Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-11490 State: PUBLISHED Published: 2020-04-02T13:07:41 Last Updated: 2024-08-04T11:35:12.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi cert_issuer, cert_division, cert_organization, cert_locality, cert_state, cert_country, or cert_email parameter. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2020/03/pentesting-zen-load-balancer-quick.html - https://github.com/c610/tmp/blob/master/zenload4patreons.zip
CVE ID: CVE-2020-11491 State: PUBLISHED Published: 2020-04-02T13:07:34 Last Updated: 2024-08-04T11:35:11.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow request to index.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2020/03/pentesting-zen-load-balancer-quick.html - https://github.com/c610/tmp/blob/master/zenload4patreons.zip
CVE ID: CVE-2020-11492 State: PUBLISHED Published: 2020-06-05T13:10:17 Last Updated: 2024-08-04T11:35:12.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/docker-for-windows/release-notes/ - https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492/
CVE ID: CVE-2020-11493 State: PUBLISHED Published: 2020-09-04T03:31:20 Last Updated: 2024-08-04T11:35:12.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2020-11494 State: PUBLISHED Published: 2020-04-02T20:14:01 Last Updated: 2024-08-04T11:35:12.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/b9258a2cece4ec1f020715fe3554bc2e360f6264 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html - h
9258a2cece4ec1f020715fe3554bc2e360f6264 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html - https://security.netapp.com/advisory/ntap-20200430-0004/ - https://usn.ubuntu.com/4364-1/ - https://usn.ubuntu.com/4368-1/ - https://usn.ubuntu.com/4363-1/ - https://usn.ubuntu.com/4369-1/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html - https://git.kernel.org/pub/scm/linux/ke
ormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=08fadc32ce6239dc75fd5e869590e29bc62bbc28
CVE ID: CVE-2020-11495 State: REJECTED Published: 2020-05-05T18:44:53 Last Updated: 2020-05-05T18:44:53 Description: No description available.
CVE ID: CVE-2020-11496 State: PUBLISHED Published: 2020-10-19T18:52:19 Last Updated: 2024-08-04T11:35:11.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the validation of the input values on the device side, which is provided by the engineering software during parameterization. Attackers with access to local configuration files can therefore insert malicious commands that are executed after compiling them to valid parameter files (“PDLs”), transferring them to the device, and restarting the device. Additional Analyst Notes: - CVE
id parameter files (“PDLs”), transferring them to the device, and restarting the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.sprecher-automation.com/en/it-security/
CVE ID: CVE-2020-11497 State: PUBLISHED Published: 2020-08-26T18:25:23 Last Updated: 2024-08-04T11:35:12.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step. Additional Analyst Notes: - CVE Program Container: References: - https://www.themissinglink.com.au/security-advisories-cve-2020-11497 - http://seclists.org/fulldisclosure/2020/Aug/13 - http://seclists.org/fulldisclosure/2020/Aug/13 - http://packetstormsecurity.com/files/
.org/fulldisclosure/2020/Aug/13 - http://seclists.org/fulldisclosure/2020/Aug/13 - http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.html
CVE ID: CVE-2020-11498 State: PUBLISHED Published: 2020-04-02T22:13:47 Last Updated: 2024-08-04T11:35:12.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context, e.g., for user-level persistence or to bypass security controls. NOTE: the vendor states that this "requires a high degree of access and other preconditions that are tough to achieve." Additional Analyst Notes: - CVE Program Container: References: - https://gith
preconditions that are tough to achieve." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/slackhq/nebula/pull/191 - http://www.pwn3d.org/posts/7918501-slack-nebula-relative-path-bug-bounty-disclosure
CVE ID: CVE-2020-11499 State: PUBLISHED Published: 2020-04-02T22:43:45 Last Updated: 2024-08-04T11:35:12.454Z Severity: LOW (CVSS 3.3 CVSS:3.0/AC:L/AV:L/A:N/C:N/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fkie-cad/FACT_core/issues/375 - https://github.com/fkie-cad/FACT_core/pull/376
CVE ID: CVE-2020-11500 State: PUBLISHED Published: 2020-04-03T12:07:28 Last Updated: 2024-08-04T11:35:12.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key. Additional Analyst Notes: - CVE Program Container: References: - https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ - https://theintercept.com/2020/04/03/zooms-encryption-is-not-suited-for-secrets-and-has-surprising-links-to-china-researchers-discover/
CVE ID: CVE-2020-11501 State: PUBLISHED Published: 2020-04-03T12:42:28 Last Updated: 2024-08-04T11:35:12.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202004-06 - https://gitlab.com/gnutls/gnutls/-/issues/960 - https://gitlab.com/gnutls/g
https://security.gentoo.org/glsa/202004-06 - https://gitlab.com/gnutls/gnutls/-/issues/960 - https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2 - https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31 - https://www.debian.org/security/2020/dsa-4652 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html - https://security.netapp.com/advisory/ntap-20200416-0002/ - https://usn.ubuntu.com/4322-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZA
VDEJLTT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
CVE ID: CVE-2020-11503 State: PUBLISHED Published: 2020-06-18T15:25:29 Last Updated: 2024-08-04T11:35:12.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remotely. Additional Analyst Notes: - CVE Program Container: References: - https://community.sophos.com/b/security-blog/posts/advisory-potential-rce-through-heap-overflow-in-awarrensmtp-cve-2020-11503
CVE ID: CVE-2020-11505 State: PUBLISHED Published: 2020-04-22T19:46:37 Last Updated: 2024-08-04T11:35:12.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
CVE ID: CVE-2020-11506 State: PUBLISHED Published: 2020-04-22T19:50:39 Last Updated: 2024-08-04T11:35:12.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
CVE ID: CVE-2020-11507 State: PUBLISHED Published: 2020-04-06T15:37:44 Last Updated: 2024-08-04T11:35:12.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://forums.malwarebytes.com/topic/258140-release-adwcleaner-804/
CVE ID: CVE-2020-11508 State: PUBLISHED Published: 2020-04-07T18:44:49 Last Updated: 2024-08-04T11:35:12.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/
CVE ID: CVE-2020-11509 State: PUBLISHED Published: 2020-04-07T18:48:43 Last Updated: 2024-08-04T11:35:12.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page). Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/
CVE ID: CVE-2020-11511 State: PUBLISHED Published: 2021-07-27T04:56:54 Last Updated: 2024-08-04T11:35:12.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/learnpress/#developers - http://packetstormsecurity.com/files/163538/WordPress-LearnPress-Privilege-Escalation.html - https://www.wordfence.com/blog/2020/04/high-severity-vulnerabilities-patched-in-learnpress/ - https://cwe.mitre.org/data/definitions/862.htm
e.com/blog/2020/04/high-severity-vulnerabilities-patched-in-learnpress/ - https://cwe.mitre.org/data/definitions/862.html
CVE ID: CVE-2020-11512 State: PUBLISHED Published: 2020-04-07T16:40:34 Last Updated: 2024-08-04T11:35:12.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.o
e new administrator-level accounts. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/idx-broker-platinum/#developers - https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-impress-for-idx-broker/
CVE ID: CVE-2020-11514 State: PUBLISHED Published: 2020-04-07T16:50:15 Last Updated: 2024-08-04T11:35:13.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://rankmath.com/changelog/ - https://wordpress.org/plugins/seo-by-rank-math/#developers - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-site
eo-by-rank-math/#developers - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
CVE ID: CVE-2020-11515 State: PUBLISHED Published: 2020-04-07T16:51:42 Last Updated: 2024-08-04T11:35:12.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI). Additional Analyst Notes: - CVE Program Container: References: - https://rankmath.com/changelog/ - https://wordpress.org/plugins/seo-by-rank-math/#dev
E Program Container: References: - https://rankmath.com/changelog/ - https://wordpress.org/plugins/seo-by-rank-math/#developers - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
CVE ID: CVE-2020-11516 State: PUBLISHED Published: 2020-04-07T16:55:39 Last Updated: 2024-08-04T11:35:12.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session. Additional Analyst Notes: - CV
eate new administrative users or perform other actions using the administrator's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-leads-to-closure-of-plugin-with-over-100000-installations/
CVE ID: CVE-2020-11518 State: PUBLISHED Published: 2020-04-04T13:25:34 Last Updated: 2024-08-04T11:35:12.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/community/topic/adselfservice-plus-5815-released-with-an-important-security-fix
CVE ID: CVE-2020-11519 State: PUBLISHED Published: 2020-06-22T17:48:25 Last Updated: 2024-08-04T11:35:12.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sectors via a \\.\SecureDocDevice handle. Exploiting this vulnerability results in privileged code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2/ - https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2-hf1
CVE ID: CVE-2020-11520 State: PUBLISHED Published: 2020-06-22T17:47:09 Last Updated: 2024-08-04T11:35:12.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2/ - https://www.winmagic.com/support/release-notes/securedoc-v8-5-sr2-hf1
CVE ID: CVE-2020-11521 State: PUBLISHED Published: 2020-05-15T16:07:52 Last Updated: 2024-08-04T11:35:13.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commits/master - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cwc-6wc9-255w - https://pub.freerdp.com/cve/CVE-2020-11521/pocAnalysis_6.pdf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lt
382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
CVE ID: CVE-2020-11522 State: PUBLISHED Published: 2020-05-15T16:10:32 Last Updated: 2024-08-04T11:35:12.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commits/master - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-48wx-7vgj-fffh - https://pub.freerdp.com/cve/CVE-2020-11522/pocAnalysis_5.pdf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/202
//lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
CVE ID: CVE-2020-11523 State: PUBLISHED Published: 2020-05-15T16:12:56 Last Updated: 2024-08-04T11:35:12.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commits/master - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qrh-8cp8-4x42 - https://pub.freerdp.com/cve/CVE-2020-11523/pocAnalysis_2.pdf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-an
1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
CVE ID: CVE-2020-11524 State: PUBLISHED Published: 2020-05-15T16:14:32 Last Updated: 2024-08-04T11:35:13.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commits/master - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgw8-3mp2-p5qw - https://pub.freerdp.com/cve/CVE-2020-11524/pocAnalysis_3.pdf - https://usn.ubuntu.com/4379-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
CVE ID: CVE-2020-11525 State: PUBLISHED Published: 2020-05-15T16:16:02 Last Updated: 2024-08-04T11:35:13.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commits/master - https://github.com/FreeRDP/FreeRDP/pull/6019/commits/58dc36b3c883fd460199cedb6d30e58eba58298c - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9755-fphh-gmjg - https://pub.freerdp.com/cve/CVE-2020-11525/pocAnalysis_1.pdf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.op
cve/CVE-2020-11525/pocAnalysis_1.pdf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
CVE ID: CVE-2020-11526 State: PUBLISHED Published: 2020-05-15T16:18:18 Last Updated: 2024-08-04T11:35:12.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commits/master - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97jw-m5w5-xvf9 - https://pub.freerdp.com/cve/CVE-2020-11526/pocAnalysis_4.pdf - https://usn.ubuntu.com/4379-1/ - https://usn.ubuntu.com/4382-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html - https://lists.debian.org/debian-lts