Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10072 State: PUBLISHED Published: 2021-05-24T21:40:26.107162Z Last Updated: 2024-09-17T04:15:01.100Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-280 Description: Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges (CWE-280). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/
l Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc
CVE ID: CVE-2020-10073 State: PUBLISHED Published: 2020-03-13T17:16:09 Last Updated: 2024-08-04T10:50:57.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10074 State: PUBLISHED Published: 2020-03-13T17:13:49 Last Updated: 2024-08-04T10:50:57.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10075 State: PUBLISHED Published: 2020-03-13T17:12:24 Last Updated: 2024-08-04T10:50:57.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10076 State: PUBLISHED Published: 2020-03-13T17:03:20 Last Updated: 2024-08-04T10:50:57.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10077 State: PUBLISHED Published: 2020-03-13T17:01:32 Last Updated: 2024-08-04T10:50:57.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10078 State: PUBLISHED Published: 2020-03-13T16:59:43 Last Updated: 2024-08-04T10:50:57.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10079 State: PUBLISHED Published: 2020-03-13T16:57:52 Last Updated: 2024-08-04T10:50:57.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10080 State: PUBLISHED Published: 2020-03-13T16:56:12 Last Updated: 2024-08-04T10:50:57.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10081 State: PUBLISHED Published: 2020-03-13T16:54:45 Last Updated: 2024-08-04T10:50:57.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10082 State: PUBLISHED Published: 2020-03-13T16:53:49 Last Updated: 2024-08-04T10:50:57.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10083 State: PUBLISHED Published: 2020-03-13T16:51:32 Last Updated: 2024-08-04T10:50:57.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10084 State: PUBLISHED Published: 2020-03-13T16:46:44 Last Updated: 2024-08-04T10:50:57.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a private project namespace Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10085 State: PUBLISHED Published: 2020-03-13T16:44:01 Last Updated: 2024-08-04T10:50:57.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10086 State: PUBLISHED Published: 2020-03-13T16:40:20 Last Updated: 2024-08-04T10:50:57.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10087 State: PUBLISHED Published: 2020-03-13T16:34:34 Last Updated: 2024-08-04T10:50:57.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10088 State: PUBLISHED Published: 2020-03-13T16:29:09 Last Updated: 2024-08-04T10:50:57.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10089 State: PUBLISHED Published: 2020-03-13T16:27:29 Last Updated: 2024-08-04T10:50:57.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10090 State: PUBLISHED Published: 2020-03-13T16:24:55 Last Updated: 2024-08-04T10:50:57.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10091 State: PUBLISHED Published: 2020-03-13T16:18:51 Last Updated: 2024-08-04T10:50:57.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10092 State: PUBLISHED Published: 2020-03-13T16:15:47 Last Updated: 2024-08-04T10:50:57.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ - https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html
CVE ID: CVE-2020-10093 State: PUBLISHED Published: 2020-04-28T13:17:16 Last Updated: 2024-08-04T10:50:57.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products. Additional Analyst Notes: - CVE Program Container: References: - http://support.lexmark.com/index?page=content&id=TE936
CVE ID: CVE-2020-10094 State: PUBLISHED Published: 2020-04-28T13:17:04 Last Updated: 2024-08-04T10:50:57.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS81
3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.
; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier. Additional Analyst Notes: - CVE Program Container: References: - http://suppor
earlier; and X86x LP.SP.P823 and earlier. Additional Analyst Notes: - CVE Program Container: References: - http://support.lexmark.com/index?page=content&id=TE936
CVE ID: CVE-2020-10095 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T15:29:23.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://support.lexmark.com/alerts/ - https://www.lexmark.com/en_us/solutions/security//lexmark-security-advisories.html
CVE ID: CVE-2020-10096 State: PUBLISHED Published: 2020-03-05T00:39:27 Last Updated: 2024-08-04T10:50:57.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains physical access to a user's workstation can browse the browser cache contents and obtain sensitive information. The attacker does not need to be authenticated with the application to view this information, as it would be available via the browser cache. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-a
a the browser cache. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-11
CVE ID: CVE-2020-10097 State: PUBLISHED Published: 2020-03-05T00:39:15 Last Updated: 2024-08-04T10:50:57.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-10
CVE ID: CVE-2020-10098 State: PUBLISHED Published: 2020-03-05T00:38:39 Last Updated: 2024-08-04T10:50:57.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-03
CVE ID: CVE-2020-10099 State: PUBLISHED Published: 2020-03-05T00:38:23 Last Updated: 2024-08-04T10:50:57.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens the ticket or has the ticket within the Toolbar. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-01
CVE ID: CVE-2020-10100 State: PUBLISHED Published: 2020-03-05T00:37:51 Last Updated: 2024-08-04T10:50:57.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies. Additiona
rom one organization to the next allows for users to exfiltrate potentially sensitive data of other companies. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-05
CVE ID: CVE-2020-10101 State: PUBLISHED Published: 2020-03-05T00:37:40 Last Updated: 2024-08-04T10:50:57.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-06
CVE ID: CVE-2020-10102 State: PUBLISHED Published: 2020-03-05T00:37:31 Last Updated: 2024-08-04T10:50:57.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the current implementation, the application responds differently depending on whether the input supplied was recognized as associated with a valid user. This behavior could be used as part of a two-stage automated attack. During the first stage, an attacker would iterate through a list of account names to determine which correspond to valid accounts. Du
rst stage, an attacker would iterate through a list of account names to determine which correspond to valid accounts. During the second stage, the attacker would use a list of common passwords to attempt to brute force credentials for accounts that were recognized by the system in the first stage. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-07
CVE ID: CVE-2020-10103 State: PUBLISHED Published: 2020-03-05T00:37:11 Last Updated: 2024-08-04T10:50:57.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-02
CVE ID: CVE-2020-10104 State: PUBLISHED Published: 2020-03-05T00:37:04 Last Updated: 2024-08-04T10:50:57.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-04
CVE ID: CVE-2020-10105 State: PUBLISHED Published: 2020-03-05T00:36:55 Last Updated: 2024-08-04T10:50:57.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/public/404.html) Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-09
CVE ID: CVE-2020-10106 State: PUBLISHED Published: 2020-03-05T12:42:22 Last Updated: 2024-08-04T10:50:57.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt. Additional Analyst Notes: - CVE Program Container: References: - https://frostylabs.net/writeups/cve-2020-10106/
CVE ID: CVE-2020-10107 State: PUBLISHED Published: 2020-03-05T12:43:08 Last Updated: 2024-08-04T10:50:57.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php. Additional Analyst Notes: - CVE Program Container: References: - https://frostylabs.net/writeups/cve-2020-10107/
CVE ID: CVE-2020-10108 State: PUBLISHED Published: 2020-03-12T12:42:33 Last Updated: 2024-08-04T10:50:57.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/ - https://lists.fedoraproject.org/archives/list/package-announce
raproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/ - https://usn.ubuntu.com/4308-2/ - https://usn.ubuntu.com/4308-1/ - https://security.gentoo.org/glsa/202007-24 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://know.bishopfox.com/advisories - https://know.bishopfox.com/advisories/twisted-version-19.10.0 - https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html