Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html - https://usn.ubuntu.com/4396-1/ - https://security.gentoo.org/glsa/202007-05
CVE ID: CVE-2020-13113 State: PUBLISHED Published: 2020-05-21T16:03:03 Last Updated: 2024-08-04T12:11:19.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f - https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html - https://usn.ubuntu.com/4396-1/ - https://security.gentoo.org/glsa/2
g/opensuse-security-announce/2020-06/msg00017.html - https://usn.ubuntu.com/4396-1/ - https://security.gentoo.org/glsa/202007-05
CVE ID: CVE-2020-13114 State: PUBLISHED Published: 2020-05-21T15:50:42 Last Updated: 2024-08-04T12:11:18.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab - https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html - https://usn.ubuntu.com/4396-1/ - https://se
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html - https://usn.ubuntu.com/4396-1/ - https://security.gentoo.org/glsa/202007-05
CVE ID: CVE-2020-13116 State: PUBLISHED Published: 2021-01-12T18:13:12 Last Updated: 2024-08-04T12:11:19.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation. Additional Analyst Notes: - CVE Program Container: References: - https://support.carbonite.com/evault/articles/Cross-site-scripting-vulnerability-in-Carbonite-Server-Backup-Portal-policies-functionality
CVE ID: CVE-2020-13117 State: PUBLISHED Published: 2021-02-09T18:53:18.000Z Last Updated: 2025-08-19T13:24:22.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.0xlabs.com/2021/02/wavlink-rce-CVE-2020-13117.html - https://github.com/ice-wzl/Wavlink-WN530G3A-Cmd-Injection/blob/main/README.md
CVE ID: CVE-2020-13118 State: PUBLISHED Published: 2020-05-16T19:11:23 Last Updated: 2024-08-04T12:11:19.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the parameter community. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adeoluwa-adebiyi/Mikrotik-Router-Monitoring-System/issues/4 - http://packetstormsecurity.com/files/157733/Mikrotik-Router-Monitoring-System-1.2.3-SQL-Injection.html
CVE ID: CVE-2020-13119 State: PUBLISHED Published: 2020-09-24T15:20:51 Last Updated: 2024-08-04T12:11:19.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: ismartgate PRO 1.5.9 is vulnerable to clickjacking. Additional Analyst Notes: - CVE Program Container: References: - https://ismartgate.com/secure-garage-door/ - https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf
CVE ID: CVE-2020-13121 State: PUBLISHED Published: 2020-05-16T19:39:33 Last Updated: 2024-08-04T12:11:18.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Submitty/Submitty/issues/5265
CVE ID: CVE-2020-13122 State: PUBLISHED Published: 2020-08-17T15:59:25 Last Updated: 2024-08-04T12:11:18.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: The novish command-line interface, included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices, is vulnerable to command injection in the "show status destination ipaddr" command. This could be used by a read-only user (monitoring group) or admin to execute commands on the operating system. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1iL4cc0ZbQK9s190DbFQD7mWYbBH-vlJb/view?usp=sharing
CVE ID: CVE-2020-13124 State: PUBLISHED Published: 2020-08-11T15:48:44 Last Updated: 2024-08-04T12:11:18.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://sabnzbd.org/downloads - https://github.com/sabnzbd/sabnzbd/commits/develop - https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-9x87-96gg-33w2
CVE ID: CVE-2020-13125 State: PUBLISHED Published: 2020-05-17T00:39:00 Last Updated: 2024-08-04T12:11:19.263Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10214 - https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-
ttps://wpvulndb.com/vulnerabilities/10214 - https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/
CVE ID: CVE-2020-13126 State: PUBLISHED Published: 2020-05-17T00:38:37 Last Updated: 2024-08-04T12:11:19.166Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10214 - https://www.wordfence.com/blog/2020/0
CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10214 - https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/
CVE ID: CVE-2020-13127 State: PUBLISHED Published: 2020-09-09T17:15:51 Last Updated: 2024-08-04T12:11:18.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary SQL commands via the TASKS_LIST__pt.querystring parameter. Additional Analyst Notes: - CVE Program Container: References: - https://manuals.loway.ch/QM_WhatsNew-chunked/ch17.html - https://blog.divisionzero.co/2020/05/18/cve-2020-13127/
CVE ID: CVE-2020-13128 State: PUBLISHED Published: 2020-05-17T23:04:55 Last Updated: 2024-08-04T12:11:19.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/manolo/gwtupload/issues/33 - https://logicaltrust.net/blog/2020/02/gwt-upload.html
CVE ID: CVE-2020-13129 State: PUBLISHED Published: 2020-05-18T04:42:22 Last Updated: 2024-08-04T12:11:19.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with client_key and device_id data in the query string, which allows attackers to obtain sensitive information by reading web-server logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.jvanlaak.de/stashcat.html - https://www.jvanlaak.de/stashcat_CWE_598_200517.pdf
CVE ID: CVE-2020-13131 State: PUBLISHED Published: 2020-07-09T17:50:36 Last Updated: 2024-08-04T12:11:18.860Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:P/A:N/C:H/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and
ap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token. Additional Analyst Notes: - CVE Program Container: References: - https://blog.inhq.net/posts/yubico-libykpiv-vuln/ - https://www.yubico.com/products/services-software/download/smart-card-drivers-tools/
CVE ID: CVE-2020-13132 State: PUBLISHED Published: 2020-07-09T17:51:56 Last Updated: 2024-08-04T12:11:19.035Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:P/A:H/C:N/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_generate_key() function in lib/util.c through incorrect error handling code. This could be used to cause a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://blog.inhq.net/posts/yubico-libykpiv-vuln/ - https://www.yubico.com/support/security-advisories/ysa-2020-02/
CVE ID: CVE-2020-13133 State: PUBLISHED Published: 2021-01-20T01:46:01 Last Updated: 2024-08-04T12:11:19.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1 Additional Analyst Notes: - CVE Program Container: References: - https://portal.tufin.com/aspx/SecurityAdvisories - https://github.com/Accenture/AARO-Bu
Program Container: References: - https://portal.tufin.com/aspx/SecurityAdvisories - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13134 State: PUBLISHED Published: 2021-01-20T01:45:57 Last Updated: 2024-08-04T12:11:18.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1. Additional Analyst Notes: - CVE Program Container: References: - https://portal.tufin.com/aspx/SecurityAdvisories - https://github.com/Accenture/AARO-Bugs/blob/m
ontainer: References: - https://portal.tufin.com/aspx/SecurityAdvisories - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-13135 State: PUBLISHED Published: 2020-05-18T16:05:48 Last Updated: 2024-08-04T12:11:19.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10172
CVE ID: CVE-2020-13136 State: PUBLISHED Published: 2020-05-18T16:05:37 Last Updated: 2024-08-04T12:11:18.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10172
CVE ID: CVE-2020-13143 State: PUBLISHED Published: 2020-05-18T17:50:53 Last Updated: 2024-08-04T12:11:19.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15753588bcd4bbffae1cca33c8ced5722477fe1f - https://www.spinics.net/lists/linux-usb/msg194331.html - https://security.netapp.com/a
cd4bbffae1cca33c8ced5722477fe1f - https://www.spinics.net/lists/linux-usb/msg194331.html - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - https://www.debian.org/security/2020/dsa-4699 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html - https://usn.ubuntu.com/4413-1/ - https://usn.ubuntu.com/4411-1/ - https://usn.ubuntu.com/4412
ce/2020-07/msg00008.html - https://usn.ubuntu.com/4413-1/ - https://usn.ubuntu.com/4411-1/ - https://usn.ubuntu.com/4412-1/ - https://usn.ubuntu.com/4419-1/ - https://usn.ubuntu.com/4414-1/ - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=d126cf46f829d146dde3e6a8963e095ac6cfcd1c
CVE ID: CVE-2020-13144 State: PUBLISHED Published: 2020-05-18T18:23:55 Last Updated: 2024-08-04T12:11:19.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://stark0de.com/2020/05/17/openedx-vulnerabilities.html - https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/architecture.html - http://p
dx-vulnerabilities.html - https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/architecture.html - http://packetstormsecurity.com/files/157785/OpenEDX-Ironwood-2.5-Remote-Code-Execution.html
CVE ID: CVE-2020-13145 State: PUBLISHED Published: 2020-05-18T18:24:25 Last Updated: 2024-08-04T12:11:19.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://stark0de.com/2020/05/17/openedx-vulnerabilities.html
CVE ID: CVE-2020-13146 State: PUBLISHED Published: 2020-05-18T18:24:10 Last Updated: 2024-08-04T12:11:19.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature. Additional Analyst Notes: - CVE Program Container: References: - https://stark0de.com/2020/05/17/openedx-vulnerabilities.html
CVE ID: CVE-2020-13149 State: PUBLISHED Published: 2020-05-18T19:39:23 Last Updated: 2024-08-04T12:11:19.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite system files and gain escalated privileges. One attack method is to change the Recommended App binary within App.json. Another attack method is to use this part of %PROGRAMDATA% for mounting an RPC Control directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rishaldwivedi/Public_Disclosure/blob
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rishaldwivedi/Public_Disclosure/blob/master/README.md#msi-dragon-center-eop
CVE ID: CVE-2020-13150 State: PUBLISHED Published: 2020-06-15T15:56:11 Last Updated: 2024-08-04T12:11:19.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules become active. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://gist.github.com/idris159/4c3ea746f4b19308b8ce8d8a7e313310
CVE ID: CVE-2020-13151 State: PUBLISHED Published: 2020-08-05T12:36:39 Last Updated: 2024-08-04T12:11:19.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service. Additional Analyst Notes: - CVE Program Container: References: - https://www.aerospike.co
running the Aerospike service. Additional Analyst Notes: - CVE Program Container: References: - https://www.aerospike.com/docs/operations/configure/security/access-control/index.html#create-users-and-assign-roles - https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html - https://www.aerospike.com/download/server/notes.html#5.1.0.3 - https://www.aerospike.com/enterprise/download/server/notes.html#5.1.0.3 - http://packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-Command-Execution.html - http://packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-Execution.html
CVE ID: CVE-2020-13152 State: PUBLISHED Published: 2020-05-20T12:32:21 Last Updated: 2024-08-04T12:11:19.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste resources over time, eventually allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://r00texpl0it.wordpress.com/2020/05/20/kde-amarok-2-8-0-allows-remote-attackers-to-cause-a-denial-of-service/ - http://packetstormsecurity.com/files/159898/Amarok-2.8.0-Denial-Of-Service.html
CVE ID: CVE-2020-13153 State: PUBLISHED Published: 2020-05-18T21:11:34 Last Updated: 2024-08-04T12:11:19.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/2989aa05225aa9b3a592ca50cbf8350ef256909c - https://github.com/MISP/MISP/compare/v2.4.125...v2.4.126
CVE ID: CVE-2020-13154 State: PUBLISHED Published: 2020-05-18T21:38:13 Last Updated: 2024-08-04T12:11:19.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/on-premises/readme.html - https://gitlab.com/eLeN3Re/CVE-2020-13154
CVE ID: CVE-2020-13155 State: PUBLISHED Published: 2020-06-23T19:15:11 Last Updated: 2024-08-04T12:11:19.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI. Additional Analyst Notes: - CVE Program Container: References: - https://nukeviet.vn/en/ - https://www.exploit-db.com/exploits/48489
CVE ID: CVE-2020-13156 State: PUBLISHED Published: 2020-06-23T19:14:04 Last Updated: 2024-08-04T12:11:19.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI. Additional Analyst Notes: - CVE Program Container: References: - https://nukeviet.vn/en/ - https://www.exploit-db.com/exploits/48489
CVE ID: CVE-2020-13157 State: PUBLISHED Published: 2020-06-23T19:11:54 Last Updated: 2024-08-04T12:11:19.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed. Additional Analyst Notes: - CVE Program Container: References: - https://nukeviet.vn/en/ - https://www.exploit-db.com/exploits/48489
CVE ID: CVE-2020-13158 State: PUBLISHED Published: 2020-06-22T17:43:12 Last Updated: 2024-08-04T12:11:19.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/InfoSec4Fun/CVE-2020-13158
CVE ID: CVE-2020-13159 State: PUBLISHED Published: 2020-06-22T17:39:12 Last Updated: 2024-08-04T12:11:19.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. NOTE: this may overlap CVE-2020-10818. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/artica-squid/files/ - https://github.com/InfoSec4Fun/CVE-2020-13159