an intended design Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pritunl.com - https://pritunl.com/security - https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200
CVE ID: CVE-2020-25201 State: PUBLISHED Published: 2020-11-04T22:32:10 Last Updated: 2024-08-04T15:33:05.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#185-october-23-2020 - https://security.gentoo.org/glsa/202208-09
CVE ID: CVE-2020-25203 State: PUBLISHED Published: 2020-09-25T03:55:20 Last Updated: 2024-08-04T15:33:04.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By calling the intent with the action set to android.intent.action.VIEW, any other application is able to load any website/web content into the application's context, which is shown as a full-screen overlay to the user. Additional Analyst Notes: - CVE Program Container: References: - https://rcesecurity.com - http://packetstormsecurity.com/files/159264/Framer-Preview-12-Content-Injection.html
CVE ID: CVE-2020-25204 State: PUBLISHED Published: 2020-10-28T18:47:17 Last Updated: 2024-08-04T15:33:04.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver. The purpose of this broadcast receiver is to show an in-game push notification to the player. However, the application does not enforce any authorization schema on the broadcast receiver, allowing any application to send fully customizable in-game push notifications. Additional Analyst Notes: - CVE Program Container: References: - http://packetst
ustomizable in-game push notifications. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/159747/God-Kings-0.60.1-Notification-Spoofing.html
CVE ID: CVE-2020-25205 State: PUBLISHED Published: 2021-07-20T18:45:21 Last Updated: 2024-08-04T15:33:04.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware ver
ed users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions. Additional Analyst Notes: - CVE Program Container: References: - https://labs.f-secure.com/advisories/ - https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/