Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13915 State: PUBLISHED Published: 2020-07-28T14:46:12 Last Updated: 2024-08-04T12:32:14.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credentials via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.ruckuswireless.com/security_bulletins/304
CVE ID: CVE-2020-13916 State: PUBLISHED Published: 2020-07-28T14:46:16 Last Updated: 2024-08-04T12:32:14.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack buffer overflow in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute code via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.ruckuswireless.com/security_bulletins/304
CVE ID: CVE-2020-13917 State: PUBLISHED Published: 2020-07-28T14:46:21 Last Updated: 2024-08-04T12:32:14.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a crafted CLI command. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.ruckuswireless.com/security_bulletins/304
CVE ID: CVE-2020-13918 State: PUBLISHED Published: 2020-07-28T14:46:26 Last Updated: 2024-08-04T12:32:14.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to leak system information (that can be used for a jailbreak) via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.ruckuswireless.com/security_bulletins/304
CVE ID: CVE-2020-13919 State: PUBLISHED Published: 2020-07-28T14:46:30 Last Updated: 2024-08-04T12:32:14.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.ruckuswireless.com/security_bulletins/304
CVE ID: CVE-2020-13920 State: PUBLISHED Published: 2020-09-10T00:00:00 Last Updated: 2024-08-04T12:32:14.288Z Vendors: n/a Products: Apache ActiveMQ Problem Types: Man In The Middle attack vulnerability Description: Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12. Addition
the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12. Additional Analyst Notes: - CVE Program Container: References: - http://activemq.apache.org/security-advisories.data/CVE-2020-13920-announcement.txt - https://lists.debian.org/debian-lts-announce/2020/10/msg00013.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E - https://lists.debian.org/debian-lts-announce/
0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E - https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
CVE ID: CVE-2020-13921 State: PUBLISHED Published: 2020-08-05T13:25:14 Last Updated: 2024-08-04T12:32:14.435Z Vendors: n/a Products: Apache SkyWalking Problem Types: SQL Injection Description: **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apache/skywalking/pull/4970 - http://www.openwall.com/lists/oss-security/2020/08/05/3 - https://lists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6%40%3Cdev.skywalking.apache.org%3E
CVE ID: CVE-2020-13922 State: PUBLISHED Published: 2021-01-11T09:40:19.000Z Last Updated: 2025-02-13T16:27:28.158Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-264 Description: Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/announce%40apache.org/msg06076.html
CVE ID: CVE-2020-13923 State: PUBLISHED Published: 2020-07-15T15:38:13 Last Updated: 2024-08-04T12:32:14.324Z Vendors: n/a Products: Apache OFBiz Problem Types: IDOR Vulnerability Description: IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04 Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/chokl - https://lists.apache.org/thread.html/r2e669797c1ea08562253239d2dc4192d951945e0c36cb0754f5394a6%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rac7e36c3daa60dd4b813f72942921b4fad71da821480ebcea96ecea1%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r0a0a70
2942921b4fad71da821480ebcea96ecea1%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E
CVE ID: CVE-2020-13924 State: PUBLISHED Published: 2021-03-17T09:05:19.000Z Last Updated: 2025-02-13T16:27:28.694Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: directory traversal Description: In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2BGH1A%40mail.gmail.com%3E
CVE ID: CVE-2020-13925 State: PUBLISHED Published: 2020-07-14T12:47:46 Last Updated: 2024-08-04T12:32:14.207Z Vendors: n/a Products: Apache Kylin Problem Types: Command Injection Description: Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3
am Container: References: - https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
CVE ID: CVE-2020-13926 State: PUBLISHED Published: 2020-07-14T12:50:48 Last Updated: 2024-08-04T12:32:14.237Z Vendors: n/a Products: Apache Kylin Problem Types: SQL Injection Description: Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r63d5663169e866d44ff9250796193337cff7d9cf61cc3839e86163fd%40%3Cuser.kylin.apache.org%3E
s://lists.apache.org/thread.html/r63d5663169e866d44ff9250796193337cff7d9cf61cc3839e86163fd%40%3Cuser.kylin.apache.org%3E - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
CVE ID: CVE-2020-13927 State: PUBLISHED Published: 2020-11-10T00:00:00.000Z Last Updated: 2025-10-21T23:35:32.975Z Vendors: n/a Products: Apache Airflow Problem Types: Information Disclosure Description: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend
for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html - http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
CVE ID: CVE-2020-13928 State: PUBLISHED Published: 2020-09-16T17:38:38 Last Updated: 2024-08-04T12:32:14.230Z Vendors: n/a Products: Apache Atlas Problem Types: Apache Atlas Multiple XSS Vulnerability Description: Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra468036f913be41b0c8fea74f91d53e273b0bfa838a4b140a5dcd463%40%3Cuser.atlas.apache.org%3E
CVE ID: CVE-2020-13929 State: PUBLISHED Published: 2021-09-02T00:00:00 Last Updated: 2024-08-04T12:32:14.441Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: authentication bypass Description: Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E - https://lists.apache.org/thread.html/r768800925d6407a6a
776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E - https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/09/02/2 - https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r99529e175a7c1c9a26bd41a02802c8af7aa97319fe561874627eb999%40%3Cusers.zeppelin.apache.org%3E - https://security.gentoo.org/glsa/202311-04
CVE ID: CVE-2020-13931 State: PUBLISHED Published: 2020-12-17T23:42:39 Last Updated: 2024-08-04T12:32:14.285Z Vendors: n/a Products: Apache TomEE Problem Types: Undesired port open with unauthenticated access Description: If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org
did not cover this edge case. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ref088c4732e1a8dd0bbbb96e13ffafcfe65f984238ffa55f438d78fe%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/r7f98907165b355dc65f28a57f15103a06173ce03261115fa46d569b4%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/r85b87478f8aa4751aa3a06e88622e80ffabae376ee7283e147ee56b9%40%3Cdev.tomee.apache.org%3E
CVE ID: CVE-2020-13932 State: PUBLISHED Published: 2020-07-20T21:08:34 Last Updated: 2024-08-04T12:32:14.247Z Vendors: n/a Products: Apache ActiveMQ Artemis Problem Types: Remote XSS in Web console Diagram Plugin Description: In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section. Additional Analyst Notes: - CVE Program Container: References: - https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt - https://l
ontainer: References: - https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt - https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb%40%3Cusers.activemq.apache.org%3E - https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
CVE ID: CVE-2020-13933 State: PUBLISHED Published: 2020-08-17T20:19:53 Last Updated: 2024-08-04T12:32:14.332Z Vendors: n/a Products: Apache Shiro Problem Types: Information Disclosure Description: Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f0041068936912876856835f%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r18b45d560d76c4260813c802771cc9678aa651fb8340e09366bfa198%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r9ea6d8560d6354d41433ad00606
aa651fb8340e09366bfa198%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r9ea6d8560d6354d41433ad006069904f0ed083527aa348b5999261a7%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r6ea0224c1971a91dc6ade1f22508119a9c3bd56cef656f0c44bbfabb%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r4c1e1249e9e1acb868db0c80728c13f448d07333da06a0f1603c0a33%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r8097b81905f2a113ebdf925bcbc6d8c9d6863c807c9ee42e1e7c9293%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/rb5edf49cd1451475dbcf53826ba6ef1bb7872dd6493d6112eb0c2bad%40%3Cdev.shiro.apache.org%3E - https://lists.a
org/thread.html/rb5edf49cd1451475dbcf53826ba6ef1bb7872dd6493d6112eb0c2bad%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r4506cedc401d6b8de83787f8436aac83956e411d66848c84785db46d%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r70098e336d02047ce4d4e69293fe8d558cd68cde06f6430398959bc4%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/rb47d88af224e396ee34ffb88ee99fb6d04510de5722cf14b7137e6bc%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r575301804bfac87a064359cf4b4ae9d514f2d10db7d44120765f4129%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r70b907ccb306e9391145e2b10f56cc6914a245f91720a17a486c0
%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r70b907ccb306e9391145e2b10f56cc6914a245f91720a17a486c020a%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/re25b8317b00a50272a7252c4552cf1a81a97984cc2111ef7728e48e0%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r852971e28f54cafa7d325bd7033115c67d613b112a2a1076817390ac%40%3Cdev.shiro.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/08/msg00002.html
CVE ID: CVE-2020-13934 State: PUBLISHED Published: 2020-07-14T14:59:11 Last Updated: 2024-08-04T12:32:14.414Z Vendors: n/a Products: Apache Tomcat Problem Types: Denial of Service Description: An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E - https://www.debian
d.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E - https://www.debian.org/security/2020/dsa-4727 - https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html - https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200724-0003/ - https://usn.ubuntu.com/4596-1/ - https://www.oracle.com/security-alerts/cpujan2021.h
.com/advisory/ntap-20200724-0003/ - https://usn.ubuntu.com/4596-1/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2020-13935 State: PUBLISHED Published: 2020-07-14T15:00:21 Last Updated: 2024-08-04T12:32:14.307Z Vendors: n/a Products: Apache Tomcat Problem Types: Denial of Service Description: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E - http
ache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E - https://www.debian.org/security/2020/dsa-4727 - https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html - https://usn.ubuntu.com/4448-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200724-0003/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10332 - https://usn.ubuntu.com/4596-1/ - https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40
ontent&id=SB10332 - https://usn.ubuntu.com/4596-1/ - https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-13936 State: PUBLISHED Published: 2021-03-10T08:00:19.000Z Last Updated: 2025-02-13T16:27:29.361Z Vendors: Apache Software Foundation Products: Apache Velocity Engine Problem Types: Velocity Sandbox Bypass Description: An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64
Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E - https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E - https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/03/10/1 - https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752
4dcf777728d02068ae6%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html - https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc32
be6c862c7%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E - https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E - https://lists.apache.org/thread.html/r4c