Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-24356 State: PUBLISHED Published: 2020-10-02T14:16:23.809007Z Last Updated: 2024-09-17T01:46:28.741Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: Cloudflare Products: cloudflared Problem Types: Local Privilege Escalation Description: `cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` searches for configuration files which could be abused by a malicious entity to execute commands as a privileged user. Version 2020.8.1 fixes this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cloudfl
fixes this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cloudflared/security/advisories/GHSA-hgwp-4vp4-qmm2
CVE ID: CVE-2020-24359 State: PUBLISHED Published: 2020-08-20T16:20:20 Last Updated: 2024-08-04T15:12:08.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/vault-ssh-helper/releases - https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020
CVE ID: CVE-2020-24360 State: PUBLISHED Published: 2020-12-28T18:08:57 Last Updated: 2024-08-04T15:12:08.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. The affected Arista EOS versions are: 4.24.2.4F and below releases in the 4.24.x train; 4.23.4M and below releases in the 4.23.x train; 4.22.6M and below releases in the 4.22.x train. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/11999-security-advisory-59
CVE ID: CVE-2020-24361 State: PUBLISHED Published: 2020-08-16T03:31:59 Last Updated: 2024-08-04T15:12:08.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202007-63 - http://www.snmptt.org/changelog.shtml - https://lists.debian.org/debian-lts-announce/2020/10/msg00006.html
CVE ID: CVE-2020-24363 State: PUBLISHED Published: 2020-08-31T15:49:15.000Z Last Updated: 2025-10-21T23:35:37.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/us/support/download/tl-wa855re/#Firmware - http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/ - https://pastebin.com
a855re/#Firmware - http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/ - https://pastebin.com/VjHM4UiA
CVE ID: CVE-2020-24364 State: PUBLISHED Published: 2020-08-24T18:35:53 Last Updated: 2024-08-04T15:12:08.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite. Additional Analyst Notes: - CVE Program Container: References: - https://minetime.ai - https://github.com/theart42/cves/blob/master/cve-2020-24364/CVE-2020-24364.md
CVE ID: CVE-2020-24365 State: PUBLISHED Published: 2020-09-24T14:17:54 Last Updated: 2024-08-04T15:12:08.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed as the root user (uid 0). (Even if a login is required, most routers are left with default credentials.) Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/QTev1TjM - http://packetstormsecurity.com/files/160136/Gemtek-WVRTM-127ACN-01.01.02.141-Command-Inje
ttps://pastebin.com/QTev1TjM - http://packetstormsecurity.com/files/160136/Gemtek-WVRTM-127ACN-01.01.02.141-Command-Injection.html
CVE ID: CVE-2020-24366 State: PUBLISHED Published: 2020-11-16T14:56:09 Last Updated: 2024-08-04T15:12:08.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-24367 State: PUBLISHED Published: 2020-11-10T20:43:28 Last Updated: 2024-08-04T15:12:09.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that is later executed by a higher-privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://support.bluestacks.com/hc/en-us/articles/360051471652--Bluestacks-update-fixes-vulnerabilities
CVE ID: CVE-2020-24368 State: PUBLISHED Published: 2020-08-19T14:25:07 Last Updated: 2024-08-04T15:12:08.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Icinga/icingaweb2/blob/master/CHANGELOG.md - https://github.com/Icinga/icingaweb2/issues/4226 - https://icinga.com/2020/08/19/icinga-web-security-release-v2-6-4-v2-7-4-and-v2-8-2/
.com/Icinga/icingaweb2/issues/4226 - https://icinga.com/2020/08/19/icinga-web-security-release-v2-6-4-v2-7-4-and-v2-8-2/ - https://www.debian.org/security/2020/dsa-4747 - https://lists.debian.org/debian-lts-announce/2020/08/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00026.html - https://security.gentoo.org/glsa/202208-05
CVE ID: CVE-2020-24369 State: PUBLISHED Published: 2020-08-17T16:06:42 Last Updated: 2024-08-04T15:12:08.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://www.lua.org/bugs.html#5.4.0-12 - https://github.com/lua/lua/commit/ae5b5ba529753c7a653901ffc29b5ea24c3fdf3a
CVE ID: CVE-2020-24370 State: PUBLISHED Published: 2020-08-17T00:00:00 Last Updated: 2024-08-04T15:12:08.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). Additional Analyst Notes: - CVE Program Container: References: - http://lua-users.org/lists/lua-l/2020-07/msg00324.html - https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb17868ab7b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00019.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
CVE ID: CVE-2020-24371 State: PUBLISHED Published: 2020-08-17T16:06:14 Last Updated: 2024-08-04T15:12:08.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110 - https://www.lua.org/bugs.html#5.4.0-10
CVE ID: CVE-2020-24372 State: PUBLISHED Published: 2020-08-17T16:05:57.000Z Last Updated: 2025-11-03T18:07:57.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LuaJIT/LuaJIT/issues/603
CVE ID: CVE-2020-24373 State: PUBLISHED Published: 2020-09-16T20:00:17 Last Updated: 2024-08-04T15:12:08.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://dev.freebox.fr/blog/?p=10222 - https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/
CVE ID: CVE-2020-24374 State: PUBLISHED Published: 2020-09-16T20:00:13 Last Updated: 2024-08-04T15:12:08.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DNS rebinding vulnerability in Freebox v5 before 1.5.29. Additional Analyst Notes: - CVE Program Container: References: - https://dev.freebox.fr/blog/?p=10222 - https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/
CVE ID: CVE-2020-24375 State: PUBLISHED Published: 2020-10-19T18:08:03 Last Updated: 2024-08-04T15:12:08.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://dev.freebox.fr/blog/?p=10222 - https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/
CVE ID: CVE-2020-24376 State: PUBLISHED Published: 2020-09-16T20:00:25 Last Updated: 2024-08-04T15:12:08.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://dev.freebox.fr/blog/?p=10222 - https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/
CVE ID: CVE-2020-24377 State: PUBLISHED Published: 2020-09-16T20:00:29 Last Updated: 2024-08-04T15:12:08.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://dev.freebox.fr/blog/?p=10222 - https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/
CVE ID: CVE-2020-24379 State: PUBLISHED Published: 2020-09-09T18:10:23 Last Updated: 2024-08-04T15:12:08.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erlyaws/yaws/commits/master - https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.html - https://vuln.be/post/yaws-xxe-and-shell-injections/ - https://github.com/vulnbe/poc-yaws-dav-xxe - https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html - https://usn.ubuntu.com/4569-1/ - https://www.debian.org/se
/lists.debian.org/debian-lts-announce/2020/09/msg00022.html - https://usn.ubuntu.com/4569-1/ - https://www.debian.org/security/2020/dsa-4773
CVE ID: CVE-2020-24381 State: PUBLISHED Published: 2020-08-19T11:50:17 Last Updated: 2024-08-04T15:12:08.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default. Additional Analyst Notes: - CVE Program Container: References: - https://emaragkos.gr/cve-2020-24381/ - https://github.com/gunet/openeclass/issues/39
CVE ID: CVE-2020-24383 State: PUBLISHED Published: 2020-12-11T22:56:22 Last Updated: 2024-08-04T15:12:08.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check for proper '\0' termination of the resource record name string, leading to an out-of-bounds read, and potentially causing information leak or Denial-or-Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
CVE ID: CVE-2020-24384 State: PUBLISHED Published: 2020-11-10T13:46:34 Last Updated: 2024-08-04T15:12:08.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems. ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x are affected. aGalaxy versions 3.0.x, 3.2.x, and 5.0.x are affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.a10networks.com/support/security_advisory/acos-agalaxy-gui-rce-vulnerability-cve-2020-24384
CVE ID: CVE-2020-24385 State: PUBLISHED Published: 2020-09-03T14:35:36 Last Updated: 2024-08-04T15:12:08.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td->td_emuldata in sys/compat/linux/linux_emul.h is not getting initialized and returns NULL from em_find(). Additional Analyst Notes: - CVE Program Container: References: - https://www.midnightbsd.org/notes/ - http://www.midnightbsd.org/security/adv/MIDNIGHTBSD-SA-20:02.txt
CVE ID: CVE-2020-24386 State: PUBLISHED Published: 2021-01-04T16:25:43 Last Updated: 2024-08-04T15:12:08.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure). Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - http://www.openwall.com/lists/oss-security/2021/01/04/4 - https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html - https://doc.dovecot.org/configuration_manual/hibernation/ - https://www.debia
il/dovecot-news/2021-January/000450.html - https://doc.dovecot.org/configuration_manual/hibernation/ - https://www.debian.org/security/2021/dsa-4825 - http://seclists.org/fulldisclosure/2021/Jan/18 - http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html - https://security.gentoo.org/glsa/202101-01 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/
CVE ID: CVE-2020-24387 State: PUBLISHED Published: 2020-10-19T19:39:23 Last Updated: 2024-08-04T15:12:08.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yubico/yubihsm-shell - https://developers.yubico.com/yubihsm-shell/ - https://www.yubico.com/support/secur
://github.com/Yubico/yubihsm-shell - https://developers.yubico.com/yubihsm-shell/ - https://www.yubico.com/support/security-advisories/ysa-2020-06/ - https://blog.inhq.net/posts/yubico-libyubihsm-vuln/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y77KQJW76M3PFOBFLBT6DLH2NWHYRNZO/
CVE ID: CVE-2020-24388 State: PUBLISHED Published: 2020-10-19T19:41:33 Last Updated: 2024-08-04T15:12:08.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded length field of a message received from the device. This could lead to an oversized memcpy() call that will crash the running process. This could be used by an attacker to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yubico/yubihsm-shell - https://developers.yubico.com/yubihsm-shell/ - https://www.yubico.com/support/security-adv
ub.com/Yubico/yubihsm-shell - https://developers.yubico.com/yubihsm-shell/ - https://www.yubico.com/support/security-advisories/ysa-2020-06/ - https://blog.inhq.net/posts/yubico-libyubihsm-vuln/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y77KQJW76M3PFOBFLBT6DLH2NWHYRNZO/
CVE ID: CVE-2020-24390 State: PUBLISHED Published: 2020-08-27T15:24:25 Last Updated: 2024-08-04T15:12:08.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording. Additional Analyst Notes: - CVE Program Container: References: - https://www.eyesofnetwork.com/fr/news/fr-CVE-2020-24390 - https://github.com/EyesOfNetworkCommunity/eonweb/releases/tag/5.3-7 - https://github.com/EyesOfNetworkCommunity/eonweb/commit/c416b52d3b500d96ab40875f95b7c7939628854b
CVE ID: CVE-2020-24391 State: PUBLISHED Published: 2021-03-30T20:52:58 Last Updated: 2024-08-04T15:12:08.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a - https://github.com/mongodb-js/query-parser/issues/16
CVE ID: CVE-2020-24392 State: PUBLISHED Published: 2021-02-19T22:42:17 Last Updated: 2024-08-04T15:12:08.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/voloko/twitter-stream - https://securitylab.github.com/advisories/GHSL-2020-097-voloko-twitter-stream
CVE ID: CVE-2020-24393 State: PUBLISHED Published: 2021-02-19T22:44:56 Last Updated: 2024-08-04T15:12:08.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tweetstream/tweetstream - https://securitylab.github.com/advisories/GHSL-2020-096-tweetstream-tweetstream
CVE ID: CVE-2020-24394 State: PUBLISHED Published: 2020-08-19T00:00:00 Last Updated: 2024-08-04T15:12:08.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832 - https://cdn.kernel.org/pub/linux/kernel/v5.x
it/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8 - https://usn.ubuntu.com/4465-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html - https://usn.ubuntu.com/4483-1/ - https://usn.ubuntu.com/4485-1/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20200904-0003/ - https://www.starwindsoftware.com/security/sw-20210325-0004/
CVE ID: CVE-2020-24395 State: PUBLISHED Published: 2021-05-20T13:24:53 Last Updated: 2024-08-04T15:12:08.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt
CVE ID: CVE-2020-24396 State: PUBLISHED Published: 2021-05-20T13:20:51 Last Updated: 2024-08-04T15:12:08.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-027.txt - https://cwe.mitre.org/data/definitions/522.html
CVE ID: CVE-2020-24397 State: PUBLISHED Published: 2020-10-02T19:06:42 Last Updated: 2024-08-04T15:12:08.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/ - https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html
CVE ID: CVE-2020-24400 State: PUBLISHED Published: 2020-11-09T00:39:01.550481Z Last Updated: 2024-09-16T23:40:24.869Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Adobe Products: Magento Commerce Problem Types: CWE-89 Description: Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/magento/apsb20-59.html