Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5183 State: PUBLISHED Published: 2020-01-08T17:19:53 Last Updated: 2024-08-04T08:22:08.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: FTPGetter Professional 5.97.0.223 is vulnerable to a memory corruption bug when a user sends a specially crafted string to the application. This memory corruption bug can possibly be classified as a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155832/FTPGetter-Professional-5.97.0.223-Denial-Of-Service.html - https://www.exploit-db.com/exploits/47871
CVE ID: CVE-2020-5186 State: PUBLISHED Published: 2020-02-24T14:24:27 Last Updated: 2024-08-04T08:22:08.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dnnsoftware/Dnn.Platform/releases - https://packetstormsecurity.com/files/156483/DotNetNuke-CMS-9.5.0-Cross-Site-Scripting.html - https://medium.com/%40SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175
CVE ID: CVE-2020-5187 State: PUBLISHED Published: 2020-02-24T14:22:46 Last Updated: 2024-08-04T08:22:09.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dnnsoftware/Dnn.Platform/releases - http://packetstormsecurity.com/files/156489/DotNetNuke-CMS-9.4.4-Zip-Directory-Traversal.html - https://medium.com/%40SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175
CVE ID: CVE-2020-5188 State: PUBLISHED Published: 2020-02-24T14:20:55 Last Updated: 2024-08-04T08:22:08.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dnnsoftware/Dnn.Platform/releases - http://packetstormsecurity.com/files/156484/DotNetNuke-CMS-9.5.0-File-Extension-Check-Bypass.html - https://medium.com/%40SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175
CVE ID: CVE-2020-5191 State: PUBLISHED Published: 2020-01-06T00:58:38 Last Updated: 2024-08-04T08:22:08.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/hospital-management-system-in-php/ - https://www.exploit-db.com/exploits/47841
CVE ID: CVE-2020-5192 State: PUBLISHED Published: 2020-01-06T00:52:19 Last Updated: 2024-08-04T08:22:08.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/hospital-management-system-in-php/ - https://www.exploit-db.com/exploits/47840
CVE ID: CVE-2020-5193 State: PUBLISHED Published: 2020-01-14T17:40:03 Last Updated: 2024-08-04T08:22:08.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155929/Hospital-Management-System-4.0-Cross-Site-Scripting.html
CVE ID: CVE-2020-5194 State: PUBLISHED Published: 2020-01-14T13:34:06 Last Updated: 2024-08-04T08:22:08.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajax_download_zip/zip_name endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists. Additional Analyst Notes: - CVE Program Container: References: - https://support.cerberusftp.com/hc/en-us/community/topics/360
onal Analyst Notes: - CVE Program Container: References: - https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements - https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities
CVE ID: CVE-2020-5195 State: PUBLISHED Published: 2020-01-13T17:29:36 Last Updated: 2024-08-04T08:22:08.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folder_up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker. Additional Analy
Script or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements - https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities - https://www.cerberusftp.com/xss-vulnerability-in-public-shares-fixed-in-cerberus-ftp-server-version-11-0-1-and-10-0-17/
CVE ID: CVE-2020-5196 State: PUBLISHED Published: 2020-01-14T13:29:01 Last Updated: 2024-08-04T08:22:08.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission. Additional Analyst Notes: - CVE Program Container: Refere
d hidden files, and can create directories without permission. Additional Analyst Notes: - CVE Program Container: References: - https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements - https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities - https://www.cerberusftp.com/zip-unzip-permission-bypass-vulnerability-fixed-in-cerberus-ftp-server-versions-11-0-3-and-10-0-18/
CVE ID: CVE-2020-5197 State: PUBLISHED Published: 2020-01-13T19:51:41 Last Updated: 2024-08-04T08:22:08.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/
CVE ID: CVE-2020-5200 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-11-04T19:59:41.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://en.minerbabe.com/pc.html/#/helps/updateLog - https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html
CVE ID: CVE-2020-5202 State: PUBLISHED Published: 2020-01-21T17:54:04 Last Updated: 2024-08-04T08:22:08.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from
ically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2020-5202 - http://www.openwall.com/lists/oss-security/2020/01/20/4 - http://www.openwall.com/lists/oss-security/2020/01/20/4 - https://seclists.org/oss-sec/2020/q1/21 - http://lists.opensuse.org/opensuse-security-a
ists/oss-security/2020/01/20/4 - https://seclists.org/oss-sec/2020/q1/21 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html
CVE ID: CVE-2020-5203 State: PUBLISHED Published: 2020-03-11T13:28:03 Last Updated: 2024-08-04T08:22:08.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bcosca/fatfree/releases - https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829
CVE ID: CVE-2020-5204 State: PUBLISHED Published: 2020-01-06T19:10:12 Last Updated: 2024-08-04T08:22:08.699Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: troglobit Products: uftpd Problem Types: CWE-121 Description: In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&#39;255.255.255.255&#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11 Additional Analyst Notes: - CV
ut the format specifier %d allows more than 3 digits. This has been fixed in version 2.11 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/troglobit/uftpd/security/advisories/GHSA-wrpr-xw7q-9wvq - https://github.com/troglobit/uftpd/commit/0fb2c031ce0ace07cc19cd2cb2143c4b5a63c9dd - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00034.html
CVE ID: CVE-2020-5205 State: PUBLISHED Published: 2020-01-09T02:05:14 Last Updated: 2024-08-04T08:22:08.880Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: danschultzer Products: Pow Problem Types: CWE-384 Description: In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw - https://gith
gram Container: References: - https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw - https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f - https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07
CVE ID: CVE-2020-5206 State: PUBLISHED Published: 2020-01-30T21:25:16 Last Updated: 2024-08-04T08:22:08.781Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: opencast Products: opencast Problem Types: CWE-285 Description: In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever
sume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencast/opencast/security/advisories/GHSA-vmm6-w4cf-7f3x - https://github.com/opencast/opencast/commit/b157e1fb3b35991ca7bf59f0730329fbe7ce82e8
CVE ID: CVE-2020-5207 State: PUBLISHED Published: 2020-01-27T19:30:15 Last Updated: 2024-08-04T08:22:09.258Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Ktor.io Products: Ktor Problem Types: CWE-444 Description: In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ktorio/ktor/security/advisories/GHSA-xrr9-rh8p-433v - https://github.com/ktorio/ktor/pull/1547
CVE ID: CVE-2020-5208 State: PUBLISHED Published: 2020-02-05T14:00:19 Last Updated: 2024-08-04T08:22:08.968Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: ipmitool Products: ipmitool Problem Types: CWE-120 Description: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ipmitool/ipmitool/
n version 1.8.19. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp - https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2 - https://lists.debian.org/debian-lts-announce/2020/02/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYYEKUAUTCWICM77HOEGZDVVEUJLP4BP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K2BPW66KDP4H36AGZXLED57A3O2Y6EQW/ - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00031.html - https://security.gentoo.org/glsa/202101
/ - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00031.html - https://security.gentoo.org/glsa/202101-03 - https://lists.debian.org/debian-lts-announce/2021/06/msg00029.html
CVE ID: CVE-2020-5209 State: PUBLISHED Published: 2020-01-28T17:50:19 Last Updated: 2024-08-04T08:22:08.881Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NetHack Products: NetHack Problem Types: CWE-120 Description: In NetHack before 3.6.5, unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/comm
NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/commit/f3def5c0b999478da2d0a8f0b6a7c370a2065f77 - https://github.com/NetHack/NetHack/security/advisories/GHSA-fw72-r8xm-45p8
CVE ID: CVE-2020-5210 State: PUBLISHED Published: 2020-01-28T17:50:14 Last Updated: 2024-08-04T08:22:08.904Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NetHack Products: NetHack Problem Types: CWE-120 Description: In NetHack before 3.6.5, an invalid argument to the -w command line option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/Net
pgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-v5pg-hpjg-9rpp - https://github.com/NetHack/NetHack/commit/f3def5c0b999478da2d0a8f0b6a7c370a2065f77
CVE ID: CVE-2020-5211 State: PUBLISHED Published: 2020-01-28T17:55:28 Last Updated: 2024-08-04T08:22:08.819Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NetHack Products: NetHack Problem Types: CWE-120 Description: In NetHack before 3.6.5, an invalid extended command in value for the AUTOCOMPLETE configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: Refe
own configuration files. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-r788-4jf4-r9f7
CVE ID: CVE-2020-5212 State: PUBLISHED Published: 2020-01-28T17:55:23 Last Updated: 2024-08-04T08:22:08.776Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NetHack Products: NetHack Problem Types: CWE-120 Description: In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https:
on files. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-g89f-m829-4m56
CVE ID: CVE-2020-5213 State: PUBLISHED Published: 2020-01-28T17:55:18 Last Updated: 2024-08-04T08:22:08.960Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NetHack Products: NetHack Problem Types: CWE-120 Description: In NetHack before 3.6.5, too long of a value for the SYMBOL configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://githu
s. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-rr25-4v34-pr7v
CVE ID: CVE-2020-5214 State: PUBLISHED Published: 2020-01-28T17:55:13 Last Updated: 2024-08-04T08:22:08.719Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NetHack Products: NetHack Problem Types: CWE-120 Description: In NetHack before 3.6.5, detecting an unknown configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/
d upgrade to NetHack 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-p8fw-rq89-xqx6
CVE ID: CVE-2020-5215 State: PUBLISHED Published: 2020-01-28T21:20:15 Last Updated: 2024-08-04T08:22:09.071Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TensorFlow Products: TensorFlow Problem Types: CWE-754 Description: In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and che
ch contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar tf.float16 value with a scalar string will trigger this issue due to automatic conversions. This can be easily reproduced by tf.constant("hello", tf.float16), if eager execution is enabled. This issue is patched in TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched. TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected. Users are encouraged to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/adv
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-977j-xj7q-2jr9 - https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf - https://github.com/tensorflow/tensorflow/releases/tag/v1.15.2 - https://github.com/tensorflow/tensorflow/releases/tag/v2.0.1
CVE ID: CVE-2020-5216 State: PUBLISHED Published: 2020-01-23T02:30:15 Last Updated: 2024-08-04T08:22:08.681Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Twitter Products: secure_headers Problem Types: CWE-113 Description: In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string.
header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg - https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0