Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ersions < V5.4 HF2). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdf - https://www.us-cert.gov/ics/advisories/icsa-20-161-05 - https://us-cert.cisa.gov/ics/advisories/icsa-20-161-05
CVE ID: CVE-2020-7586 State: PUBLISHED Published: 2020-06-10T16:23:52 Last Updated: 2024-08-04T09:33:19.798Z Vendors: Siemens Products: SIMATIC PCS 7 V8.2 and earlier, SIMATIC PCS 7 V9.0, SIMATIC PDM, SIMATIC STEP 7 V5.X, SINAMICS STARTER (containing STEP 7 OEM version) Problem Types: CWE-122 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A buffer overflow vulnerability could allow a local attacker to cause a Denial-of-Service situation
ersions < V5.4 HF2). A buffer overflow vulnerability could allow a local attacker to cause a Denial-of-Service situation. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdf - https://www.us-cert.gov/ics/advisories/icsa-20-161-05 - https://us-cert.cisa.gov/ics/advisories/icsa-20-161-05
CVE ID: CVE-2020-7587 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.877Z Vendors: Siemens Products: Opcenter Execution Discrete, Opcenter Execution Foundation, Opcenter Execution Process, Opcenter Intelligence, Opcenter Quality, Opcenter RD&L, SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC Notifier Server for Windows, SIMATIC PCS neo, SIMATIC STEP 7 (TIA Portal) V15, SIMATIC STEP 7 (TIA Portal) V16, SIMOCODE ES V15.1, SIMOCODE ES V16, Soft Starter ES V15.1, Soft Starter ES V16 Problem Types: CWE-400 Description: A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2
been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Star
6 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending multiple specially crafted packets to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf
CVE ID: CVE-2020-7588 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.850Z Vendors: Siemens Products: Opcenter Execution Discrete, Opcenter Execution Foundation, Opcenter Execution Process, Opcenter Intelligence, Opcenter Quality, Opcenter RD&L, SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC Notifier Server for Windows, SIMATIC PCS neo, SIMATIC STEP 7 (TIA Portal) V15, SIMATIC STEP 7 (TIA Portal) V16, SIMOCODE ES V15.1, SIMOCODE ES V16, Soft Starter ES V15.1, Soft Starter ES V16 Problem Types: CWE-20 Description: A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2)
een identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Start
Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending a specially crafted packet to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf
CVE ID: CVE-2020-7589 State: PUBLISHED Published: 2020-06-10T16:24:57 Last Updated: 2024-08-04T09:33:19.722Z Vendors: Siemens Products: LOGO! 8 BM (incl. SIPLUS variants) Problem Types: CWE-306 Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 135/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the
d to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-817401.pdf - https://www.us-cert.gov/ics/advisories/icsa-20-161-03
CVE ID: CVE-2020-7590 State: PUBLISHED Published: 2020-10-13T15:30:19 Last Updated: 2024-08-04T09:33:19.941Z Vendors: Siemens Products: DCA Vantage Analyzer Problem Types: CWE-259 Description: A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-2020-15797). Affected devices use a hard-coded password to protect the onboard database. This could allow an attacker to read and or modify the onboard database. Successful exploitation requires direct physical access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.
ires direct physical access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.siemens-healthineers.com/support-documentation/security-advisory
CVE ID: CVE-2020-7591 State: PUBLISHED Published: 2020-10-15T18:45:35 Last Updated: 2024-08-04T09:33:19.580Z Vendors: Siemens Products: SIPORT MP Problem Types: CWE-603 Description: A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on behalf of those users if the single sign-on feature ("Allow logon without password") is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-384879.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-0
- https://cert-portal.siemens.com/productcert/pdf/ssa-384879.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-287-06
CVE ID: CVE-2020-7592 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.896Z Vendors: Siemens AG Products: SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants), SIMATIC HMI Comfort Panels (incl. SIPLUS variants), SIMATIC HMI KTP700F Mobile Arctic, SIMATIC HMI Mobile Panels 2nd Generation, SIMATIC WinCC Runtime Advanced Problem Types: CWE-319 Description: A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SI
s), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-364335.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-196-04
CVE ID: CVE-2020-7593 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.945Z Vendors: Siemens AG Products: LOGO! 8 BM (incl. SIPLUS variants) Problem Types: CWE-120 Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.02). A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacker could send a specially crafted HTTP request to cause a memory corruption, potentially resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: Refere
ry corruption, potentially resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-573753.pdf - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1069
CVE ID: CVE-2020-7594 State: PUBLISHED Published: 2020-01-21T21:05:48 Last Updated: 2024-08-04T09:33:19.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/multitech-authenticated-remote-code.html
CVE ID: CVE-2020-7595 State: PUBLISHED Published: 2020-01-21T22:54:14 Last Updated: 2024-08-04T09:33:19.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/ - https://usn.ubuntu.com/4274-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/ - https://lists.fedoraproject.org/archives/list/package-
sts.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200702-0005/ - https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076 - https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html - https://security.gentoo.org/glsa/202010-04 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf - https://us-
racle.com/security-alerts/cpuoct2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-7596 State: PUBLISHED Published: 2020-01-25T18:08:41 Last Updated: 2024-08-04T09:33:19.898Z Vendors: n/a Products: codecov npm module Problem Types: Command Injection Description: Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CODECOV-543183
CVE ID: CVE-2020-7597 State: PUBLISHED Published: 2020-02-17T18:48:40 Last Updated: 2024-08-04T09:33:19.906Z Vendors: n/a Products: codecov npm module Problem Types: Command Injection Description: codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/codecov/codecov-node/commit/02cf13d8b93ac547b5b4c2cfe186b7d874fd234f - https://snyk.io/vuln/SNYK-JS-CODECOV-548879
CVE ID: CVE-2020-7598 State: PUBLISHED Published: 2020-03-11T21:40:09 Last Updated: 2024-08-04T09:33:19.947Z Vendors: n/a Products: minimist Problem Types: Prototype Pollution Description: minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html
CVE ID: CVE-2020-7599 State: PUBLISHED Published: 2020-03-30T18:20:45 Last Updated: 2024-08-04T09:33:19.912Z Vendors: n/a Products: com.gradle.plugin-publish Problem Types: Insertion of Sensitive Information into Log File Description: All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with t
ystems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866 - https://blog.gradle.org/plugin-portal-update
CVE ID: CVE-2020-7600 State: PUBLISHED Published: 2020-03-12T22:25:43 Last Updated: 2024-08-04T09:33:19.998Z Vendors: n/a Products: querymen Problem Types: Prototype Pollution Description: querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef - https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867
CVE ID: CVE-2020-7601 State: PUBLISHED Published: 2020-03-15T21:23:11 Last Updated: 2024-08-04T09:33:19.986Z Vendors: n/a Products: gulp-scss-lint Problem Types: Command Injection Description: gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GULPSCSSLINT-560114
CVE ID: CVE-2020-7602 State: PUBLISHED Published: 2020-03-15T21:26:22 Last Updated: 2024-08-04T09:33:19.938Z Vendors: n/a Products: node-prompt-here Problem Types: Command Injection Description: node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is used to construct the argument of function "execSync()", which can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEPROMPTHERE-560115
CVE ID: CVE-2020-7603 State: PUBLISHED Published: 2020-03-15T21:48:52 Last Updated: 2024-08-04T09:33:20.013Z Vendors: n/a Products: closure-compiler-stream Problem Types: Command Injection Description: closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123
CVE ID: CVE-2020-7604 State: PUBLISHED Published: 2020-03-15T21:28:34 Last Updated: 2024-08-04T09:33:19.973Z Vendors: n/a Products: pulverizr Problem Types: Command Injection Description: pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PULVERIZR-560122
CVE ID: CVE-2020-7605 State: PUBLISHED Published: 2020-03-15T21:36:33 Last Updated: 2024-08-04T09:33:19.990Z Vendors: n/a Products: gulp-tape Problem Types: Command Injection Description: gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GULPTAPE-560124
CVE ID: CVE-2020-7606 State: PUBLISHED Published: 2020-03-15T21:31:11 Last Updated: 2024-08-04T09:33:19.966Z Vendors: n/a Products: docker-compose-remote-api Problem Types: Command Injection Description: docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125
CVE ID: CVE-2020-7607 State: PUBLISHED Published: 2020-03-15T21:40:50 Last Updated: 2024-08-04T09:33:20.004Z Vendors: n/a Products: gulp-styledocco Problem Types: Command Injection Description: gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GULPSTYLEDOCCO-560126
CVE ID: CVE-2020-7608 State: PUBLISHED Published: 2020-03-16T19:49:49 Last Updated: 2024-08-04T09:33:19.972Z Vendors: n/a Products: yargs-parser Problem Types: Prototype Pollution Description: yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
CVE ID: CVE-2020-7609 State: PUBLISHED Published: 2020-04-27T21:06:35 Last Updated: 2024-08-04T09:33:19.997Z Vendors: n/a Products: node-rules Problem Types: Command Injection Description: node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mithunsatheesh/node-rules/commit/100862223904bb6478fcc33b701c7dee11f7b832%2C - https://snyk.io/vuln/SNYK-JS-NODERULES-560426
CVE ID: CVE-2020-7610 State: PUBLISHED Published: 2020-03-30T18:28:17 Last Updated: 2024-08-04T09:33:19.956Z Vendors: n/a Products: bson Problem Types: Deserialization of Untrusted Data Description: All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BSON-561052
CVE ID: CVE-2020-7611 State: PUBLISHED Published: 2020-03-30T21:53:05 Last Updated: 2024-08-04T09:33:19.963Z Vendors: n/a Products: io.micronaut:micronaut-http-client Problem Types: HTTP Request Header Injection Description: All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342 - https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm - https://github.com/micronaut-projects/micronaut-c
naut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm - https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1
CVE ID: CVE-2020-7612 State: REJECTED Published: 2020-04-15T20:53:00 Last Updated: 2020-04-15T20:53:00 Description: No description available.
CVE ID: CVE-2020-7613 State: PUBLISHED Published: 2020-04-07T13:19:05 Last Updated: 2024-08-04T09:33:19.958Z Vendors: n/a Products: clamscan Problem Types: Command Injection Description: clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CLAMSCAN-564113 - https://github.com/kylefarris/clamsc
CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CLAMSCAN-564113 - https://github.com/kylefarris/clamscan/blob/master/index.js#L34