Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-36224 State: PUBLISHED Published: 2021-01-25T09:44:29 Last Updated: 2024-08-04T17:23:09.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://bugs.openldap.org/show_bug.cgi?id=9409 - https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 - https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c981
927176579d652f2fe60c90e9abbad4c65 - https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 - https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 - https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure
ps://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2020-36225 State: PUBLISHED Published: 2021-01-25T09:44:21 Last Updated: 2024-08-04T17:23:09.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 - https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 - https://git.openldap.org/openldap/openldap/-/com
g/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 - https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 - https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 - https://bugs.openldap.org/show_bug.cgi?id=9412 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/
rt.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2020-36226 State: PUBLISHED Published: 2021-01-25T09:44:13 Last Updated: 2024-08-04T17:23:09.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 - https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 - https://git.openldap.org/openld
//git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 - https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 - https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 - https://bugs.openldap.org/show_bug.cgi?id=9413 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldis
1 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2020-36227 State: PUBLISHED Published: 2021-01-25T09:43:37 Last Updated: 2024-08-04T17:23:09.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://bugs.openldap.org/show_bug.cgi?id=9428 - https://git.openldap.org/openldap/openldap/-/commit/9d0e8485f3113505743baabf1167e01e4558ccf5 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.o
3505743baabf1167e01e4558ccf5 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d69
.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2020-36228 State: PUBLISHED Published: 2021-01-25T09:44:05 Last Updated: 2024-08-04T17:23:09.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://bugs.openldap.org/show_bug.cgi?id=9427 - https://git.openldap.org/openldap/openldap/-/commit/91dccd25c347733b365adc74cb07d074512ed5ad - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https:
t/91dccd25c347733b365adc74cb07d074512ed5ad - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600
e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2020-36229 State: PUBLISHED Published: 2021-01-25T09:43:57 Last Updated: 2024-08-04T17:23:09.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://bugs.openldap.org/show_bug.cgi?id=9425 - https://git.openldap.org/openldap/openldap/-/commit/4bdfffd2889c0c5cdf58bebafbdc8fce4bb2bff0 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.d
fd2889c0c5cdf58bebafbdc8fce4bb2bff0 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e6
CVE ID: CVE-2020-36230 State: PUBLISHED Published: 2021-01-25T09:43:47 Last Updated: 2024-08-04T17:23:09.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 - https://bugs.openldap.org/show_bug.cgi?id=9423 - https://git.openldap.org/openldap/openldap/-/commit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - ht
ommit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793 - https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html - https://www.debian.org/security/2021/dsa-4845 - https://security.netapp.com/advisory/ntap-20210226-0002/ - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212531 - https://support.apple.com/kb/HT212530 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/64 - http://seclists.org/fulldisclosure/2021/May/65 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db
CVE ID: CVE-2020-36231 State: PUBLISHED Published: 2021-02-01T23:40:12.974592Z Last Updated: 2024-09-16T17:14:09.087Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72002
CVE ID: CVE-2020-36232 State: PUBLISHED Published: 2021-02-22T20:46:59.290734Z Last Updated: 2024-09-17T01:22:10.668Z Vendors: Atlassian Products: Atlassian Gadgets Problem Types: Security Misconfiguration Description: The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled. Additional Analyst Notes: - CVE Program Container: References: - http
g http request which could be attacker controlled. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72025
CVE ID: CVE-2020-36233 State: PUBLISHED Published: 2021-02-18T15:16:22.101146Z Last Updated: 2024-09-16T19:30:12.974Z Vendors: Atlassian Products: Bitbucket Server, Bitbucket Data Center Problem Types: Incorrect Permission Assignment for Critical Resource Description: The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BSERV-12753 - https://www.kb.cert.org/vuls/id/240785
CVE ID: CVE-2020-36234 State: PUBLISHED Published: 2021-02-15T00:00:15.314287Z Last Updated: 2024-09-16T16:18:31.237Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Scripting (XSS) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72059
CVE ID: CVE-2020-36235 State: PUBLISHED Published: 2021-02-14T23:45:12.759760Z Last Updated: 2024-09-16T16:24:07.752Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-71950
CVE ID: CVE-2020-36236 State: PUBLISHED Published: 2021-02-14T23:50:13.382882Z Last Updated: 2024-09-17T02:16:55.095Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Scripting (XSS) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-720
8.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72015
CVE ID: CVE-2020-36237 State: PUBLISHED Published: 2021-02-14T23:55:12.878225Z Last Updated: 2024-09-16T18:34:42.149Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72064
CVE ID: CVE-2020-36238 State: PUBLISHED Published: 2021-04-01T02:30:14.029329Z Last Updated: 2024-09-17T00:30:53.159Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-863 Description: The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72249
CVE ID: CVE-2020-36239 State: PUBLISHED Published: 2021-07-29T10:12:42.879604Z Last Updated: 2024-10-17T15:25:47.384Z Vendors: Atlassian Products: Jira Data Center, Jira Core Data Center, Jira Software Data Center, Jira Service Management Data Center Problem Types: CWE-862 Description: Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potential
.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Eh
cache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-8454 - https://jira.atlassian.com/browse/JRASERVER-72566 - https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html
CVE ID: CVE-2020-36240 State: PUBLISHED Published: 2021-03-01T16:23:08.996989Z Last Updated: 2024-09-17T01:22:12.649Z Vendors: Atlassian Products: Crowd Problem Types: Arbitrary File Read Description: The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5685
CVE ID: CVE-2020-36241 State: PUBLISHED Published: 2021-02-05T07:11:07 Last Updated: 2024-08-04T17:23:09.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gnome-autoar/-/issues/7 - https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/adb067e645732fdbe7103516e506d09eb6a54429 - https://lists.fedoraproject.org/a
itlab.gnome.org/GNOME/gnome-autoar/-/commit/adb067e645732fdbe7103516e506d09eb6a54429 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN5TVQ7OHZEGY6AGFLAZWCVCI53RYNHQ/ - https://security.gentoo.org/glsa/202105-10
CVE ID: CVE-2020-36242 State: PUBLISHED Published: 2021-02-07T19:50:57 Last Updated: 2024-08-04T17:23:09.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyca/cryptography/issues/5615 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/ - https://www.oracle.com/security-alerts/cpuapr2022.html - htt
doraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://github.com/pyca/cryptography/compare/3.3.1...3.3.2 - https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36243 State: PUBLISHED Published: 2021-02-07T19:59:50 Last Updated: 2024-08-04T17:23:09.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenticated attacker can send a POST request that executes arbitrary OS commands via shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection
/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592 - https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
CVE ID: CVE-2020-36244 State: PUBLISHED Published: 2021-02-10T00:00:00 Last Updated: 2024-08-04T17:23:09.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the DLT-Daemon (versions prior to 2.18.6). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GENIVI/dlt-daemon/issues/265 - https://github.com/GENIVI/dlt-daemon/compare/v2.18.5...v2.18.6 - https://us-cert.cisa.gov/ics/advisories/icsa-21-147-01 - https://lists.debian.org/debian-lts-announce/2022/12/msg00016.html
CVE ID: CVE-2020-36245 State: PUBLISHED Published: 2021-02-17T21:49:12 Last Updated: 2024-08-04T17:23:09.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GramAddict/bot/issues/134
CVE ID: CVE-2020-36246 State: PUBLISHED Published: 2021-02-19T04:55:11 Last Updated: 2024-08-04T17:23:09.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamAmaze/AmazeFileManager/releases/tag/v3.5.1 - https://compass-security.com/fileadmin/Research/Advisories/2020-18_CSNC-2020-030_Amaze_FileManager_Privilege_Escalation.txt