Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35627 State: PUBLISHED Published: 2020-12-28T14:36:30 Last Updated: 2024-08-04T17:09:14.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image extension to PHP and executing PHP code on the server. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6 - https://makewebbetter.com/product/giftware-woocomme
: - https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6 - https://makewebbetter.com/product/giftware-woocommerce-gift-cards/
CVE ID: CVE-2020-35628 State: PUBLISHED Published: 2021-03-04T00:00:00.000Z Last Updated: 2025-04-23T19:44:44.149Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: CGAL Problem Types: CWE-129 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - h
ontainer: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35629 State: PUBLISHED Published: 2022-04-18T16:56:39.561Z Last Updated: 2025-04-23T18:34:36.343Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CGAL Project Products: libcgal Problem Types: CWE-129 Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sloop() slh->facet(). Addition
ities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sloop() slh->facet(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35630 State: PUBLISHED Published: 2022-04-18T16:56:41.182Z Last Updated: 2025-04-23T18:34:30.797Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CGAL Project Products: libcgal Problem Types: CWE-129 Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->center_vertex().
ities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->center_vertex(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35631 State: PUBLISHED Published: 2022-04-18T16:56:42.551Z Last Updated: 2025-04-23T18:34:24.966Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CGAL Project Products: libcgal Problem Types: CWE-129 Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() SD.link_as_face_cycle(
ities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() SD.link_as_face_cycle(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35632 State: PUBLISHED Published: 2022-04-18T16:56:44.039Z Last Updated: 2025-04-23T18:34:19.430Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CGAL Project Products: libcgal Problem Types: CWE-129 Description: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_ob
ities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Edge_of. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35633 State: PUBLISHED Published: 2021-08-30T00:00:00.000Z Last Updated: 2025-04-23T19:31:44.419Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: CGAL Project Problem Types: CWE-129 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() store_sm_boundary_item() Edge_of.A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability. Additional A
which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35634 State: PUBLISHED Published: 2021-08-30T00:00:00.000Z Last Updated: 2025-04-23T19:31:33.459Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: CGAL Project Problem Types: CWE-129 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Sloop_of. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability. Additio
sion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35635 State: PUBLISHED Published: 2021-08-30T00:00:00.000Z Last Updated: 2025-04-23T19:31:27.108Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: CGAL Project Problem Types: CWE-129 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() store_sm_boundary_item() Sloop_of OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program
xecution. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35636 State: PUBLISHED Published: 2021-03-04T00:00:00.000Z Last Updated: 2025-04-23T19:44:35.825Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: CGAL Project Problem Types: CWE-129 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA A
r can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - https://security.gentoo.org/glsa/202305-34
CVE ID: CVE-2020-35650 State: PUBLISHED Published: 2020-12-23T15:25:24 Last Updated: 2024-08-04T17:09:14.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgm_code_redeem POST Parameter in user-code-redemption.php, the ulgm_user_first POST Parameter in user-registration-form.php, the ulgm_user_last POST Parameter in user-registration-form.php, the ulgm_user_email POST Parameter in user-registration-form.php, the ulgm_code_registration POST Parameter in user-registration-form.php, the ulgm_terms_condi
ser-registration-form.php, the ulgm_code_registration POST Parameter in user-registration-form.php, the ulgm_terms_conditions POST Parameter in user-registration-form.php, the _ulgm_total_seats POST Parameter in frontend-uo_groups_buy_courses.php, the uncanny_group_signup_user_first POST Parameter in group-registration-form.php, the uncanny_group_signup_user_last POST Parameter in group-registration-form.php, the uncanny_group_signup_user_login POST Parameter in group-registration-form.php, the uncanny_group_signup_user_email POST Parameter in group-registration-form.php, the success-invited GET Parameter in frontend-uo_groups.php, the bulk-errors GET Parameter in frontend-uo_groups.php, or
he success-invited GET Parameter in frontend-uo_groups.php, the bulk-errors GET Parameter in frontend-uo_groups.php, or the message GET Parameter in frontend-uo_groups.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.uncannyowl.com/knowledge-base/uncanny-learndash-groups-changelog/ - https://gist.github.com/michiiii/81d801f563138abe7da61e2d95342202
CVE ID: CVE-2020-35652 State: PUBLISHED Published: 2021-01-29T07:22:40 Last Updated: 2024-08-04T17:09:14.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-29219 - https://issues.asterisk.org/jira/browse/ASTERISK-29191 -
es: - https://issues.asterisk.org/jira/browse/ASTERISK-29219 - https://issues.asterisk.org/jira/browse/ASTERISK-29191 - https://downloads.asterisk.org/pub/security/AST-2020-004.html - https://downloads.asterisk.org/pub/security/AST-2020-003.html
CVE ID: CVE-2020-35653 State: PUBLISHED Published: 2021-01-12T08:02:35 Last Updated: 2024-08-04T17:09:14.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/index.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553
QEL3S3YQCZTVHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/ - https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
CVE ID: CVE-2020-35654 State: PUBLISHED Published: 2021-01-12T08:06:55 Last Updated: 2024-08-04T17:09:14.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/index.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa
RIPERKYDQEL3S3YQCZTVHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/
CVE ID: CVE-2020-35655 State: PUBLISHED Published: 2021-01-12T08:08:47 Last Updated: 2024-08-04T17:09:14.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/index.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNB
YQCZTVHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/
CVE ID: CVE-2020-35656 State: PUBLISHED Published: 2020-12-23T02:02:19 Last Updated: 2024-08-04T17:09:14.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jaws-project/jaws - https://github.com/xNoBody12/Jaws-CMS-RCE
CVE ID: CVE-2020-35657 State: PUBLISHED Published: 2020-12-23T02:03:03 Last Updated: 2024-08-04T17:09:14.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jaws-project/jaws - https://github.com/xNoBody12/jaws-rce-via-theme
CVE ID: CVE-2020-35658 State: PUBLISHED Published: 2020-12-23T02:10:33 Last Updated: 2024-08-04T17:09:14.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted. Additional Analyst Notes: - CVE Program Container: References: - https://docs.titanhq.com/en/13161-spamtitan-release-notes.html - https://secator.pl/index.php/2020/12/23/cve-2020-35658/
CVE ID: CVE-2020-35659 State: PUBLISHED Published: 2020-12-24T15:59:04 Last Updated: 2024-08-04T17:09:14.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pi-hole/AdminLTE/pull/1665 - https://discourse.pi-hole.net/t/pi-hole-core-web-v5-2-2-and-ftl-v5-3-3-released/41998 - https://blog.mirch.io/2020/12/24/pihole-
discourse.pi-hole.net/t/pi-hole-core-web-v5-2-2-and-ftl-v5-3-3-released/41998 - https://blog.mirch.io/2020/12/24/pihole-xss/
CVE ID: CVE-2020-35660 State: PUBLISHED Published: 2021-04-14T17:05:19 Last Updated: 2024-08-04T17:09:14.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page. Additional Analyst Notes: - CVE Program Container: References: - https://www.huntr.dev/bounties/1-other-monica/ - https://github.com/monicahq/monica/releases/tag/v2.19.1 - https://github.com/monicahq/monica/pull/4451
CVE ID: CVE-2020-35662 State: PUBLISHED Published: 2021-02-27T00:00:00 Last Updated: 2024-10-15T18:35:19.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.
OGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/ - https://security.gentoo.org/glsa/202103-01 - https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2021/dsa-5011 - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2020-35664 State: PUBLISHED Published: 2021-02-22T02:13:33 Last Updated: 2024-08-04T17:09:14.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console. Additional Analyst Notes: - CVE Program Container: References: - https://www.acronis.com - https://dl.managed-protection.com/u/cyberprotect/rn/15/user/en-US/AcronisCyberProtect15_relnotes.htm
CVE ID: CVE-2020-35665 State: PUBLISHED Published: 2020-12-23T00:00:00 Last Updated: 2024-08-04T17:09:14.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation. Additional Analyst Notes: - CVE Program Container: References: - https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/49330 - http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html
CVE ID: CVE-2020-35666 State: PUBLISHED Published: 2020-12-23T19:49:28 Last Updated: 2024-08-04T17:09:14.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id[$ne]=1 value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/steedos/steedos-platform/issues/1245
CVE ID: CVE-2020-35667 State: PUBLISHED Published: 2021-02-03T15:51:37 Last Updated: 2024-08-04T17:09:14.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2020-35668 State: PUBLISHED Published: 2020-12-23T22:32:13 Last Updated: 2024-08-04T17:09:14.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has not yet been introduced. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RedisGraph/RedisGraph/issues/1502 - https://github.com/RedisGraph/RedisGraph/pull/1503
CVE ID: CVE-2020-35669 State: PUBLISHED Published: 2020-12-24T02:05:30 Last Updated: 2024-08-04T17:09:14.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dart-lang/http/issues/511 - https://github.com/dart-lang/http/blob/master/CHANGELOG.md#0133