Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5257 State: PUBLISHED Published: 2020-03-13T21:05:15 Last Updated: 2024-08-04T08:22:09.077Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: thoughtbot Products: administrate Problem Types: CWE-943 Description: In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect
lst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thoughtbot/administrate/security/advisories/GHSA-2p5p-m353-833w - https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3
CVE ID: CVE-2020-5258 State: PUBLISHED Published: 2020-03-10T17:50:20 Last Updated: 2024-08-04T08:22:09.130Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: dojo Products: dojo Problem Types: CWE-94 Description: In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.
prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2 Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2 - https://github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d - https://lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a806554d00%40%3Cusers.qpid.apache.org%3E - https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b%40%3
qpid.apache.org%3E - https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b%40%3Cusers.qpid.apache.org%3E - https://lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6df326fd3%40%3Cusers.qpid.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-5259 State: PUBLISHED Published: 2020-03-10T17:50:14 Last Updated: 2024-08-04T08:22:09.035Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: dojo Products: dojox Problem Types: CWE-94 Description: In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.
prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw - https://github.com/dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da - https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html
CVE ID: CVE-2020-5260 State: PUBLISHED Published: 2020-04-14T22:50:12 Last Updated: 2024-08-04T08:22:09.095Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: git Products: git Problem Types: CWE-20 Description: Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper
n encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically
lone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1. Additional Analyst Notes: - CVE Program Container: References: -
2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q - https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b - https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/ - https://www.debian.org/security/2020/dsa-4657 - https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html - http://www.openwall.com/lists/oss-security/2020/04/15/5 - http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html - http://www.openwall.com/lists/oss-security/2020/04/15/6 - http://lists.opensuse.org/o
-Protocol-Newline-Injection.html - http://www.openwall.com/lists/oss-security/2020/04/15/6 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html - https://support.apple.com/kb/HT211141 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/ - http://www.openwall.com/lists/oss-security/2020/04/20/1 - https://security.gentoo.org/glsa/202004-13 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABE
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/ - https://usn.ubuntu.com/4329-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
CVE ID: CVE-2020-5261 State: PUBLISHED Published: 2020-03-25T01:15:15 Last Updated: 2024-08-04T08:22:09.101Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Sustainsys Products: Saml2 Problem Types: CWE-294 Description: Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NE
not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv - https://github.com/Sustainsys/Saml2/commit/
ttps://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv - https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 - https://github.com/Sustainsys/Saml2/issues/711
CVE ID: CVE-2020-5262 State: PUBLISHED Published: 2020-03-19T17:05:16 Last Updated: 2024-08-04T08:22:09.105Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: easybuilders Products: easybuild-framework Problem Types: CWE-532 Description: In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/easybuil
uild-framework` repository. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/easybuilders/easybuild-framework/security/advisories/GHSA-2wx6-wc87-rmjm - https://github.com/easybuilders/easybuild-framework/pull/3248 - https://github.com/easybuilders/easybuild-framework/pull/3249
CVE ID: CVE-2020-5263 State: PUBLISHED Published: 2020-04-09T15:50:12 Last Updated: 2024-08-04T08:22:09.088Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: auth0 Products: auth0.js Problem Types: CWE-522 Description: auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3 Additional Analyst No
ged without modification, the application risks password exposure. This is fixed in version 9.12.3 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp - https://github.com/auth0/auth0.js/commit/355ca749b229fb93142f0b3978399b248d710828
CVE ID: CVE-2020-5264 State: PUBLISHED Published: 2020-04-20T16:40:19 Last Updated: 2024-08-04T08:22:09.088Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-48vj-vvr6-jj4f - https://github.com/PrestaShop/PrestaShop/commit/06b7765c91c58e09ab4f8ddafbde02070fcb6f3a
CVE ID: CVE-2020-5265 State: PUBLISHED Published: 2020-04-20T16:40:13 Last Updated: 2024-08-04T08:22:09.139Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page. The problem is patched in 1.7.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7fmr-5vcc-329j - https://github.com/PrestaShop/PrestaShop/commit/622ba66ffdbf48b399875003e00bc34d8a3ef712
CVE ID: CVE-2020-5266 State: PUBLISHED Published: 2020-04-16T21:15:21 Last Updated: 2024-08-04T08:22:09.107Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: ps_linklist Problem Types: CWE-79 Description: In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/ps_linklist/security/advisories/GHSA-vr7g-vqp5-966j - https://github.com/PrestaShop/ps_linklist/commit/b90005c2cfed949ab564228b277a728e0a62a876
CVE ID: CVE-2020-5267 State: PUBLISHED Published: 2020-03-19T17:30:16 Last Updated: 2024-08-04T08:22:09.079Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: rails Products: actionview Problem Types: CWE-80 Description: In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv - https://github.com/rails/rails
r: References: - https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv - https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a - http://www.openwall.com/lists/oss-security/2020/03/19/1 - https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
CVE ID: CVE-2020-5268 State: PUBLISHED Published: 2020-04-21T15:30:37 Last Updated: 2024-08-04T08:22:09.027Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: Sustainsys Products: Saml2 Problem Types: CWE-303 Description: In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private
tocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 -
E Program Container: References: - https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 - https://github.com/Sustainsys/Saml2/security/advisories/GHSA-9475-xg6m-j7pw - https://github.com/Sustainsys/Saml2/issues/712 - https://www.nuget.org/packages/Sustainsys.Saml2/
CVE ID: CVE-2020-5269 State: PUBLISHED Published: 2020-04-20T16:45:20 Last Updated: 2024-08-04T08:22:09.082Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminFeatures page by using the `id_feature` parameter. The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-87jh-7xpg-6v93 - https://github.com/PrestaShop/PrestaShop/commit/9efca621a0b74b82dafa91e6b955120036e31334
CVE ID: CVE-2020-5270 State: PUBLISHED Published: 2020-04-20T16:45:15 Last Updated: 2024-08-04T08:22:09.085Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-601 Description: In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The
though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-375w-q56h-h7qc - https://github.com/PrestaShop/PrestaShop/commit/cd2219dca49965ae8421bb5a53fc301f3f23c458
CVE ID: CVE-2020-5271 State: PUBLISHED Published: 2020-04-20T16:50:39 Last Updated: 2024-08-04T08:22:09.101Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m2x6-c2c6-pjrx - https://github.com/PrestaShop/PrestaShop/commit/c464518d2aaf195007a1eb055fce64a9a027e00a
CVE ID: CVE-2020-5272 State: PUBLISHED Published: 2020-04-20T16:50:34 Last Updated: 2024-08-04T08:22:09.094Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters. The problem is patched in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rpg3-f23r-jmqv - https://github.com/PrestaShop/PrestaShop/commit/d3bf027fa37e8105fed3c809d636ebe787e43f46
CVE ID: CVE-2020-5273 State: PUBLISHED Published: 2020-04-16T21:15:17 Last Updated: 2024-08-04T08:22:09.084Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: ps_linklist Problem Types: CWE-79 Description: In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/ps_linklist/security/advisories/GHSA-cx2r-mf6x-55rx - https://github.com/PrestaShop/ps_linklist/commit/83e6e0bdda2287f4d6e64127cb90c41d26b5ad82
CVE ID: CVE-2020-5274 State: PUBLISHED Published: 2020-03-30T19:40:14 Last Updated: 2024-08-04T08:22:09.100Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: symfony Products: symfony Problem Types: CWE-209 Description: In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5 Additional Analyst Note
n debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2 - https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db - https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad
CVE ID: CVE-2020-5275 State: PUBLISHED Published: 2020-03-30T19:45:14 Last Updated: 2024-08-04T08:22:09.094Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: symfony Products: symfony Problem Types: CWE-285 Description: In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being app
strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-g4m9-5hpf-hx72 - https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ/
CVE ID: CVE-2020-5276 State: PUBLISHED Published: 2020-04-20T16:50:29 Last Updated: 2024-08-04T08:22:09.066Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-q6pr-42v5-v97q - https://github.com/PrestaShop/PrestaShop/commit/6838d21850e7227fb8afbf568cb0386b3dedd3ef
CVE ID: CVE-2020-5277 State: PUBLISHED Published: 2020-03-25T18:30:15 Last Updated: 2024-08-04T08:22:09.180Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: PrestaShop Products: ps_facetedsearch Problem Types: CWE-79 Description: PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/ps_facetedsearch/security/advisories/GHSA-mmmv-m5q9-g3cm - https://github.com/PrestaShop/ps_facetedsearch/commit/c792ddcdd84ec208a6dfa4a30fd66d8bc9863f4a