Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
at have been signed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IdentityPython/pysaml2/commit/5e9d5acbcd8ae45c4e736ac521fd2df5b1c62e25 - https://github.com/IdentityPython/pysaml2/commit/f27c7e7a7010f83380566a219fd6a290a00f2b6e - https://github.com/IdentityPython/pysaml2/releases/tag/v5.0.0 - https://github.com/IdentityPython/pysaml2/releases - https://pypi.org/project/pysaml2/5.0.0/ - https://usn.ubuntu.com/4245-1/ - https://www.debian.org/security/2020/dsa-4630 - https://lists.debian.org/debian-lts-announce/2020/02/msg00025.html
CVE ID: CVE-2020-5391 State: PUBLISHED Published: 2020-04-01T12:50:26 Last Updated: 2024-08-04T08:30:23.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/wp-auth0/releases - https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0 - https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
CVE ID: CVE-2020-5392 State: PUBLISHED Published: 2020-04-01T12:48:37 Last Updated: 2024-08-04T08:30:24.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/wp-auth0/releases - https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0 - https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
CVE ID: CVE-2020-5393 State: PUBLISHED Published: 2020-01-07T15:27:29 Last Updated: 2024-08-04T08:30:24.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS. Additional Analyst Notes: - CVE Program Container: References: - https://docs.appspace.com/latest/release-notes/7-1-platform-release-notes/#Patch_Updates - https://sumukh30.blogspot.com/2020/01/cross-site-scripting-vulnerability-in.html
CVE ID: CVE-2020-5395 State: PUBLISHED Published: 2020-01-03T00:00:00 Last Updated: 2024-08-04T08:30:23.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fontforge/fontforge/issues/4084 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00041.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2S75EAVF4KPCH3WFBMZADUAU7EAXA7ZQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MH6PKVQLBKIO7LQPDXB3MKI5I6AMDCN6/
ts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MH6PKVQLBKIO7LQPDXB3MKI5I6AMDCN6/ - https://security.gentoo.org/glsa/202004-14 - https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html
CVE ID: CVE-2020-5396 State: PUBLISHED Published: 2020-07-31T19:40:19.558489Z Last Updated: 2024-09-16T16:23:21.490Z Vendors: VMware Tanzu Products: VMware Tanzu GemFire for VMs, VMware GemFire Problem Types: CWE-284 Description: VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2020-5396
CVE ID: CVE-2020-5397 State: PUBLISHED Published: 2020-01-17T18:50:12.742951Z Last Updated: 2024-09-17T01:45:35.621Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Spring Products: Spring Framework Problem Types: CWE-352 Description: Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers wh
ials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://pivotal.io/security/cve-2020-5397 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/s
com/security-alerts/cpuoct2020.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-5398 State: PUBLISHED Published: 2020-01-16T23:55:15.596268Z Last Updated: 2024-09-16T17:43:32.422Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Spring Products: Spring Framework Problem Types: CWE-79 Description: In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rf8dc72b974ee74f1
Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rf8dc72b974ee74f17bce661ea7d124e733a1f4c4f236354ac0cf48e8%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/rc05acaacad089613e9642f939b3a44f7199b5537493945c3e045287f%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/rdcaadaa9a68b31b7d093d76eacfaacf6c7a819f976b595c75ad2d4dc%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r7361bfe84bde9d233f9800c3a96673e7bd81207549ced0236f07a29d%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r9fb1ee08cf337d16c3364feb0f35a072438c1a956afd7b77859aa090%40%3Cissues.karaf.apache.org
ps://lists.apache.org/thread.html/r9fb1ee08cf337d16c3364feb0f35a072438c1a956afd7b77859aa090%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r8736185eb921022225a83e56d7285a217fd83f5524bd64a6ca3bf5cc%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r7d5e518088e2e778928b02bcd3be3b948b59acefe2f0ebb57ec2ebb0%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r3765353ff434fd00d8fa5a44734b3625a06eeb2a3fb468da7dfae134%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/rab0de39839b4c208d
b3625a06eeb2a3fb468da7dfae134%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/rab0de39839b4c208dcd73f01e12899dc453361935a816a784548e048%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r4b1886e82cc98ef38f582fef7d4ea722e3fcf46637cd4674926ba682%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/reaa8a6674baf2724b1b88a621b0d72d9f7a6f5577c88759842c16eb6%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r74f81f93a9b69140fe41e236afa7cbe8dfa75692e7ab31a468fddaa0%40%3Ccommits.karaf.apac
- https://lists.apache.org/thread.html/r74f81f93a9b69140fe41e236afa7cbe8dfa75692e7ab31a468fddaa0%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r2dfd5b331b46d3f90c4dd63a060e9f04300468293874bd7e41af7163%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r8cc37a60a5056351377ee5f1258f2a4fdd39822a257838ba6bcc1e88%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/rb4d1fc078f08
70a4510a584eb3efd1e32e8660ccf46676%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/rb4d1fc078f086ec2e98b2693e8b358e58a6a4ef903ceed93a1ee2b18%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r6dac0e365d1b2df9a7ffca12b4195181ec14ff0abdf59e1fdb088ce5%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r4639e821ef9ca6ca10887988f410a60261400a7766560e7a97a22efc%40%3Ccommits.karaf.apache.org%3E - https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad%40%3Cissues.karaf.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html
org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://pivotal.io/security/cve-2020-5398 - https://lists.apache.org/thread.html/r712a6fce928e24e7b6ec30994a7e115a70f1f6e4cf2c2fbf0347ce46%40%3Ccommits.servicecomb.apache.org%3E - https://lists.apache.org/thread.html/ra996b56e1f5ab2fed235a8b91fa0cc3cf34c2e9fee290b7fa4380a0d%40%3Ccommits.servicecomb.apache.org%3E - https://lists.apache.org/thread.html/r881fb5a95ab251106fed38f836257276feb026bfe01290e72ff91c2a%40%3Ccommits.servicecomb.apache.org%3E - https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%
://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%3E - https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3Cdev.ambari.apache.org%3E - https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3Cdev.ambari.apache.org%3E - https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3Cissues.ambari.apache.org%3E - htt
.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3Cissues.ambari.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/rc9c7f96f08c8554225dba9050ea5e64bebc129d0d836303143fe3160%40%3Cdev.rocketmq.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/rded5291e25a4c4085a6d43cf262e479140198bf4eabb84986e0a1ef3%40%3Cdev.rocketmq.apache.org%3E - https://lists.apache.org/thread.html/r645408661a8df9158f49e337072df39838fa76da629a7e25a20928a6%40%3Cdev.rocketmq.apache.org%3E - https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a
8a6%40%3Cdev.rocketmq.apache.org%3E - https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a0c5e7585a02d%40%3Cdev.rocketmq.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210917-0006/ - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-5399 State: PUBLISHED Published: 2020-02-12T20:30:17.255850Z Last Updated: 2024-09-16T19:51:26.662Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Cloud Foundry Products: CredHub Problem Types: CWE-319 Description: Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2020-5399
CVE ID: CVE-2020-5400 State: PUBLISHED Published: 2020-02-27T19:30:23.330488Z Last Updated: 2024-09-17T02:47:41.645Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Cloud Foundry Products: CAPI Problem Types: CWE-522 Description: Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2020-5400
CVE ID: CVE-2020-5401 State: PUBLISHED Published: 2020-02-27T19:30:23.717536Z Last Updated: 2024-09-16T17:38:11.499Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Cloud Foundry Products: Routing Problem Types: CWE-393 Description: Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2020-5401
CVE ID: CVE-2020-5402 State: PUBLISHED Published: 2020-02-27T19:30:24.167601Z Last Updated: 2024-09-16T17:03:33.297Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: UAA Problem Types: CWE-352 Description: In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2020-5402
CVE ID: CVE-2020-5403 State: PUBLISHED Published: 2020-03-03T18:25:14.205946Z Last Updated: 2024-09-17T00:00:46.313Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Pivotal Products: Reactor Netty Problem Types: CWE-20 Description: Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2020-5403
CVE ID: CVE-2020-5404 State: PUBLISHED Published: 2020-03-03T17:55:13.953515Z Last Updated: 2024-09-17T01:02:01.211Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: Pivotal Products: Reactor Netty Problem Types: CWE-522 Description: The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2020-5404
CVE ID: CVE-2020-5405 State: PUBLISHED Published: 2020-03-05T19:00:19.429999Z Last Updated: 2024-09-16T22:36:28.048Z Vendors: Spring by VMware Products: Spring Cloud Config Problem Types: CWE-23 Description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2020-5405
CVE ID: CVE-2020-5406 State: PUBLISHED Published: 2020-04-10T18:50:12.090459Z Last Updated: 2024-09-17T03:17:26.159Z Vendors: Pivotal Products: VMware Tanzu Application Service for VMs Problem Types: CWE-522 Description: VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.co
base being used by Autoscaling. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2020-5406
CVE ID: CVE-2020-5407 State: PUBLISHED Published: 2020-05-13T17:00:15.881645Z Last Updated: 2024-09-16T23:56:17.066Z Vendors: Spring by VMware Products: Spring Security Problem Types: CWE-347 Description: Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a52532
yst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://tanzu.vmware.com/security/cve-2020-5407 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-5408 State: PUBLISHED Published: 2020-05-14T17:15:13.256026Z Last Updated: 2024-09-17T01:01:47.960Z Vendors: Spring by VMware Products: Spring Security Problem Types: CWE-329 Description: Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.co
values using a dictionary attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuoct2020.html - https://tanzu.vmware.com/security/cve-2020-5408 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2020-5409 State: PUBLISHED Published: 2020-05-13T23:15:17.452592Z Last Updated: 2024-09-17T02:47:32.788Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: Pivotal Products: Concourse Problem Types: CWE-601 Description: Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.) Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.v
to, but distinct from, CVE-2018-15798.) Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2020-5409
CVE ID: CVE-2020-5410 State: PUBLISHED Published: 2020-06-02T16:50:12.055Z Last Updated: 2025-10-21T23:35:43.023Z Vendors: Spring by VMware Products: Spring Cloud Config Problem Types: CWE-23 Description: Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2020-5410
CVE ID: CVE-2020-5411 State: PUBLISHED Published: 2020-06-11T17:00:16.564695Z Last Updated: 2024-09-17T01:46:53.158Z Vendors: Spring by VMware Products: Spring Batch Problem Types: CWE-502 Description: When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A mali
e following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2020-5411
CVE ID: CVE-2020-5412 State: PUBLISHED Published: 2020-08-07T20:45:13.154243Z Last Updated: 2024-09-16T18:24:52.747Z Vendors: Spring by VMware Products: Spring Cloud Netflix Problem Types: CWE-441 Description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2020-5412
CVE ID: CVE-2020-5413 State: PUBLISHED Published: 2020-07-31T19:40:19.970815Z Last Updated: 2024-09-16T16:22:53.854Z Vendors: Spring by VMware Products: Spring Integration Problem Types: CWE-502 Description: Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration sho