Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15333 State: PUBLISHED Published: 2020-06-26T15:04:22 Last Updated: 2024-08-04T13:15:20.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" requests. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15334 State: PUBLISHED Published: 2020-06-26T15:02:57 Last Updated: 2024-08-04T13:15:20.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15335 State: PUBLISHED Published: 2020-06-26T15:02:11 Last Updated: 2024-08-04T13:15:20.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html#xmpp-no-auth-cleartext
CVE ID: CVE-2020-15336 State: PUBLISHED Published: 2020-06-26T15:01:28 Last Updated: 2024-08-04T13:15:19.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html#xmpp-no-auth-cleartext
CVE ID: CVE-2020-15337 State: PUBLISHED Published: 2020-06-26T15:00:44 Last Updated: 2024-08-04T13:15:20.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15338 State: PUBLISHED Published: 2020-06-26T15:00:03 Last Updated: 2024-08-04T13:15:20.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15339 State: PUBLISHED Published: 2020-06-26T14:58:50 Last Updated: 2024-08-04T13:15:20.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15340 State: PUBLISHED Published: 2020-06-26T14:58:09 Last Updated: 2024-08-04T13:15:20.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15341 State: PUBLISHED Published: 2020-06-26T14:57:15 Last Updated: 2024-08-04T13:15:20.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15342 State: PUBLISHED Published: 2020-06-26T14:56:26 Last Updated: 2024-08-04T13:15:20.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15343 State: PUBLISHED Published: 2020-06-26T14:55:30 Last Updated: 2024-08-04T13:15:20.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15344 State: PUBLISHED Published: 2020-06-26T14:54:27 Last Updated: 2024-08-04T13:15:20.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15345 State: PUBLISHED Published: 2020-06-26T14:53:50 Last Updated: 2024-08-04T13:15:20.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15346 State: PUBLISHED Published: 2020-06-26T14:53:12 Last Updated: 2024-08-04T13:15:20.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15347 State: PUBLISHED Published: 2020-06-26T14:51:48 Last Updated: 2024-08-04T13:15:19.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15348 State: PUBLISHED Published: 2020-06-26T13:46:10 Last Updated: 2024-08-04T13:15:20.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code. Additional Analyst Notes: - CVE Program Container: References: - https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html - https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml
CVE ID: CVE-2020-15349 State: PUBLISHED Published: 2020-11-17T01:56:05 Last Updated: 2024-08-04T13:15:20.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process (copy, move, delete) as root and changing permissions. Additional Analyst Notes: - CVE Program Container: References: - https://binarynights.com/blog/posts/forklift-3-4-security-update.html - https://insinuator.net/2020/11/forklift-lpe/
CVE ID: CVE-2020-15350 State: PUBLISHED Published: 2020-07-07T16:37:39 Last Updated: 2024-08-04T13:15:20.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the required buffer capacity and validate against the provided buffer size. The base64_estimate_decode_size() function calculates the expected decoded size with an arithmetic round-off error and does not take into account possible padding bytes. Due to this underestimation, it may be possible to craft base64 input that causes a buffer overflow. Additional Analyst Notes: - CVE Pro
restimation, it may be possible to craft base64 input that causes a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1jMCAi8uawV1-an5uCghIxT2TEdxCE1Lk/view?usp=sharing - https://github.com/RIOT-OS/RIOT/pull/14400
CVE ID: CVE-2020-15351 State: PUBLISHED Published: 2020-06-26T18:35:26 Last Updated: 2024-08-04T13:15:20.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions granting any user modify permission (i.e., NT AUTHORITY\Authenticated Users:(OI)(CI)(M)) to the contents of the directory and its sub-folders. In addition, the program installs a service called IDriveService that runs as LocalSystem. Thus, any standard user can escalate privileges to NT AUTHORITY\SYSTEM by substituting the service's binary with a malicious one. Additional Analyst Notes: - CVE Program Contain
HORITY\SYSTEM by substituting the service's binary with a malicious one. Additional Analyst Notes: - CVE Program Container: References: - https://www.idrive.com/release-info#win - https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-004.md
CVE ID: CVE-2020-15352 State: PUBLISHED Published: 2020-10-27T04:10:54 Last Updated: 2024-08-04T13:15:20.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
CVE ID: CVE-2020-15354 State: REJECTED Published: 2020-06-29T16:18:21 Last Updated: 2020-06-29T16:18:21 Description: No description available.
CVE ID: CVE-2020-15355 State: REJECTED Published: 2020-06-29T16:19:41 Last Updated: 2020-06-29T16:19:41 Description: No description available.
CVE ID: CVE-2020-15356 State: REJECTED Published: 2020-06-29T16:20:08 Last Updated: 2020-06-29T16:20:08 Description: No description available.
CVE ID: CVE-2020-15357 State: PUBLISHED Published: 2020-12-11T15:22:13 Last Updated: 2024-08-04T13:15:20.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell metacharacter in the ping, traceroute, or route options. Additional Analyst Notes: - CVE Program Container: References: - https://starlabs.sg/advisories/ - https://www.askey.com.tw/incident_report_notifications.html - https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d
CVE ID: CVE-2020-15358 State: PUBLISHED Published: 2020-06-27T11:39:37 Last Updated: 2024-08-04T13:15:20.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. Additional Analyst Notes: - CVE Program Container: References: - https://www.sqlite.org/src/tktview?name=8f157e8010 - https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2 - https://www.sqlite.org/src/info/10fa79d00f8091e5 - https://security.gentoo.org/glsa/202007-26 - https://usn.ubuntu.com/4438-1/ - https://www.oracle.co
o/10fa79d00f8091e5 - https://security.gentoo.org/glsa/202007-26 - https://usn.ubuntu.com/4438-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200709-0001/ - http://seclists.org/fulldisclosure/2020/Nov/19 - http://seclists.org/fulldisclosure/2020/Nov/20 - http://seclists.org/fulldisclosure/2020/Nov/22 - http://seclists.org/fulldisclosure/2020/Dec/32 - https://www.oracle.com/security-alerts/cpujan2021.html - https://support.apple.com/kb/HT211843 - https://support.apple.com/kb/HT211850 - https://support.apple.com/kb/HT211844 - https://support.apple.com/kb/HT211847 - https://support.apple.com/kb/HT211931 - http://seclists.org/fulldisclosu
11844 - https://support.apple.com/kb/HT211847 - https://support.apple.com/kb/HT211931 - http://seclists.org/fulldisclosure/2021/Feb/14 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://support.apple.com/kb/HT212147 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-15360 State: PUBLISHED Published: 2020-06-27T12:07:25 Last Updated: 2024-08-04T13:15:20.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/docker-for-windows/release-notes/ - https://whitehatck01.blogspot.com/2020/06/dockers-latest-version-of-privilege.html
CVE ID: CVE-2020-15362 State: PUBLISHED Published: 2020-06-29T16:12:44 Last Updated: 2024-08-04T13:15:20.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thingsSDK/wifiscanner/issues/1
CVE ID: CVE-2020-15363 State: PUBLISHED Published: 2020-06-28T11:48:06 Last Updated: 2024-08-04T13:15:19.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://themeforest.net/item/nexos-real-estate-agency-directory/21126242 - https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-06-17-nexos-real-estate-wordpress-theme-v1-7.txt - http://packetstormsecurity.com/files/158510/WordPress-NexosReal-Estate-Theme-1.7-Cross-Site-Scripting-SQL-Injection.html
CVE ID: CVE-2020-15364 State: PUBLISHED Published: 2020-06-28T11:47:57 Last Updated: 2024-08-04T13:15:20.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://themeforest.net/item/nexos-real-estate-agency-directory/21126242 - https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-06-17-nexos-real-estate-wordpress-theme-v1-7.txt - http://packetstormsecurity.com/files/158510/WordPress-NexosReal-Estate-Theme-1.7-Cross-Site-Scripting-SQL-Injection.html
CVE ID: CVE-2020-15365 State: PUBLISHED Published: 2020-06-28T12:07:34 Last Updated: 2024-08-04T13:15:20.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/compare/0.20-Beta2...0.20-Beta3 - https://github.com/LibRaw/LibRaw/issues/301
CVE ID: CVE-2020-15366 State: PUBLISHED Published: 2020-07-15T19:14:07 Last Updated: 2024-08-04T13:15:20.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.) Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/bugs?subject=user&report_id=894259 - https://github.com/ajv-validator/ajv/tags - https://github.co
https://hackerone.com/bugs?subject=user&report_id=894259 - https://github.com/ajv-validator/ajv/tags - https://github.com/ajv-validator/ajv/releases/tag/v6.12.3 - https://security.netapp.com/advisory/ntap-20240621-0007/
CVE ID: CVE-2020-15367 State: PUBLISHED Published: 2020-07-07T14:00:15 Last Updated: 2024-08-04T13:15:20.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page. Additional Analyst Notes: - CVE Program Container: References: - https://www.venki.com.br/ - https://github.com/inflixim4be/CVE-2020-15367
CVE ID: CVE-2020-15368 State: PUBLISHED Published: 2020-06-29T00:00:00 Last Updated: 2024-08-04T13:15:20.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3. Additional Analyst Notes: - CVE Program Container: References: - https://codetector.org/post/asrock_rgb_driver/ - https://github.com/stong/CVE-2020-15368?tab=readme-ov-file
CVE ID: CVE-2020-15369 State: PUBLISHED Published: 2020-09-25T13:08:45 Last Updated: 2024-08-04T13:15:20.253Z Vendors: n/a Products: Brocade Fabric OS Problem Types: Unprotected Storage of Credentials Description: Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remote host. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1078
CVE ID: CVE-2020-15370 State: PUBLISHED Published: 2020-09-25T13:09:32 Last Updated: 2024-08-04T13:15:20.688Z Vendors: n/a Products: Brocade Fabric OS Problem Types: Unprotected Storage of Credentials Description: Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerability is due to incorrectly logging the user password in log files. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1079
CVE ID: CVE-2020-15371 State: PUBLISHED Published: 2020-09-25T13:10:23 Last Updated: 2024-08-04T13:15:19.963Z Vendors: n/a Products: Brocade Fabric OS Problem Types: privilege escalation Description: Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege escalation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1080
CVE ID: CVE-2020-15372 State: PUBLISHED Published: 2020-09-25T13:10:40 Last Updated: 2024-08-04T13:15:20.117Z Vendors: n/a Products: Brocade Fabric OS Problem Types: privilege escalation Description: A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local authenticated attacker to modify shell variables, which may lead to an escalation of privileges or bypassing the logging. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1081
CVE ID: CVE-2020-15373 State: PUBLISHED Published: 2020-09-25T13:10:49 Last Updated: 2024-08-04T13:15:20.185Z Vendors: n/a Products: Brocade Fabric OS Problem Types: Buffer overflow Description: Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote unauthenticated attackers to perform various attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1082
CVE ID: CVE-2020-15374 State: PUBLISHED Published: 2020-09-25T13:11:22 Last Updated: 2024-08-04T13:15:20.390Z Vendors: n/a Products: Brocade Fabric OS Problem Types: Reflected Input Description: Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1084
CVE ID: CVE-2020-15375 State: PUBLISHED Published: 2020-12-11T20:34:43 Last Updated: 2024-08-04T13:15:19.990Z Vendors: n/a Products: Brocade Fabric OS Problem Types: Privilege escalation Description: Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1083
CVE ID: CVE-2020-15376 State: PUBLISHED Published: 2020-12-11T20:34:24 Last Updated: 2024-08-04T13:15:20.652Z Vendors: n/a Products: Brocade Fabric OS Problem Types: ldap authentication Description: Brocade Fabric OS versions before v9.0.0 and after version v8.1.0, configured in Virtual Fabric mode contain a weakness in the ldap implementation that could allow a remote ldap user to login in the Brocade Fibre Channel SAN switch with "user" privileges if it is not associated with any groups. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1158