Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-20471 State: PUBLISHED Published: 2021-02-01T20:10:12 Last Updated: 2024-08-08T17:42:37.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used (123456) for administrative purposes. There is no prompt to change this password. Note that this password can be used in combination with CVE-2019-20470. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tk-star.com - https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/ - http://seclists.org/fulldisclosure
.com - https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20472 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:12:07.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on One2Track 2019-12-08 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and cannot be used. This makes it easier for an attacker to use the SIM card by stealing the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.one2track.nl - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20473 State: PUBLISHED Published: 2021-02-01T20:13:13 Last Updated: 2024-08-05T02:39:10.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and cannot be used. This makes it easier for an attacker to use the SIM card by stealing the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tk-star.com - https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/ - ht
eferences: - https://www.tk-star.com - https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20474 State: PUBLISHED Published: 2020-02-17T18:36:34 Last Updated: 2024-08-05T02:39:10.084Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port scan operations of the localhost or the hosts on the same network segment, aka SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.managee
the same network segment, aka SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/remote-desktop-management/knowledge-base/authorization-failure.html - https://excellium-services.com/cert-xlm-advisory/cve-2019-20474/
CVE ID: CVE-2019-20477 State: PUBLISHED Published: 2020-02-19T03:09:21 Last Updated: 2024-08-05T02:39:10.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yaml/pyyaml/blob/master/CHANGES - https://www.exploit-db.com/download/47655 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R
55 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN/
CVE ID: CVE-2019-20478 State: PUBLISHED Published: 2020-02-19T03:09:08 Last Updated: 2024-08-05T02:39:10.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47655
CVE ID: CVE-2019-20479 State: PUBLISHED Published: 2020-02-20T00:00:00 Last Updated: 2024-08-05T02:39:10.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zmartzone/mod_auth_openidc/pull/453 - https://github.com/zmartzone/mod_auth_openidc/commit/02431c0adfa30f478cf2eb20ed6ea51fdf446be7 - https://lists.debian.org/debian-lts-announce/2020/02/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00036.html - https://lists.fedoraproje
2/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00036.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27XJYAEONKJDESNE7WVZF5D2Z2OBY5JK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGXONXPWTX7DV62TIUIUVOZF4KQ6SIJE/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html
CVE ID: CVE-2019-20480 State: PUBLISHED Published: 2020-02-24T14:35:58 Last Updated: 2024-08-05T02:39:09.989Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the "admin panel" because there is no CSRF protection. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2019-010
CVE ID: CVE-2019-20481 State: PUBLISHED Published: 2020-02-24T14:35:42 Last Updated: 2024-08-05T02:39:10.085Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2019-010
CVE ID: CVE-2019-20483 State: PUBLISHED Published: 2021-01-05T21:02:18 Last Updated: 2024-08-05T02:39:10.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control/
CVE ID: CVE-2019-20484 State: PUBLISHED Published: 2021-01-05T21:05:07 Last Updated: 2024-08-05T02:39:10.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control/
CVE ID: CVE-2019-20485 State: PUBLISHED Published: 2020-03-19T01:29:44 Last Updated: 2024-08-05T02:39:10.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage). Additional Analyst Notes: - CVE Program Container: References: - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=a663a860819287e041c3de672aad1d8543098ecc - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1730509.html - https://bugzilla.redhat.com/show_bug.cgi?id=1809740 - https://security-tracker.debian.org/tracker/CVE-
msg1730509.html - https://bugzilla.redhat.com/show_bug.cgi?id=1809740 - https://security-tracker.debian.org/tracker/CVE-2019-20485 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953078 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/
CVE ID: CVE-2019-20486 State: PUBLISHED Published: 2020-03-02T15:06:33 Last Updated: 2024-08-05T02:39:10.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/
CVE ID: CVE-2019-20487 State: PUBLISHED Published: 2020-03-02T15:06:06 Last Updated: 2024-08-05T02:39:10.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the setup.cgi?todo=save_htp_account URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/
CVE ID: CVE-2019-20488 State: PUBLISHED Published: 2020-03-02T15:06:24 Last Updated: 2024-08-05T02:39:10.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/
CVE ID: CVE-2019-20489 State: PUBLISHED Published: 2020-03-02T15:06:16 Last Updated: 2024-08-05T02:39:10.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FW_remote.htm&todo=cfg_init request without a cookie, reads the Set-Cookie header in the 401 Unauthorized response, and then repeats the FW_remote.htm&todo=cfg_init request with the specified cookie. Additional Analyst Notes: - CVE Program Container: References:
ote.htm&todo=cfg_init request with the specified cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/
CVE ID: CVE-2019-20490 State: PUBLISHED Published: 2020-03-17T14:23:08 Last Updated: 2024-08-05T02:39:09.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20491 State: PUBLISHED Published: 2020-03-16T20:13:25 Last Updated: 2024-08-05T02:39:10.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20492 State: PUBLISHED Published: 2020-03-17T14:23:54 Last Updated: 2024-08-05T02:39:10.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20493 State: PUBLISHED Published: 2020-03-17T14:24:47 Last Updated: 2024-08-05T02:39:10.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20494 State: PUBLISHED Published: 2020-03-17T14:29:37 Last Updated: 2024-08-05T02:39:10.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20495 State: PUBLISHED Published: 2020-03-17T14:30:15 Last Updated: 2024-08-05T02:39:10.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20496 State: PUBLISHED Published: 2020-03-17T14:30:57 Last Updated: 2024-08-05T02:39:10.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20497 State: PUBLISHED Published: 2020-03-17T14:31:35 Last Updated: 2024-08-05T02:39:10.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20498 State: PUBLISHED Published: 2020-03-17T14:32:12 Last Updated: 2024-08-05T02:39:10.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-20499 State: PUBLISHED Published: 2020-03-05T14:37:27 Last Updated: 2024-08-05T02:39:10.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113 - https://www.exploit-db.com/exploits/46841 - http://packetstormsecurity.com/files/156952/DLINK-DWL-2600-Aut
me=SAP10113 - https://www.exploit-db.com/exploits/46841 - http://packetstormsecurity.com/files/156952/DLINK-DWL-2600-Authenticated-Remote-Command-Injection.html
CVE ID: CVE-2019-20500 State: PUBLISHED Published: 2020-03-05T14:37:00.000Z Last Updated: 2025-10-21T23:35:50.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113 - https://www.exploit-db.com/exploits/46841
CVE ID: CVE-2019-20501 State: PUBLISHED Published: 2020-03-05T14:36:08 Last Updated: 2024-08-05T02:46:08.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, using shell metacharacters in the admin.cgi?action=upgrade firmwareRestore or firmwareServerip parameter. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113 - https://www.exploit-db.com/exploits/46841
CVE ID: CVE-2019-20502 State: PUBLISHED Published: 2020-03-05T19:14:09 Last Updated: 2024-08-05T02:46:08.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s1kr10s/EasyChatServer-DOS
CVE ID: CVE-2019-20503 State: PUBLISHED Published: 2020-03-06T00:00:00 Last Updated: 2024-08-05T02:46:08.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1992 - https://github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467 - https://lists.debian.org/debian-lts-announce/2020/03/msg00013.html - https://www.debian.org/security/2020/dsa-4639 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - http://lists.opensuse.org
39 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00022.html - https://access.redhat.com/errata/RHSA-2020:0815 - https://access.redhat.com/errata/RHSA-2020:0819 - https://access.redhat.com/errata/RHSA-2020:0816 - https://access.redhat.com/errata/RHSA-2020:0820 - https://usn.ubuntu.com/4299-1/ - https://crbug.com/1059349 - https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00023.html - https://www.debian.org/security/2020/dsa-4642 - http://lists.opensuse.org/opensuse-security-announce/2020-03
0023.html - https://www.debian.org/security/2020/dsa-4642 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00030.html - https://www.debian.org/security/2020/dsa-4645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
/2020-03/msg00037.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/ - https://usn.ubuntu.com/4328-1/ - https://usn.ubuntu.com/4335-1/ - https://support.apple.com/kb/HT211175 - https://support.apple.com/kb/HT211171 - https://support.apple.com/kb/HT211168 - https://support.apple.com/kb/HT211177 - http://seclists.org/fulldisclosure/2020/May/49 - http://seclists.org/fulldisclosure/2020/May/52 - http://seclists.org/fulldisclosure/2020/May/55 - http://seclists.org/fulldisclosure/2020/May/59 - https://support.apple.com/HT211168 - https://support.apple.com/HT211171 - https://support.apple.com/HT211175 - https://s
https://support.apple.com/HT211168 - https://support.apple.com/HT211171 - https://support.apple.com/HT211175 - https://support.apple.com/HT211177 - https://lists.debian.org/debian-lts-announce/2023/07/msg00003.html
CVE ID: CVE-2019-20504 State: PUBLISHED Published: 2020-03-09T00:55:30 Last Updated: 2024-08-05T02:46:08.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.rcesecurity.com/2019/04/dell-kace-k1000-remote-code-execution-the-story-of-bug-k1-18652/
CVE ID: CVE-2019-20509 State: REJECTED Published: 2020-03-10T13:37:26 Last Updated: 2020-03-12T13:56:28 Description: No description available.
CVE ID: CVE-2019-20510 State: REJECTED Published: 2020-03-18T00:23:43 Last Updated: 2020-03-18T20:32:20 Description: No description available.
CVE ID: CVE-2019-20511 State: PUBLISHED Published: 2020-03-18T17:41:04 Last Updated: 2024-08-05T02:46:09.157Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: ERPNext 11.1.47 allows blog?blog_category= Frame Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-19-018-frame-injection-in-erpnext/
CVE ID: CVE-2019-20512 State: PUBLISHED Published: 2020-03-18T17:51:40 Last Updated: 2024-08-05T02:46:08.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-19-014-reflected-cross-site-scripting-in-openedx/
CVE ID: CVE-2019-20513 State: PUBLISHED Published: 2020-03-19T17:35:57 Last Updated: 2024-08-05T02:46:09.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open edX Ironwood.1 allows support/certificates?user= reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-19-014-reflected-cross-site-scripting-in-openedx/
CVE ID: CVE-2019-20514 State: PUBLISHED Published: 2020-03-19T17:50:31 Last Updated: 2024-08-05T02:46:09.153Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE ID: CVE-2019-20515 State: PUBLISHED Published: 2020-03-19T17:50:47 Last Updated: 2024-08-05T02:46:09.201Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/