Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
A/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb
h.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8476 State: PUBLISHED Published: 2020-04-29T00:00:00 Last Updated: 2024-08-04T10:03:45.851Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ABB Products: Central Licensing System, ABB Ability System 800xA, Compact HMI, Control Builder Safe, Symphony Plus S+ Operations, Symphony Plus S+ Engineering , Composer Harmony, Composer Melody , Harmony OPC Server Standalone, Advant OCS Control Builder A, Composer CTK, AdvaBuild, OPC Server for Mod 300 (non-800xA), OPC Data Link, Knowledge Manager, Manufacturing Operations Management, Advant OCS AC 100 OPS Server, ABB Ability™ SCADAvantage Problem Types: CWE-20 Description: For the Central Licensing Se
A/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to alter licenses assigned to the system nodes by sending specially crafted messages to the CLS web service. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch
nces: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8477 State: PUBLISHED Published: 2020-04-22T14:46:23 Last Updated: 2024-08-04T10:03:46.221Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ABB Products: System 800xA Information Manager Problem Types: CWE-79, CWE-489 Description: The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121232&LanguageCode=en&
CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121232&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8478 State: PUBLISHED Published: 2020-04-29T01:58:54 Last Updated: 2024-08-04T10:03:44.802Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ABB Products: OPC Server for AC 800M, MMS Server for AC 800M, Base Software for SoftControl Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl (all published versions) enables an attacker authenticated on the local system to inject data, affecting the online view of runtime data shown in Control Builder. Additional Analyst Notes: - CVE Program
inject data, affecting the online view of runtime data shown in Control Builder. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8479 State: PUBLISHED Published: 2020-04-29T00:00:00 Last Updated: 2024-08-04T10:03:44.804Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: ABB Products: Central Licensing System, ABB Ability System 800xA, Compact HMI, Control Builder Safe, Symphony Plus S+ Operations, Symphony Plus S+ Engineering , Composer Harmony, Composer Melody , Harmony OPC Server Standalone, Advant OCS Control Builder A, Composer CTK, AdvaBuild, OPC Server for Mod 300 (non-800xA), OPC Data Link, Knowledge Manager, Manufacturing Operations Management, Advant OCS AC 100 OPS Server, ABB Ability™ SCADAvantage Problem Types: CWE-91 Description: For the Central Licensing
t, Advant OCS AC 100 OPS Server, ABB Ability™ SCADAvantage Problem Types: CWE-91 Description: For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2,
0xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5. an XML External Entity Injection vulnerability exists that allows an attacker to read or call arbitrary files from the license server and/or from the network and also block the license handling. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&Docume
ogram Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8481 State: PUBLISHED Published: 2020-04-29T01:30:56 Last Updated: 2024-08-04T10:03:45.868Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Central Licensing System, ABB Ability System 800xA, Compact HMI, Control Builder Safe, Symphony Plus S+ Operations, Symphony Plus S+ Engineering , Composer Harmony, Composer Melody , Harmony OPC Server Standalone, Advant OCS Control Builder A, Composer CTK, AdvaBuild, OPC Server for Mod 300 (non-800xA), OPC Data Link, Knowledge Manager, Manufacturing Operations Management, Advant OCS AC 100 OPS Server Problem Types: CWE-200 Description: For ABB products ABB Ability™ System 800xA and relat
t, Advant OCS AC 100 OPS Server Problem Types: CWE-200 Description: For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Da
ver 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8482 State: PUBLISHED Published: 2020-05-29T21:33:10 Last Updated: 2024-08-04T10:03:45.846Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Device Library Wizard Problem Types: CWE-922 Description: Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121681&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8484 State: PUBLISHED Published: 2020-04-29T01:58:57 Last Updated: 2024-08-04T10:03:45.932Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: 800xA for DCI Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=La
ferences: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8485 State: PUBLISHED Published: 2020-04-29T01:59:04 Last Updated: 2024-08-04T10:03:46.099Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: 800xA for MOD300 Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Ac
ner: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8486 State: PUBLISHED Published: 2020-04-29T01:59:23 Last Updated: 2024-08-04T10:03:46.229Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: ABB Products: 800xA RNRP Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker authenticated on the local system to inject data, affect node redundancy handling. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8487 State: PUBLISHED Published: 2020-04-29T01:59:28 Last Updated: 2024-08-04T10:03:45.974Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: ABB Products: System 800xA Base Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker authenticated on the local system to inject data, affect node redundancy handling. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8488 State: PUBLISHED Published: 2020-04-29T01:59:34 Last Updated: 2024-08-04T10:03:44.822Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: 800xA Batch Management Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageC
tes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8489 State: PUBLISHED Published: 2020-04-29T01:59:42 Last Updated: 2024-08-04T10:03:45.932Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: 800xA Information Management Problem Types: CWE-264 Description: Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management history services unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download
es unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-8492 State: PUBLISHED Published: 2020-01-30T00:00:00 Last Updated: 2024-08-04T10:03:45.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue39503 - https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html - https://github.com/python/cpython/pull/18284 - https://security.net
y.readthedocs.io/vuln/urllib-basic-auth-regex.html - https://github.com/python/cpython/pull/18284 - https://security.netapp.com/advisory/ntap-20200221-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html - https://usn.ubuntu.com/4333-1/ - https://usn.ubuntu.com/4333-2/ - https://security.gentoo.org/glsa/202005-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.or
KDEXLYW5UQ4S7PA7E37IITOC7C56J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html - https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.ht
11b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
CVE ID: CVE-2020-8493 State: PUBLISHED Published: 2020-01-30T21:18:31 Last Updated: 2024-08-04T10:03:45.884Z Severity: MEDIUM (CVSS 6.9 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:H/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator. Additional Analyst Notes: - CVE Program Container: References: - http://www.nolanbkennedy.com/post/stored-xss-in-kronos-web-time-and-attendance-webta - https://www.kronos.co
ferences: - http://www.nolanbkennedy.com/post/stored-xss-in-kronos-web-time-and-attendance-webta - https://www.kronos.com/products/kronos-webta - http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.html
CVE ID: CVE-2020-8494 State: PUBLISHED Published: 2020-01-30T21:18:23 Last Updated: 2024-08-04T10:03:46.106Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.kronos.com/products/kronos-webta - ht
ters. Additional Analyst Notes: - CVE Program Container: References: - https://www.kronos.com/products/kronos-webta - http://www.nolanbkennedy.com/post/privilege-escalation-2-in-kronos-web-time-and-attendance-webta
CVE ID: CVE-2020-8495 State: PUBLISHED Published: 2020-01-30T21:18:15 Last Updated: 2024-08-04T10:03:45.706Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and delegatorUserId parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.kronos.com/products/kronos-webta - http://www.nolanbkennedy.com/
tes: - CVE Program Container: References: - https://www.kronos.com/products/kronos-webta - http://www.nolanbkennedy.com/post/privilege-escalation-in-kronos-web-time-and-attendance-webta - http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.html
CVE ID: CVE-2020-8496 State: PUBLISHED Published: 2020-01-30T21:17:59 Last Updated: 2024-08-04T10:03:44.861Z Severity: MEDIUM (CVSS 6.9 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:H/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.kronos.com/products/kronos-webta - http://www.nolanbkennedy.com/post/stored-xss-2-in-kronos-web-time-and-attendance-webta
CVE ID: CVE-2020-8497 State: PUBLISHED Published: 2020-03-23T15:01:08 Last Updated: 2024-08-04T10:03:46.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Additional Analyst Notes: - CVE Program Container: References: - https://k4m1ll0.com/cve-2020-8497.html
CVE ID: CVE-2020-8498 State: PUBLISHED Published: 2020-01-30T22:52:15 Last Updated: 2024-08-04T10:03:45.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7 - https://github.com/bradyvercher/gistpress/relea
bradyvercher/gistpress/commit/e3f260edb6673227b0471c74b7ab13c094411ef7 - https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2 - https://wpvulndb.com/vulnerabilities/10053
CVE ID: CVE-2020-8500 State: PUBLISHED Published: 2020-03-02T15:03:22 Last Updated: 2024-11-18T17:48:20.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://k4m1ll0.com/cve-2020-8500.html - https://pandorafms.com/downloads/extension-uploader-feature-explained.mp4
CVE ID: CVE-2020-8503 State: PUBLISHED Published: 2020-01-31T19:57:55 Last Updated: 2024-08-04T10:03:46.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated sender because of an error in a file-upload feature. This is fixed in 5.1.1068 and 6.0.1004. Additional Analyst Notes: - CVE Program Container: References: - https://cve.biscom.com/bis-sft-cv-0008
CVE ID: CVE-2020-8504 State: PUBLISHED Published: 2020-01-31T21:27:54 Last Updated: 2024-08-04T10:03:45.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/SchoolERPCSRF
CVE ID: CVE-2020-8505 State: PUBLISHED Published: 2020-01-31T21:27:43 Last Updated: 2024-08-04T10:03:46.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/SchoolERPCSRF
CVE ID: CVE-2020-8506 State: PUBLISHED Published: 2020-02-05T15:19:49 Last Updated: 2024-08-04T10:03:46.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics. Additional Analyst Notes: - CVE Program Container: References: - https://www.info-sec.ca/advisories.html - https://www.info-sec.ca/advisories/Global-TV.html - http://packetstormsecurity.com/files/156425/Global-TV-Unencrypted-Analytics.html