Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8127 State: PUBLISHED Published: 2020-02-28T19:25:46 Last Updated: 2024-08-04T09:48:25.585Z Vendors: n/a Products: reveal.js Problem Types: CWE-79 Description: Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/691977
CVE ID: CVE-2020-8128 State: PUBLISHED Published: 2020-02-14T21:30:21 Last Updated: 2024-08-04T09:48:25.647Z Vendors: n/a Products: jsreport Problem Types: CWE-829 Description: An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/660565
CVE ID: CVE-2020-8129 State: PUBLISHED Published: 2020-02-14T21:28:27 Last Updated: 2024-08-04T09:48:25.589Z Vendors: n/a Products: script-manager Problem Types: CWE-94 Description: An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/660563
CVE ID: CVE-2020-8130 State: PUBLISHED Published: 2020-02-24T14:41:26 Last Updated: 2024-08-04T09:48:25.624Z Vendors: n/a Products: https://github.com/ruby/ruby Problem Types: CWE-78 Description: There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/651518 - https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html - https://usn.ubuntu.com/4295-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html - https://lists.fedoraproject.org/archives/list/package-announce%40li
g/opensuse-security-announce/2020-03/msg00041.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/523CLQ62VRN3VVC52KMPTROCCKY4Z36B/
CVE ID: CVE-2020-8131 State: PUBLISHED Published: 2020-02-24T14:41:23 Last Updated: 2024-08-04T09:48:25.635Z Vendors: n/a Products: yarn Problem Types: CWE-22 Description: Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/730239 - https://github.com/yarnpkg/yarn/pull/7831
CVE ID: CVE-2020-8132 State: PUBLISHED Published: 2020-02-28T19:24:41 Last Updated: 2024-08-04T09:48:25.599Z Vendors: n/a Products: pdf-image Problem Types: CWE-94 Description: Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/781664
CVE ID: CVE-2020-8133 State: PUBLISHED Published: 2020-11-09T14:25:24 Last Updated: 2024-08-04T09:48:25.594Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-657 Description: A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/661051%2C - https://nextcloud.com/security/advisory/?id=NC-SA-2020-038
CVE ID: CVE-2020-8134 State: PUBLISHED Published: 2020-03-20T18:26:42 Last Updated: 2024-08-04T09:48:25.651Z Vendors: n/a Products: Ghost Problem Types: CWE-918 Description: Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/793704
CVE ID: CVE-2020-8135 State: PUBLISHED Published: 2020-03-20T18:26:32 Last Updated: 2024-08-04T09:48:25.652Z Vendors: n/a Products: uppy Problem Types: CWE-918 Description: The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/786956
CVE ID: CVE-2020-8136 State: PUBLISHED Published: 2020-03-20T18:26:21 Last Updated: 2024-08-04T09:48:25.935Z Vendors: n/a Products: fastify-multipart Problem Types: CWE-400 Description: Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/804772
CVE ID: CVE-2020-8137 State: PUBLISHED Published: 2020-03-20T18:26:37 Last Updated: 2024-08-04T09:48:25.646Z Vendors: n/a Products: blamer Problem Types: CWE-94 Description: Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/772448
CVE ID: CVE-2020-8138 State: PUBLISHED Published: 2020-03-20T20:12:26 Last Updated: 2024-08-04T09:48:25.824Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-918 Description: A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/736867 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-014
CVE ID: CVE-2020-8139 State: PUBLISHED Published: 2020-03-20T20:14:30 Last Updated: 2024-08-04T09:48:25.736Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-284 Description: A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/788257 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-015 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE ID: CVE-2020-8140 State: PUBLISHED Published: 2020-03-20T20:20:14 Last Updated: 2024-08-04T09:48:25.656Z Vendors: n/a Products: Desktop Client Problem Types: CWE-94 Description: A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/633266 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-016
CVE ID: CVE-2020-8141 State: PUBLISHED Published: 2020-03-15T17:04:40 Last Updated: 2024-08-04T09:48:25.637Z Vendors: n/a Products: dot Problem Types: CWE-94 Description: The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/390929
CVE ID: CVE-2020-8142 State: PUBLISHED Published: 2020-04-03T20:52:35 Last Updated: 2024-08-04T09:48:25.671Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-863 Description: A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was however possible for anyone with access to a Revive Adserver admin user interface to bypass such check and change e-email address or password of the currently logged in user by altering t
user interface to bypass such check and change e-email address or password of the currently logged in user by altering the form payload.The attack requires physical access to the user interface of a logged in user. If the POST payload was altered by turning the “pwold” parameter into an array, Revive Adserver would fetch and authorise the operation even if no password was provided. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2020-002/ - https://hackerone.com/reports/792895
CVE ID: CVE-2020-8143 State: PUBLISHED Published: 2020-04-03T20:52:41 Last Updated: 2024-08-04T09:48:25.605Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-601 Description: An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter. A
tion was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/794144 - https://www.revive-adserver.com/security/revive-sa-2020-002/
CVE ID: CVE-2020-8144 State: PUBLISHED Published: 2020-04-01T22:20:04 Last Updated: 2024-08-04T09:48:25.776Z Vendors: n/a Products: UniFi Video Controller (for Windows 7/8/10 x64) Problem Types: CWE-22 Description: The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware update information. If the version field contains ..\ character sequences, the destination file path to save the firmware can be manipulated to be outside the intended destination direct
quences, the destination file path to save the firmware can be manipulated to be outside the intended destination directory tree. Fixed in UniFi Video Controller v3.10.3 and newer. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0e6-4e26-a331-1d271f84673e
CVE ID: CVE-2020-8145 State: PUBLISHED Published: 2020-04-01T22:20:07 Last Updated: 2024-08-04T09:48:25.554Z Vendors: n/a Products: UniFi Video Controller (for Windows 7/8/10 x64) Problem Types: Privilege Escalation (CAPEC-233) Description: The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP or CUSTOM_GROUP groups, can access these endpoints and overwrite the current application configuration. This can be abused for various purposes, including adding new administrative users. Affected Products: UniFi Video Controller v3.9.3
bused for various purposes, including adding new administrative users. Affected Products: UniFi Video Controller v3.9.3 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.9.6 and newer. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0e6-4e26-a331-1d271f84673e
CVE ID: CVE-2020-8146 State: PUBLISHED Published: 2020-04-01T22:21:21 Last Updated: 2024-08-04T09:48:25.654Z Vendors: n/a Products: UniFi Video Controller (for Windows 7/8/10 x64) Problem Types: Privilege Escalation (CAPEC-233) Description: In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the windows registry when installing UniFi-Video controller. Affected Products: UniFi Video Controller v3.10.2 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Vide
eo controller. Affected Products: UniFi Video Controller v3.10.2 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.10.3 and newer. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0e6-4e26-a331-1d271f84673e
CVE ID: CVE-2020-8147 State: PUBLISHED Published: 2020-04-03T20:52:38 Last Updated: 2024-08-04T09:48:25.670Z Vendors: n/a Products: utils-extend Problem Types: CWE-471 Description: Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/801522
CVE ID: CVE-2020-8148 State: PUBLISHED Published: 2020-04-13T13:32:46 Last Updated: 2024-08-04T09:48:25.652Z Vendors: n/a Products: UniFi Cloud Key Gen2 Problem Types: CWE-287 Description: UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-advisory-bulletin-007-007/eb639fa0-68ad-4bf5-9663-3b760eb2f93a - https://hackerone.com/reports/802079
CVE ID: CVE-2020-8149 State: PUBLISHED Published: 2020-05-15T18:50:27 Last Updated: 2024-08-04T09:48:25.725Z Vendors: n/a Products: logkitty Problem Types: CWE-94 Description: Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/825729
CVE ID: CVE-2020-8150 State: PUBLISHED Published: 2020-11-09T14:19:42 Last Updated: 2024-08-04T09:48:25.666Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-310 Description: A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/742588 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-039 - http://seclists.org/fulldisclosure/2020/Dec/55 - http://seclists.org/fulldisclosure/2020/Dec/57 - http://seclists.org/fulldisclosure/2020/Dec/58
CVE ID: CVE-2020-8151 State: PUBLISHED Published: 2020-05-12T13:01:36 Last Updated: 2024-08-04T09:48:25.675Z Vendors: n/a Products: https://github.com/rails/activeresource Problem Types: CWE-200 Description: There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/rubyonrails-security/pktoF4VmiM8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P7B7A4H22DZ522HLDS3JX3NX2CXIOZSR/
CVE ID: CVE-2020-8152 State: PUBLISHED Published: 2020-11-16T00:36:11 Last Updated: 2024-08-04T09:48:25.679Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-522 Description: Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/743505 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-040 - http://seclists.org/fulldisclosure/2020/Dec/54
CVE ID: CVE-2020-8153 State: PUBLISHED Published: 2020-05-12T13:01:33 Last Updated: 2024-08-04T09:48:25.662Z Vendors: n/a Products: Nextcloud Groupfolders Problem Types: CWE-284 Description: Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/642515 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-017 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE ID: CVE-2020-8154 State: PUBLISHED Published: 2020-05-12T13:01:26 Last Updated: 2024-08-04T09:48:25.747Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-639 Description: An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/819807 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-018 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html - ht
ecurity-announce/2020-05/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE ID: CVE-2020-8155 State: PUBLISHED Published: 2020-05-12T13:01:29 Last Updated: 2024-08-04T09:48:25.663Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-79 Description: An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=NC-SA-2020-019 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html - htt
curity-announce/2020-05/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE ID: CVE-2020-8156 State: PUBLISHED Published: 2020-05-12T13:01:22 Last Updated: 2024-08-04T09:48:25.674Z Vendors: n/a Products: Nextcloud Mail Problem Types: CWE-295 Description: A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=NC-SA-2020-020 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE ID: CVE-2020-8157 State: PUBLISHED Published: 2020-05-02T15:19:33 Last Updated: 2024-08-04T09:48:25.665Z Vendors: n/a Products: UniFi Cloud Key Gen2, Cloud Key Gen2 plus Problem Types: CWE-284 Description: UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and Cloud Key gen2 Plus contains a vulnerability that allows unrestricted root access through the serial interface (UART). Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-advisory-bulletin-008-008/5f66ca4c-10d6-4ca5-9620-37d5a4f22413 - https://community.ui.com/releases/UniFi-Cloud-Key-Firmware-1-1-11/a24e55e1-6d90-46d7-92e2-01539ec8c79d
CVE ID: CVE-2020-8158 State: PUBLISHED Published: 2020-09-18T20:12:16 Last Updated: 2024-08-04T09:48:25.595Z Vendors: n/a Products: typeorm Problem Types: CWE-471 Description: Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/869574
CVE ID: CVE-2020-8159 State: PUBLISHED Published: 2020-05-12T13:01:43 Last Updated: 2024-08-04T09:48:25.823Z Vendors: n/a Products: https://github.com/rails/actionpack-page_caching Problem Types: CWE-22 Description: There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/rubyonrails-security/CFRVkEytdP8 - https://lists.debian.org/debian-lts-announce/2021/07/msg00019.html
CVE ID: CVE-2020-8160 State: PUBLISHED Published: 2021-01-06T14:03:44 Last Updated: 2024-08-04T09:48:25.590Z Vendors: n/a Products: MendixSSO Problem Types: CWE-79 Description: MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/838178 - https://mark
er. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/838178 - https://marketplace.mendix.com/link/component/111349
CVE ID: CVE-2020-8161 State: PUBLISHED Published: 2020-07-02T00:00:00 Last Updated: 2024-08-04T09:48:25.656Z Vendors: n/a Products: https://github.com/rack/rack Problem Types: CWE-548 Description: A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/434404 - https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA - https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html - https://usn.ubuntu.com/4561-1/ - https://
vNZTzPA - https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html - https://usn.ubuntu.com/4561-1/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
CVE ID: CVE-2020-8162 State: PUBLISHED Published: 2020-06-19T17:02:42 Last Updated: 2024-08-04T09:48:25.603Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-602 Description: A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/789579 - https://groups.google.com/g/rubyonrails-security/c/PjU3946mreQ - https://www.debian.org/security/2020/dsa-4766