Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10978 State: PUBLISHED Published: 2020-04-08T18:08:27 Last Updated: 2024-08-04T11:21:14.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10979 State: PUBLISHED Published: 2020-04-08T18:07:20 Last Updated: 2024-08-04T11:21:14.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10980 State: PUBLISHED Published: 2020-04-08T18:05:33 Last Updated: 2024-08-04T11:21:13.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10981 State: PUBLISHED Published: 2020-04-08T18:04:33 Last Updated: 2024-08-04T11:21:14.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/categories/releases/ - https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE ID: CVE-2020-10982 State: PUBLISHED Published: 2020-07-28T20:45:57 Last Updated: 2024-08-04T11:21:13.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2020-0033/
CVE ID: CVE-2020-10983 State: PUBLISHED Published: 2020-07-28T20:44:36 Last Updated: 2024-08-04T11:21:14.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2020-0034/
CVE ID: CVE-2020-10984 State: PUBLISHED Published: 2020-07-28T20:40:37 Last Updated: 2024-08-04T11:21:13.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gambio GX before 4.0.1.0 allows admin/admin.php CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2020-0031/
CVE ID: CVE-2020-10985 State: PUBLISHED Published: 2020-07-28T20:36:59 Last Updated: 2024-08-04T11:21:14.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2020-0035/
CVE ID: CVE-2020-10986 State: PUBLISHED Published: 2020-07-13T17:59:19 Last Updated: 2024-08-04T11:21:14.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/research/ - https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE ID: CVE-2020-10987 State: PUBLISHED Published: 2020-07-13T18:46:12.000Z Last Updated: 2025-10-21T23:35:40.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ise.io/research/ - https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE ID: CVE-2020-10988 State: PUBLISHED Published: 2020-07-13T18:01:55 Last Updated: 2024-08-04T11:21:14.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/research/ - https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE ID: CVE-2020-10989 State: PUBLISHED Published: 2020-07-13T18:04:36 Last Updated: 2024-08-04T11:21:14.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/research/ - https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE ID: CVE-2020-10990 State: PUBLISHED Published: 2020-03-26T23:42:28 Last Updated: 2024-08-04T11:21:14.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/mercury/issues/13 - https://github.com/Accenture/mercury/commit/f647a01347485d2afe3a0b735eab3d0121d61f46
CVE ID: CVE-2020-10991 State: PUBLISHED Published: 2020-03-26T23:42:13 Last Updated: 2024-08-04T11:21:14.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mulesoft/apikit/issues/547
CVE ID: CVE-2020-10992 State: PUBLISHED Published: 2020-03-26T23:42:02 Last Updated: 2024-08-04T11:21:14.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/azkaban/azkaban/issues/2478
CVE ID: CVE-2020-10993 State: PUBLISHED Published: 2020-03-26T23:41:53 Last Updated: 2024-08-04T11:21:14.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/osmandapp/Osmand/issues/8711
CVE ID: CVE-2020-10994 State: PUBLISHED Published: 2020-06-25T18:26:30 Last Updated: 2024-08-04T11:21:14.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/ - https://github.com/python-pillow/Pillow/commits/master/src/libImaging/ - https://github.com/python-pillow/Pillow/pull/4538 - https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html - https://github.com/python-pillow/Pillow/pull/4505 - https://lists.fedoraproject.org/archives/list/packa
tes/7.1.0.html - https://github.com/python-pillow/Pillow/pull/4505 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/ - https://usn.ubuntu.com/4430-1/ - https://usn.ubuntu.com/4430-2/
CVE ID: CVE-2020-10995 State: PUBLISHED Published: 2020-05-19T16:04:12 Last Updated: 2024-08-04T11:21:14.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains
name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.nxnsattack.com - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html - https://www.debian.org/security/2020/dsa-4691 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/ -
.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S/
CVE ID: CVE-2020-10996 State: PUBLISHED Published: 2020-04-27T12:45:01 Last Updated: 2024-08-04T11:21:14.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place of the random key expected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.percona.com/browse/PXC-3117 - https://www.percona.com/blog/2020/04/20/cve-2020-10996-percona-xtradb-cluster-sst-script-static-key/ - https://www.percona.com/doc/percona-xtradb-cluster/LATEST/release-notes/Percona-XtraDB-Cluster-5.7.28-31.41.2.html
CVE ID: CVE-2020-10997 State: PUBLISHED Published: 2020-04-27T12:38:25 Last Updated: 2024-08-04T11:21:14.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. Additional Analyst Notes: - CVE Program Container: References: - https://jira.percona.com/browse/PXB-2142 - https://www.percona.com/blog/2020/04/16/cve-2020-10997-percona-xtrabackup-information-disclosure-of-command-line-arguments/
CVE ID: CVE-2020-11000 State: PUBLISHED Published: 2020-04-08T16:30:15 Last Updated: 2024-08-04T11:21:14.526Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: luchua-bc Products: GreenBrowser Problem Types: CWE-939 Description: GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an attacker to circumvent the access control. This problem has been patched in version 1.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/luchua-bc/GreenBrows
in version 1.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/luchua-bc/GreenBrowser/security/advisories/GHSA-7x3j-7x5w-8g7w - https://github.com/luchua-bc/GreenBrowser/commit/5e257e0db4f2a08cf05f00756e5961ee873e481b
CVE ID: CVE-2020-11001 State: PUBLISHED Published: 2020-04-14T23:05:14 Last Updated: 2024-11-19T15:36:07.828Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: wagtail Products: wagtail Problem Types: CWE-80, CWE-79 Description: In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinar
igher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6
CVE ID: CVE-2020-11002 State: PUBLISHED Published: 2020-04-10T18:35:18 Last Updated: 2024-08-04T11:21:14.209Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: dropwizard Products: dropwizard Problem Types: CWE-74 Description: dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.1
bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dropwizard/dropwizard/security/advisories/GHSA-8jpx-m2wh-2v34 - https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf - https://github.com/dropwizard/dropwizard/pull/3208 - https://github.com/dropwizard/dropwizard/pull/3209 - https://docs.jboss.
://github.com/dropwizard/dropwizard/pull/3208 - https://github.com/dropwizard/dropwizard/pull/3209 - https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext - https://github.com/dropwizard/dropwizard/security/policy#reporting-a-vulnerability - https://github.com/dropwizard/dropwizard/commit/d5a512f7abf965275f2a6b913ac4fe778e424242
CVE ID: CVE-2020-11003 State: PUBLISHED Published: 2020-04-14T23:10:12 Last Updated: 2024-08-04T11:21:14.428Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: fraction Products: oasis Problem Types: CWE-352 Description: Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read/write to vulnerable applications. This has been patched in 2.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fraction/oasis/security/advisories/G
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fraction/oasis/security/advisories/GHSA-j438-45hc-vjhm
CVE ID: CVE-2020-11004 State: PUBLISHED Published: 2020-04-24T20:25:14 Last Updated: 2024-08-04T11:21:14.613Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Admidio Products: admidio Problem Types: CWE-89 Description: SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13. Additional Analyst Notes: - CVE Progr
mpacts the confidentiality of the system. This has been patched in version 3.3.13. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Admidio/admidio/security/advisories/GHSA-qh57-rcff-gx54 - https://github.com/Admidio/admidio/issues/908 - https://github.com/Admidio/admidio/commit/ea5d6f114b151ed11ec0ad7cb47bd729e77a874a
CVE ID: CVE-2020-11005 State: PUBLISHED Published: 2020-04-14T22:30:14 Last Updated: 2024-08-04T11:21:13.928Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SeppPenner Products: WindowsHello Problem Types: CWE-288 Description: The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows He
able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again. This has been patched in version 1.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6cw - https://github.com/SeppPenner/WindowsHello/issues/3
CVE ID: CVE-2020-11006 State: PUBLISHED Published: 2020-05-08T18:45:12 Last Updated: 2024-08-04T11:21:14.355Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: shopizer-ecommerce Products: shopizer Problem Types: XSS in Shopizer Description: In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed when information is fetched from backend. This has been patched in version 2.11.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a - https://github.com/shopizer-ecommerce/shopizer/security/advis
shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a - https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-8pc4-gvfw-634p
CVE ID: CVE-2020-11007 State: PUBLISHED Published: 2020-04-16T18:20:12 Last Updated: 2024-08-04T11:21:14.408Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: shopizer-ecommerce Products: shopizer Problem Types: CWE-20 Description: In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/security/advisories/
nalyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-w8rc-pgxq-x2cj - https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a
CVE ID: CVE-2020-11008 State: PUBLISHED Published: 2020-04-21T18:40:13 Last Updated: 2024-08-04T11:21:14.528Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: git Products: git Problem Types: CWE-20 Description: Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure sto
ne). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not
the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any h
tial helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7 - https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q - https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282 - https://security.gentoo.org/glsa/202004-13 - https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV5
ml - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/ - https://usn.ubuntu.com/4334-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html - https://support.apple.com/kb/HT211183 - http://seclists.org/fulldisclosure/2020/May/41
CVE ID: CVE-2020-11009 State: PUBLISHED Published: 2020-04-29T16:30:14 Last Updated: 2024-08-04T11:21:14.168Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: rundeck Products: rundeck Problem Types: CWE-200 Description: In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is