Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-9261 State: PUBLISHED Published: 2020-07-06T18:19:20 Last Updated: 2024-08-04T10:26:14.399Z Vendors: n/a Products: HUAWEI Mate 30 Problem Types: Type Confusion Description: HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a type confusion vulnerability. The system does not properly check and transform the type of certain variable, the attacker tricks the user into installing then running a crafted application, successful exploit could cause code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200701-05-smartphone-en
CVE ID: CVE-2020-9262 State: PUBLISHED Published: 2020-07-06T18:05:47 Last Updated: 2024-08-04T10:26:14.460Z Vendors: n/a Products: HUAWEI Mate 30 Problem Types: Use After Free Description: HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with high privilege, successful exploit could cause code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200701-06-smartphone-en
CVE ID: CVE-2020-9263 State: PUBLISHED Published: 2020-10-19T19:57:15 Last Updated: 2024-08-04T10:26:14.434Z Vendors: n/a Products: HUAWEI Mate 30;HUAWEI P30 Problem Types: Use After Free Description: HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with common privilege, successful exploit could cause code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-ad
execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200701-07-smartphone-en
CVE ID: CVE-2020-9264 State: PUBLISHED Published: 2020-02-18T14:56:52 Last Updated: 2024-08-04T10:26:14.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca7387-modules-review-december-2019 - https://blog.zoller.lu/p/tzo-11
ntainer: References: - https://support.eset.com/en/ca7387-modules-review-december-2019 - https://blog.zoller.lu/p/tzo-11-2020-eset-generic-malformed.html - http://seclists.org/fulldisclosure/2020/Feb/21
CVE ID: CVE-2020-9265 State: PUBLISHED Published: 2020-02-18T17:22:38 Last Updated: 2024-08-04T10:26:14.448Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/PHPMyChatPlus/blob/master/SQLi.md
CVE ID: CVE-2020-9266 State: PUBLISHED Published: 2020-02-18T17:22:30 Last Updated: 2024-08-04T10:26:15.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/SOPlanning/blob/master/AdminPasswordChangeCSRF.md
CVE ID: CVE-2020-9267 State: PUBLISHED Published: 2020-02-18T17:22:21 Last Updated: 2024-08-04T10:26:16.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/SOPlanning/blob/master/AddUserCSRF.md
CVE ID: CVE-2020-9268 State: PUBLISHED Published: 2020-02-18T17:22:13 Last Updated: 2024-08-04T10:26:14.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/SOPlanning/blob/master/SQLInjectionProjects.md
CVE ID: CVE-2020-9269 State: PUBLISHED Published: 2020-02-18T17:22:06 Last Updated: 2024-08-04T10:26:15.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/SOPlanning/blob/master/InjectionIcalShell.md
CVE ID: CVE-2020-9270 State: PUBLISHED Published: 2020-02-18T17:21:57 Last Updated: 2024-08-04T10:26:14.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/IceHRM/blob/master/ChangeUserPasswordCSRF.md
CVE ID: CVE-2020-9271 State: PUBLISHED Published: 2020-02-18T17:21:48 Last Updated: 2024-08-04T10:26:15.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/J3rryBl4nks/IceHRM/blob/master/AddNewUserCSRF.md
CVE ID: CVE-2020-9272 State: PUBLISHED Published: 2020-02-20T15:17:13 Last Updated: 2024-08-04T10:26:15.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES - https://github.com/proftpd/proftpd/issues/902 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html - https://security.gentoo.org/glsa/202003-35 - https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf
CVE ID: CVE-2020-9273 State: PUBLISHED Published: 2020-02-20T15:22:53 Last Updated: 2024-08-04T10:26:16.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES - https://github.com/proftpd/proftpd/issues/903 - https://lists.debian.org/debian-lts-announce/2020/02/msg00022.html - https://www.debian.org/security/2020/dsa-4635 - https://lists.fedoraproject.org/archives/lis
nce/2020/02/msg00022.html - https://www.debian.org/security/2020/dsa-4635 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHO3S5WPRRP7VGKIAHLYQVEYW5HRYIJN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCUPRYSJR7XOM3HQ6H5M4OGDU7OHCHBF/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00002.html - https://security.gentoo.org/glsa/202003-35 - https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf - http://www.openwall.com/lists/oss-security/2021/08/25/1 - http://www.openwall.com/lists/oss-security/2
/ssa-679335.pdf - http://www.openwall.com/lists/oss-security/2021/08/25/1 - http://www.openwall.com/lists/oss-security/2021/09/06/2
CVE ID: CVE-2020-9274 State: PUBLISHED Published: 2020-02-26T15:29:32 Last Updated: 2024-08-04T10:26:16.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa - https://ww
tainer: References: - https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa - https://www.pureftpd.org/project/pure-ftpd/news/ - https://lists.debian.org/debian-lts-announce/2020/02/msg00029.html - https://security.gentoo.org/glsa/202003-54 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5DBVHJCXWRSJPNJQCJQCKZF6ZDPZCKA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/ - https://usn.ubuntu.com/451
s/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/ - https://usn.ubuntu.com/4515-1/
CVE ID: CVE-2020-9275 State: PUBLISHED Published: 2020-04-20T22:39:33 Last Updated: 2024-08-04T10:26:15.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of administrative credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ - https://raelize.com/advisories/CVE-2020-9275_D-Link-DSL-2640B_Remote-Credentials-Exfiltration_v1.0.txt
CVE ID: CVE-2020-9276 State: PUBLISHED Published: 2020-04-20T22:40:08 Last Updated: 2024-08-04T10:26:16.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ - https://raelize.com/advisories/CVE-2020
ity-bulletin - https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ - https://raelize.com/advisories/CVE-2020-9276_D-Link-DSL-2640B_do_cgi-buffer-overflow_v1.0.txt
CVE ID: CVE-2020-9277 State: PUBLISHED Published: 2020-04-20T22:40:32 Last Updated: 2024-08-04T10:26:16.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks (e.g., modify the admin password) with no authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ - https://raelize.com/advisories/CVE-2020-9277_D-Link-DSL-2640B_CGI-Authentication-bypass_v1.0.txt
CVE ID: CVE-2020-9278 State: PUBLISHED Published: 2020-04-20T22:41:14 Last Updated: 2024-08-04T10:26:16.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ - https://raelize.com/advisories/CVE-2020-9278_D-Link-DSL-2640B_Unauthenticated-configuration-reset_v1.0.txt
CVE ID: CVE-2020-9279 State: PUBLISHED Published: 2020-04-20T22:41:28 Last Updated: 2024-08-04T10:26:15.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ - https://raelize.com/advisories/CVE-2020-9279_D-Link-DSL-2640B_Hard-coded-privileged-account_v1.0.txt
CVE ID: CVE-2020-9280 State: PUBLISHED Published: 2020-04-15T20:18:14 Last Updated: 2024-08-04T10:26:15.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/downl
r an upgrade to 4.x. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/cve-2020-9280
CVE ID: CVE-2020-9281 State: PUBLISHED Published: 2020-03-07T00:02:27 Last Updated: 2024-08-04T10:26:15.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax). Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452X
NECGZNO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/ckeditor/ckeditor4 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2020-9282 State: PUBLISHED Published: 2020-03-09T13:42:59 Last Updated: 2024-08-04T10:26:16.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting network responses on the 'Edit access' screen when sharing portfolios. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1863043 - https://mahara.org/interaction/forum/topic.php?id=8590
CVE ID: CVE-2020-9283 State: PUBLISHED Published: 2020-02-20T00:00:00 Last Updated: 2024-08-04T10:26:15.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY - http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html - https://lists.debian.org/debian-lts-announce/2020/10/msg0
ecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
CVE ID: CVE-2020-9285 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T18:06:06.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the motherboard that hosts the WiFi card on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tnpitsecurity.com/blog/gaining-root-on-sonos-speakers/
CVE ID: CVE-2020-9286 State: PUBLISHED Published: 2020-04-07T18:52:09 Last Updated: 2024-10-25T14:02:00.972Z Vendors: n/a Products: FortiADC Problem Types: Improper Access Control Description: An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-013
CVE ID: CVE-2020-9287 State: PUBLISHED Published: 2020-03-15T21:56:00 Last Updated: 2024-10-25T14:26:22.460Z Vendors: Fortinet Products: Fortinet FortiClient EMS Problem Types: Execute unauthorized code or commands Description: An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which FortiClientEMSOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-060
CVE ID: CVE-2020-9288 State: PUBLISHED Published: 2020-06-22T15:14:43 Last Updated: 2024-10-25T14:01:09.947Z Vendors: Fortinet Products: Fortinet FortiWLC Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius Profile. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-016
CVE ID: CVE-2020-9289 State: PUBLISHED Published: 2020-06-16T20:12:40 Last Updated: 2024-10-25T14:25:10.790Z Vendors: n/a Products: Fortinet FortiManager Problem Types: Information disclosure Description: Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-007
CVE ID: CVE-2020-9290 State: PUBLISHED Published: 2020-03-15T21:52:05 Last Updated: 2024-10-25T14:26:32.997Z Vendors: Fortinet Products: Fortinet FortiClient for Windows Problem Types: Execute unauthorized code or commands Description: An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/ps
ory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-060
CVE ID: CVE-2020-9291 State: PUBLISHED Published: 2020-06-01T18:39:42 Last Updated: 2024-10-25T14:01:40.548Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Fortinet Products: Fortinet FortiClient for Windows Problem Types: Improper Access Control, Privilege Escalation Description: An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-040
CVE ID: CVE-2020-9292 State: PUBLISHED Published: 2020-06-04T12:41:09 Last Updated: 2024-10-25T14:25:22.267Z Vendors: n/a Products: Fortinet FortiSIEMWindowsAgent Problem Types: Escalation of privilege Description: An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-021
CVE ID: CVE-2020-9294 State: PUBLISHED Published: 2020-04-27T16:20:22 Last Updated: 2024-08-04T10:26:16.032Z Vendors: Fortinet Products: FortiMail, FortiVoiceEnterprise Problem Types: Improper Access Control Description: An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-20-045
CVE ID: CVE-2020-9295 State: PUBLISHED Published: 2025-03-17T13:40:48.531Z Last Updated: 2025-03-17T17:57:18.843Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-358 Description: FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version 6.00137 and below may not immediately detect certain types of malformed or non-standard RAR archives, potentially containing malicious files. Based on the samples provided, FortiClient will detect the malicious files upon trying extraction by real-time scan
les. Based on the samples provided, FortiClient will detect the malicious files upon trying extraction by real-time scanning and FortiGate will detect the malicious archive if Virus Outbreak Prevention is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-037
CVE ID: CVE-2020-9296 State: PUBLISHED Published: 2020-06-16T13:19:56 Last Updated: 2024-08-04T10:26:16.063Z Vendors: n/a Products: Netflix Titus Problem Types: Server-Side Template Injection Description: Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code. Additional Analyst Notes: - CVE Program Container: References: - http