Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-27347 State: PUBLISHED Published: 2020-11-06T02:20:13.352334Z Last Updated: 2024-09-17T00:20:28.710Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: tmux, Ubuntu Products: tmux Problem Types: CWE-121 Description: In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c - https://www.openwall.com/lists/oss-security/2020/11/05/3 - https://security.gentoo.org/glsa/202011-10 - https://raw.githubus
s://www.openwall.com/lists/oss-security/2020/11/05/3 - https://security.gentoo.org/glsa/202011-10 - https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES
CVE ID: CVE-2020-27348 State: PUBLISHED Published: 2020-12-04T02:30:36.159059Z Last Updated: 2024-09-16T17:14:15.768Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Canonical Products: snapcraft Problem Types: CWE-427 Description: In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snapcore/
d prior to 2.43.1+18.04.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snapcore/snapcraft/pull/3345 - https://usn.ubuntu.com/usn/usn-4661-1 - https://bugs.launchpad.net/bugs/1901572
CVE ID: CVE-2020-27349 State: PUBLISHED Published: 2020-12-09T03:35:17.337615Z Last Updated: 2024-09-16T18:50:26.180Z Vendors: Canonical Products: aptdaemon Problem Types: CWE-862 Description: Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu19.5, 1.1.1+bzr982-0ubuntu14.5. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/usn/usn-4664-1 - https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1899193
CVE ID: CVE-2020-27350 State: PUBLISHED Published: 2020-12-10T04:05:18.456615Z Last Updated: 2024-09-17T04:29:18.208Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Canonical Products: apt Problem Types: CWE-190 Description: APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1; Additional Analy
ntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1; Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/usn/usn-4667-1 - https://bugs.launchpad.net/bugs/1899193 - https://www.debian.org/security/2020/dsa-4808 - https://security.netapp.com/advisory/ntap-20210108-0005/
CVE ID: CVE-2020-27351 State: PUBLISHED Published: 2020-12-10T04:05:18.897719Z Last Updated: 2024-09-16T22:15:18.197Z Severity: LOW (CVSS 2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L) Vendors: Canonical Products: python-apt Problem Types: CWE-772 Description: Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1; Additional Analyst Notes: - CVE Program Container: Referen
untu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1; Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/bugs/1899193 - https://usn.ubuntu.com/usn/usn-4668-1 - https://www.debian.org/security/2020/dsa-4809
CVE ID: CVE-2020-27352 State: PUBLISHED Published: 2024-06-21T20:06:37.992Z Last Updated: 2024-08-04T16:11:36.612Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: snapd Description: When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended. Additional Analyst Notes: - CISA ADP Vulnrich
ivileges to a container within the snap that were not originally intended. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.launchpad.net/snapd/+bug/1910456 - https://ubuntu.com/security/notices/USN-4728-1 - https://www.cve.org/CVERecord?id=CVE-2020-27352
CVE ID: CVE-2020-27353 State: REJECTED Published: N/A Last Updated: 2024-06-04T22:59:27.579Z Description: No description available.
CVE ID: CVE-2020-27354 State: REJECTED Published: N/A Last Updated: 2024-06-04T23:05:41.103Z Description: No description available.
CVE ID: CVE-2020-27355 State: REJECTED Published: N/A Last Updated: 2024-06-04T23:06:36.595Z Description: No description available.
CVE ID: CVE-2020-27356 State: PUBLISHED Published: 2021-12-07T20:25:51 Last Updated: 2024-08-04T16:11:36.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: The debug-meta-data plugin 1.1.2 for WordPress allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/debug-meta-data/#developers - https://github.com/ahmadawais/debug-meta-data/blob/master/changelog.md - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0009/MNDT-2021-0009.md
CVE ID: CVE-2020-27358 State: PUBLISHED Published: 2020-10-31T16:18:43 Last Updated: 2024-08-04T16:11:36.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}. Additional Analyst Notes: - CVE Program Container: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.ruse.tech/b
iner: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.ruse.tech/blog/38 - https://github.com/seb1055/cve-2020-27358-27359
CVE ID: CVE-2020-27359 State: PUBLISHED Published: 2020-10-31T16:22:03 Last Updated: 2024-08-04T16:11:36.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages. Additional Analyst Notes: - CVE Program Container: References: - https:
hout interaction from the user on several pages. Additional Analyst Notes: - CVE Program Container: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.ruse.tech/blog/38 - https://github.com/seb1055/cve-2020-27358-27359
CVE ID: CVE-2020-27361 State: PUBLISHED Published: 2021-07-01T15:57:22 Last Updated: 2024-08-04T16:11:36.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories. Additional Analyst Notes: - CVE Program Container: References: - https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/
CVE ID: CVE-2020-27362 State: PUBLISHED Published: 2021-07-01T15:57:24 Last Updated: 2024-08-04T16:11:36.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file editor and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/
CVE ID: CVE-2020-27366 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T14:13:25.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in wlscanresults.html in Humax HGB10R-02 BRGCAB version 1.0.03, allows local attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pastebin.com/sr0JR1ys
CVE ID: CVE-2020-27368 State: PUBLISHED Published: 2021-01-14T15:57:26 Last Updated: 2024-08-04T16:11:36.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/swzhouu/CVE-2020-27368
CVE ID: CVE-2020-27372 State: PUBLISHED Published: 2021-10-11T18:09:28 Last Updated: 2024-08-04T16:11:36.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run_interpreter function. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/brandy/bugs/10/
CVE ID: CVE-2020-27373 State: PUBLISHED Published: 2022-04-07T01:24:02 Last Updated: 2024-08-04T16:11:36.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE. Additional Analyst Notes: - CVE Program Container: References: - http://dr.com - https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor - https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE ID: CVE-2020-27374 State: PUBLISHED Published: 2022-04-07T01:23:56 Last Updated: 2024-08-04T16:11:36.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring. Additional Analyst Notes: - CVE Program Container: References: - http://dr.com - https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor - https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE ID: CVE-2020-27375 State: PUBLISHED Published: 2022-04-07T01:23:50 Last Updated: 2024-08-04T16:11:36.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars. Additional Analyst Notes: - CVE Program Container: References: - http://dr.com - https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor - https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE ID: CVE-2020-27376 State: PUBLISHED Published: 2022-04-07T01:23:45 Last Updated: 2024-08-04T16:11:36.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication. Additional Analyst Notes: - CVE Program Container: References: - http://dr.com - https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor - https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE ID: CVE-2020-27377 State: PUBLISHED Published: 2021-06-01T14:57:20 Last Updated: 2024-08-04T16:11:36.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12317
CVE ID: CVE-2020-27379 State: PUBLISHED Published: 2021-07-14T14:38:17 Last Updated: 2024-08-04T16:11:36.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e
CVE ID: CVE-2020-27383 State: PUBLISHED Published: 2021-06-09T18:20:52 Last Updated: 2024-08-04T16:11:36.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticated Users Group" which grants the (F) Flag aka "Full Control" Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreySolarEye/CVE/blob/master/Battle%20Net%20Launcher%20Local%20Privilege%20Escalation
CVE ID: CVE-2020-27384 State: PUBLISHED Published: 2021-06-09T14:54:09 Last Updated: 2024-08-04T16:11:36.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full Control) for 'Everyone' group, making the entire directory 'Guild Wars 2' and its files and sub-dirs world-writable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreySolarEye/CVE/blob/maste
ritable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreySolarEye/CVE/blob/master/Guild%20Wars%202%20-%20Local%20Privilege%20Escalation
CVE ID: CVE-2020-27385 State: PUBLISHED Published: 2020-11-12T18:24:06 Last Updated: 2024-08-04T16:11:36.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. (dot dot) path such as ..\..\..\..\..\<file> in the input field of the FileEditor. In FlexDotnetCMS before v1.5.8, it is also possible to access files by specifying the full path (e.g., C:\<file>). The files can then be edited via the FileEditor. Additional
access files by specifying the full path (e.g., C:\<file>). The files can then be edited via the FileEditor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.11 - https://blog.vonahi.io/whats-in-a-re-name/
CVE ID: CVE-2020-27386 State: PUBLISHED Published: 2020-11-12T18:15:14 Last Updated: 2024-08-04T16:11:36.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>. Additional Analyst Notes
tension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9 - https://blog.vonahi.io/whats-in-a-re-name/ - https://github.com/rapid7/metasploit-framework/pull/14339 - http://packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upload.html
CVE ID: CVE-2020-27387 State: PUBLISHED Published: 2020-11-05T01:18:12 Last Updated: 2024-08-04T16:11:36.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta. Additi
st to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/14340 - https://github.com/ttimot24/HorizontCMS/commit/436b5ab679fd27afa3d99c023dbe103113da4fee - https://blog.vonahi.io/whats-in-a-re-name/ - http://packetstormsecurity.com/files/160046/HorizontCMS-1.0.0-beta-Shell-Upload.html
CVE ID: CVE-2020-27388 State: PUBLISHED Published: 2020-10-23T19:59:37 Last Updated: 2024-08-04T16:11:36.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues. Additional Analyst Notes: - CVE Program Container: References: - http://yourls.com - https://johnjhacking.com/blog/cve-2020-27388/ - https://github.com/YOURLS/YOURLS/pull/2761
CVE ID: CVE-2020-27397 State: PUBLISHED Published: 2020-12-23T17:54:10 Last Updated: 2024-08-04T16:11:36.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution (RCE) on the Hosting web server via uploading a maliciously crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/160337/Online-Matrimonial-Project-1.0-Remote-Code-Execution.html
CVE ID: CVE-2020-27402 State: PUBLISHED Published: 2020-11-05T14:25:42 Last Updated: 2024-08-04T16:11:36.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb. Additional Analyst Notes: - CVE Program Container: References: - https://threatpost.com/authentication-bug-android-smart-tv-data-theft/160025/ - https://www.cybersecurity-help.cz/vdb/SB2020101404 - https://www.securitylab.ru/news/513051.php - https://sick.codes/sick-2020-004/ - https://github.com/sickcodes/security/blob/master/advisories
ab.ru/news/513051.php - https://sick.codes/sick-2020-004/ - https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-004.md
CVE ID: CVE-2020-27403 State: PUBLISHED Published: 2020-11-10T17:18:56 Last Updated: 2024-08-04T16:11:36.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network, can download most system files, leading to serious critical information disclosure. Also, some TV models and/or FW versions may expose the webse
files, leading to serious critical information disclosure. Also, some TV models and/or FW versions may expose the webserver with the entire filesystem accessible on another port. For example, nmap scan for all ports run directly from the TV model U43P6046 (Android 8.0) showed port 7983 not mentioned in the original CVE description, but containing the same directory listing of the entire filesystem. This webserver is bound (at least) to localhost interface and accessible freely to all unprivileged installed apps on the Android such as a regular web browser. Any app can therefore read any files of any other apps including Android system settings including sensitive data such as saved password
efore read any files of any other apps including Android system settings including sensitive data such as saved passwords, private keys etc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sickcodes - https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-009.md - https://sick.codes/sick-2020-009 - https://sick.codes/extraordinary-vulnerabilities-discovered-in-tcl-android-tvs-now-worlds-3rd-largest-tv-manufacturer/ - https://github.com/sickcodes/security/issues/1 - https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf - https://github.com/sickcodes/security/blob/master
2020-27403_CVE-2020-28055_Press-Statement-and-Questions_11162020.pdf - https://github.com/sickcodes/security/blob/master/etc/CVE-2020-27403_CVE-2020-28055_GlobalFAQ.pdf - https://securityledger.com/2020/11/security-holes-opened-back-door-to-tcl-android-smart-tvs/ - https://securityledger.com/2020/11/tv-maker-tcl-denies-back-door-promises-better-process/ - https://support.tcl.com/vulnerabilities-found-in-tcl-android-tvs
CVE ID: CVE-2020-27406 State: PUBLISHED Published: 2021-11-02T10:11:44 Last Updated: 2024-08-04T16:18:43.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname. Additional Analyst Notes: - CVE Program Container: References: - http://dynpg.com - https://www.exploit-db.com/exploits/48865
CVE ID: CVE-2020-27408 State: PUBLISHED Published: 2020-12-04T15:27:22 Last Updated: 2024-08-04T16:18:43.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Responsive-Design/releases - https://insinuator.net/2020/10/opensis-vulnerabilities/