Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10942 State: PUBLISHED Published: 2020-03-24T21:03:52 Last Updated: 2024-08-04T11:21:14.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/linus/42d84c8490f9f0931786f1623191fcab397c3d64 - https://lkml.org/lkml/2020/2/15/125 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8 - https://security.netapp.com/advisory/ntap-20200403-0003/ - http://www.openwall.com/lists/oss
rnel/v5.x/ChangeLog-5.5.8 - https://security.netapp.com/advisory/ntap-20200403-0003/ - http://www.openwall.com/lists/oss-security/2020/04/15/4 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html - https://www.debian.org/security/2020/dsa-4667 - https://usn.ubuntu.com/4344-1/ - https://usn.ubuntu.com/4345-1/ - https://usn.ubuntu.com/4342-1/ - https://usn.ubuntu.com/4364-1/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698
CVE ID: CVE-2020-10944 State: PUBLISHED Published: 2020-04-28T13:29:50 Last Updated: 2024-08-04T11:21:14.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/nomad/issues/7468
CVE ID: CVE-2020-10945 State: PUBLISHED Published: 2020-05-27T15:12:31 Last Updated: 2024-08-04T11:21:13.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon before 19.10.7 exposes Session IDs in server responses. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2020-05-13-cve-2020-10945-centreon-session-id-exposure
CVE ID: CVE-2020-10946 State: PUBLISHED Published: 2020-05-27T15:12:32 Last Updated: 2024-08-04T11:21:13.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2
ctical-overview widget. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
CVE ID: CVE-2020-10947 State: PUBLISHED Published: 2020-04-17T12:38:45 Last Updated: 2024-08-04T11:21:13.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.sophos.com/en-us.aspx - https://community.sophos.com/b/security-blog/posts/advisory-cve-2020-10947---sophos-anti-virus-for-macos-privilege-escalation
CVE ID: CVE-2020-10948 State: PUBLISHED Published: 2020-04-01T20:11:38 Last Updated: 2024-08-04T11:21:13.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fireeye/Vulnerability-Disclosures/tree/master/FEYE-2020-0004
CVE ID: CVE-2020-10951 State: PUBLISHED Published: 2020-04-15T19:48:38 Last Updated: 2024-08-04T11:21:13.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19012-my-cloud-home-and-ibi-portal-websites-clickjacking-vulnerability - https://www.westerndigital.com/support/productsecurity/wdc-19012-my-cloud-home-and-ibi-websites-2-2-0 - https://www.westerndigital.com/support/productsecurity/wdc-19012-my-cloud-home-
2-my-cloud-home-and-ibi-websites-2-2-0 - https://www.westerndigital.com/support/productsecurity/wdc-19012-my-cloud-home-and-ibi-websites-2-2-0
CVE ID: CVE-2020-10952 State: PUBLISHED Published: 2020-03-27T18:55:16 Last Updated: 2024-08-04T11:21:13.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10953 State: PUBLISHED Published: 2020-03-27T18:52:05 Last Updated: 2024-08-04T11:21:13.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10954 State: PUBLISHED Published: 2020-03-27T18:50:15 Last Updated: 2024-08-04T11:21:14.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab through 12.9 is affected by a potential DoS in repository archive download. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10955 State: PUBLISHED Published: 2020-03-27T18:48:49 Last Updated: 2024-08-04T11:21:14.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/ - https://www.debian.org/security/2020/dsa-4691
CVE ID: CVE-2020-10956 State: PUBLISHED Published: 2020-03-27T18:25:52 Last Updated: 2024-08-04T11:21:13.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10957 State: PUBLISHED Published: 2020-05-18T13:56:25 Last Updated: 2024-08-04T11:21:13.823Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - https://www.openwall.com/lists/oss-security/2020/05/18/1 - http://www.openwall.com/lists/oss-security/2020/05/18/1 - https://usn.ubuntu.com/4361-1/ - http://seclists.org/fulldisclosure
//www.openwall.com/lists/oss-security/2020/05/18/1 - https://usn.ubuntu.com/4361-1/ - http://seclists.org/fulldisclosure/2020/May/37 - http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html - https://www.debian.org/security/2020/dsa-4690 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/
CVE ID: CVE-2020-10958 State: PUBLISHED Published: 2020-05-18T14:00:33 Last Updated: 2024-08-04T11:21:13.881Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - https://www.openwall.com/lists/oss-security/2020/05/18/1 - http://www.openwall.com/lists/oss-security/2020/05/18/1 - https://usn.ubu
openwall.com/lists/oss-security/2020/05/18/1 - http://www.openwall.com/lists/oss-security/2020/05/18/1 - https://usn.ubuntu.com/4361-1/ - http://seclists.org/fulldisclosure/2020/May/37 - http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html - https://www.debian.org/security/2020/dsa-4690 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/
CVE ID: CVE-2020-10959 State: PUBLISHED Published: 2020-06-02T13:52:22 Last Updated: 2024-08-04T11:21:14.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T232932 - https://gerrit.wikimedia.org/r/c/mediawiki/core/+/536725 - https://phabricator.wikimedia.org/T240393
CVE ID: CVE-2020-10960 State: PUBLISHED Published: 2020-04-03T14:13:52 Last Updated: 2024-08-04T11:21:14.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T246602 - https
XSS). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T246602 - https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.html
CVE ID: CVE-2020-10962 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-21T14:34:37.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default configuration may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases - https://discourse.psappdeploytoolkit.com/t/psappdeploytoolkit-3-8-2/2555
CVE ID: CVE-2020-10963 State: PUBLISHED Published: 2020-03-25T21:23:52 Last Updated: 2024-08-04T11:21:14.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued. Additional Analyst Notes: - CVE Program Container: References: - https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/ - http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.html
CVE ID: CVE-2020-10964 State: PUBLISHED Published: 2020-03-25T21:53:01 Last Updated: 2024-08-04T11:21:14.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename. Additional Analyst Notes: - CVE Program Container: References: - https://blog.s9y.org/archives/290-Serendipity-2.3.4-released-security-update.html - https://github.com/s9y/Serendipity/releases/tag/2.3.4
CVE ID: CVE-2020-10965 State: PUBLISHED Published: 2020-03-25T22:53:12 Last Updated: 2024-08-04T11:21:13.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin account. This vulnerability only exists when the default admin account is not disabled. It is fixed in 20.01.1 and 19.11.2. Additional Analyst Notes: - CVE Program Container: References: - https://help.teradici.com/s/article/3729 - https://healdb.tech/blog.html
CVE ID: CVE-2020-10966 State: PUBLISHED Published: 2020-03-25T22:50:16 Last Updated: 2024-08-04T11:21:13.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hestiacp/hestiacp/issues/748 - https://github.com/serghey-rodin/vesta/commit/c3c4de43d6701560f604ca7996f717b08e3d7d1d - https://github.com/hestiacp/hestiacp/releases/tag/1.1.1
CVE ID: CVE-2020-10967 State: PUBLISHED Published: 2020-05-18T14:02:55 Last Updated: 2024-08-04T11:21:14.414Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - https://www.openwall.com/lists/oss-security/2020/05/18/1 - http://www.openwall.com/lists/oss-security/2020/05/18/1 - https://usn.ubuntu.com/4361-1/ - http://seclists.org/fulldisclosure/2020/May/37 - http://packetstormse
ty/2020/05/18/1 - https://usn.ubuntu.com/4361-1/ - http://seclists.org/fulldisclosure/2020/May/37 - http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html - https://www.debian.org/security/2020/dsa-4690 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.or
N2VW55ZC2AQBGBJMLRJSZIKSB2NS6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/
CVE ID: CVE-2020-10968 State: PUBLISHED Published: 2020-03-26T12:43:45 Last Updated: 2024-08-04T11:21:14.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://securit
ic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200403-0002/ - https://github.com/FasterXML/jackson-databind/issues/2662 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-10969 State: PUBLISHED Published: 2020-03-26T12:43:34 Last Updated: 2024-08-04T11:21:13.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200403-0002/
8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200403-0002/ - https://github.com/FasterXML/jackson-databind/issues/2642 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-10971 State: PUBLISHED Published: 2020-05-07T17:54:01 Last Updated: 2024-08-04T11:21:14.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session. Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3,
N531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10971 - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10971-Affected_Devices - https://github.com/sudo-jtcsec/Nyra - https://github.com/Roni-Carta/nyra
CVE ID: CVE-2020-10972 State: PUBLISHED Published: 2020-05-07T17:51:48 Last Updated: 2024-08-04T11:21:14.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972 - https://github.com/sudo-jtcsec/Nyra - https://github.com/Roni-Carta/nyra -
sudo-jtcsec/CVE/blob/master/CVE-2020-10972 - https://github.com/sudo-jtcsec/Nyra - https://github.com/Roni-Carta/nyra - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972-affected_devices
CVE ID: CVE-2020-10973 State: PUBLISHED Published: 2020-05-07T17:50:15 Last Updated: 2024-08-04T11:21:14.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973 - https://github.com
CVE Program Container: References: - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973 - https://github.com/sudo-jtcsec/Nyra - https://github.com/Roni-Carta/nyra - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973-affected_devices
CVE ID: CVE-2020-10974 State: PUBLISHED Published: 2020-05-07T17:42:57 Last Updated: 2024-08-04T11:21:14.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/
79X3, and Jetstream AC3000/ERAC3000 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974 - https://github.com/sudo-jtcsec/Nyra - https://github.com/Roni-Carta/nyra - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devices
CVE ID: CVE-2020-10975 State: PUBLISHED Published: 2020-04-08T18:11:48 Last Updated: 2024-08-04T11:21:13.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10976 State: PUBLISHED Published: 2020-04-08T18:10:59 Last Updated: 2024-08-04T11:21:14.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10977 State: PUBLISHED Published: 2020-04-08T18:09:59 Last Updated: 2024-08-04T11:21:13.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/ - http://packetstormsecurity.com/files/160441/GitLab-File-Read-Remote-Code-Execution.html