Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8507 State: PUBLISHED Published: 2020-02-05T15:15:09 Last Updated: 2024-08-04T10:03:45.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. Additional Analyst Notes: - CVE Program Container: References: - https://www.info-sec.ca/advisories.html - https://www.info-sec.ca/advisories/Citytv-Video.html - http://packetstormsecurity.com/files/156426/Citytv-Video-Unencrypted-Analytics.html
CVE ID: CVE-2020-8508 State: PUBLISHED Published: 2020-02-03T02:43:06 Last Updated: 2024-08-04T10:03:45.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://downwithup.github.io/CVEPosts.html
CVE ID: CVE-2020-8509 State: PUBLISHED Published: 2020-03-30T17:50:16 Last Updated: 2024-08-04T10:03:46.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/unauthenticated-servlet-access.html
CVE ID: CVE-2020-8510 State: PUBLISHED Published: 2020-02-03T15:00:40 Last Updated: 2024-08-04T10:03:46.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as any user without a password. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/phpabook/news/ - https://0xem.ma/cve/2020/01/31/CVE-2020-8510.html
CVE ID: CVE-2020-8511 State: PUBLISHED Published: 2020-03-23T15:12:00 Last Updated: 2024-08-04T10:03:45.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500. Additional Analyst Notes: - CVE Program Container: References: - https://k4m1ll0.com/cve-2020-8511.html
CVE ID: CVE-2020-8512 State: PUBLISHED Published: 2020-01-31T23:05:29 Last Updated: 2024-08-04T10:03:46.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/156103/IceWarp-WebMail-11.4.4.1-Cross-Site-Scripting.html - https://cxsecurity.com/issue/WLB-2020010205 - https://packetstormsecurity.com/files/156103/IceWarp-WebMail-11.4.4.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-8514 State: PUBLISHED Published: 2020-02-02T14:06:20 Last Updated: 2024-08-04T10:03:46.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality. Additional Analyst Notes: - CVE Program Container: References: - https://www.maxum.com/Rumpus/Download.html - https://pastebin.com/3YdFZCKe
CVE ID: CVE-2020-8515 State: PUBLISHED Published: 2020-02-01T12:36:59.000Z Last Updated: 2025-10-21T23:35:52.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html - https://www.draytek.com/about/security-advisory/vigor3900
spot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html - https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/ - http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html
CVE ID: CVE-2020-8516 State: PUBLISHED Published: 2020-02-02T12:52:56 Last Updated: 2024-08-04T10:03:45.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html - https://lists.torproject.org/pipermail/tor-dev/2020-Februa
log/index.php?/archives/868-Deanonymizing-Tor-Circuits.html - https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html - https://security-tracker.debian.org/tracker/CVE-2020-8516 - https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html - https://trac.torproject.org/projects/tor/ticket/33129
CVE ID: CVE-2020-8517 State: PUBLISHED Published: 2020-02-04T19:54:31 Last Updated: 2024-08-04T10:03:46.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2020_3.tx
. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2020_3.txt - http://www.squid-cache.org/Versions/v4/changesets/squid-4-6982f1187a26557e582172965e266f544ea562a5.patch - https://usn.ubuntu.com/4289-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html - https://security.gentoo.org/glsa/202003-34 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html - https://security.netapp.com/advisory/ntap-20210304-0002/
CVE ID: CVE-2020-8518 State: PUBLISHED Published: 2020-02-17T14:53:34 Last Updated: 2024-08-04T10:03:46.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PRPIFQDGYPQ3F2TF2ETPIL7IYNSVVZQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKTNYDBDVJNMVC7QPXQI7CMPLX3USZ2T/ - https://lists.horde.org/archives/announce/2020/001285.html - http://packets
/message/DKTNYDBDVJNMVC7QPXQI7CMPLX3USZ2T/ - https://lists.horde.org/archives/announce/2020/001285.html - http://packetstormsecurity.com/files/156872/Horde-5.2.22-CSV-Import-Code-Execution.html - https://lists.debian.org/debian-lts-announce/2020/04/msg00008.html
CVE ID: CVE-2020-8519 State: PUBLISHED Published: 2020-07-07T19:20:20 Last Updated: 2024-08-04T10:03:46.105Z Vendors: phpzag Products: phpzag live add edit delete data tables records with ajax php mysql Problem Types: SQL Injection Description: SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=213 - https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/ - http://www.openwall.com/lists/oss-security/2020/07/09/1
CVE ID: CVE-2020-8520 State: PUBLISHED Published: 2020-07-07T19:20:20 Last Updated: 2024-08-04T10:03:46.177Z Vendors: phpzag Products: phpzag live add edit delete data tables records with ajax php mysql Problem Types: SQL Injection in search field of phpzag live add edit delete data tables records with ajax php mysql Description: SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=213 - https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/ - http://www.openwall.com/lists/oss-secur
://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/ - http://www.openwall.com/lists/oss-security/2020/07/09/1
CVE ID: CVE-2020-8521 State: PUBLISHED Published: 2020-07-07T19:20:21 Last Updated: 2024-08-04T10:03:45.850Z Vendors: phpzag Products: phpzag live add edit delete data tables records with ajax php mysql Problem Types: SQL Injection in search field of phpzag live add edit delete data tables records with ajax php mysql Description: SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=213 - https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/ - http://www.openwall.com/lists/oss-sec
ps://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/ - http://www.openwall.com/lists/oss-security/2020/07/09/1
CVE ID: CVE-2020-8539 State: PUBLISHED Published: 2020-12-01T17:48:46 Last Updated: 2024-08-04T10:03:45.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle. Additional Analyst Notes: - CVE Program Container: References: - https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf - https://gis
tional Analyst Notes: - CVE Program Container: References: - https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf - https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3
CVE ID: CVE-2020-8540 State: PUBLISHED Published: 2020-03-11T16:15:47 Last Updated: 2024-08-04T10:03:45.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/xxe-vulnerability.html
CVE ID: CVE-2020-8541 State: PUBLISHED Published: 2020-06-16T13:47:27 Last Updated: 2024-08-04T10:03:46.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows XXE attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html
CVE ID: CVE-2020-8542 State: PUBLISHED Published: 2020-06-16T13:46:57 Last Updated: 2024-08-04T10:03:46.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html - http://seclists.org/fulldisclosure/2020/Aug/14 - http://packetstormsecurity.com/files/158932/OX-App-Suite-OX-Documents-XSS-SSRF-Bypass.html
CVE ID: CVE-2020-8543 State: PUBLISHED Published: 2020-06-16T13:46:10 Last Updated: 2024-08-04T10:03:46.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 has Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html
CVE ID: CVE-2020-8544 State: PUBLISHED Published: 2020-06-16T13:50:52 Last Updated: 2024-08-04T10:03:46.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.3 allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/ - https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html
CVE ID: CVE-2020-8545 State: PUBLISHED Published: 2020-02-03T15:23:17 Last Updated: 2024-08-04T10:03:46.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Global.py in AIL framework 2.8 allows path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CIRCL/AIL-framework/commit/e808840f957c810b8e3944cba808716dc722581b
CVE ID: CVE-2020-8547 State: PUBLISHED Published: 2020-02-03T15:52:13 Last Updated: 2024-08-04T10:03:46.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47989
CVE ID: CVE-2020-8548 State: PUBLISHED Published: 2020-02-03T16:32:35 Last Updated: 2024-08-04T10:03:45.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/antonreshetov/massCode/issues/44 - https://github.com/antonreshetov/massCode/issues/43
CVE ID: CVE-2020-8549 State: PUBLISHED Published: 2020-02-03T16:43:03 Last Updated: 2024-08-04T10:03:46.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10056 - https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txt - https://www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-strong-testimonials-plugin/ - https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-tes
lnerability-found-in-strong-testimonials-plugin/ - https://www.jinsonvarghese.com/stored-xss-vulnerability-in-strong-testimonials-plugin/ - http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-8551 State: PUBLISHED Published: 2020-03-27T14:25:14 Last Updated: 2024-08-04T10:03:45.888Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-789 Description: The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/89377 - https://gr
Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/89377 - https://groups.google.com/forum/#%21topic/kubernetes-security-announce/2UOlsba2g0s - https://security.netapp.com/advisory/ntap-20200413-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
CVE ID: CVE-2020-8552 State: PUBLISHED Published: 2020-03-27T14:25:15 Last Updated: 2024-08-04T10:03:46.260Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-789 Description: The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/kubernetes-security-announce/2UOlsba2g0s - https://github.com/kubernetes/kubernetes/issues/89378 - https://security.netapp.com/advisory/ntap-2020
nce/2UOlsba2g0s - https://github.com/kubernetes/kubernetes/issues/89378 - https://security.netapp.com/advisory/ntap-20200413-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
CVE ID: CVE-2020-8553 State: PUBLISHED Published: 2020-07-29T14:53:32 Last Updated: 2024-08-04T10:03:46.369Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: ingress-nginx Problem Types: CWE-73 Description: The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/ingress-nginx/issues/5126
CVE ID: CVE-2020-8554 State: PUBLISHED Published: 2021-01-21T17:09:21.169393Z Last Updated: 2024-09-17T00:40:57.713Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-283 Description: Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect. Additional Analyst Not
to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8 - https://github.com/kubernetes/kubernetes/issues/97076 - https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E - https://lists.apac
ead.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-8555 State: PUBLISHED Published: 2020-06-04T21:50:11.749943Z Last Updated: 2024-09-16T18:39:58.006Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-918 Description: The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services). Additional Analyst Notes: - CVE Program Container: References
's host network (such as link-local or loopback services). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2020/06/01/4 - https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion - https://github.com/kubernetes/kubernetes/issues/91542 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/ - https://security.netapp.com/advisory/ntap-20200724-0005/ - http://www.openwall.com/lists/oss-security/2021/05/04/8
CVE ID: CVE-2020-8557 State: PUBLISHED Published: 2020-07-23T16:59:38.580465Z Last Updated: 2024-09-17T03:14:05.177Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-400 Description: The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause
od. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/93032 - https://groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY/m/vVSO61AhBwAJ - https://security.netapp.com/advisory/ntap-20200821-0002/
CVE ID: CVE-2020-8558 State: PUBLISHED Published: 2020-07-27T19:55:19.321721Z Last Updated: 2024-09-16T22:40:40.949Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-420 Description: The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the sam
eachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/92315 - https://groups.google.com/g/kubernetes-announce/c/sI4KmlH3S2I/m/TljjxOBvBQAJ - https://security.netapp.com/advisory/ntap-20200821-0001/