Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later. Additional Analyst Notes: - CVE Program Container: References: - https://developer.android.com/reference/com/google/android/play/core/release-notes#1-7-2 - https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/
CVE ID: CVE-2020-8916 State: PUBLISHED Published: 2020-07-07T20:15:12 Last Updated: 2024-08-04T10:12:11.054Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Google LLC Products: wpantund Problem Types: CWE-401 Description: A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to restrict access in your debug environments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openthread/wpantund/
g environments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openthread/wpantund/pull/468/commits/0e5d1601febb869f583e944785e5685c6c747be7
CVE ID: CVE-2020-8918 State: PUBLISHED Published: 2020-08-11T18:35:11 Last Updated: 2024-08-04T10:12:11.062Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Google LLC Products: google/go-tpm library Problem Types: CWE-665 Description: An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and 'encMigrationAuth', and then can calculate 'usageAuth ^ encMigrationAuth' as the 'migrationAuth' can be guessed for all keys created with CreateWrap
can calculate 'usageAuth ^ encMigrationAuth' as the 'migrationAuth' can be guessed for all keys created with CreateWrapKey. TPM2.0 is not impacted by this. We recommend updating your library to 0.3.0 or later, or, if you cannot update, to call CreateWrapKey with a random 20-byte value for 'migrationAuth'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/go-tpm/security/advisories/GHSA-5x29-3hr9-6wpw
CVE ID: CVE-2020-8919 State: PUBLISHED Published: 2020-12-10T10:15:22 Last Updated: 2024-08-04T10:12:10.971Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Gerrit Products: Gerrit Problem Types: CWE-285 Description: An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with restricted access. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.googlesource.com/gerrit/+/0532fb876cb86bc091a91f78e6f28fff9
Notes: - CVE Program Container: References: - https://gerrit.googlesource.com/gerrit/+/0532fb876cb86bc091a91f78e6f28fff9e39ca65 - https://www.gerritcodereview.com/2.15.html#21521 - https://www.gerritcodereview.com/2.16.html#21625 - https://www.gerritcodereview.com/3.0.html#3014 - https://www.gerritcodereview.com/3.1.html#3110 - https://www.gerritcodereview.com/3.2.html#325
CVE ID: CVE-2020-8920 State: PUBLISHED Published: 2020-12-10T10:15:23 Last Updated: 2024-08-04T10:12:10.990Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Gerrit Products: Gerrit Problem Types: CWE-285 Description: An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.gerritcodereview.com/2.15.ht
heir accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.gerritcodereview.com/2.15.html#21521 - https://www.gerritcodereview.com/2.16.html#21625 - https://www.gerritcodereview.com/3.0.html#3014 - https://www.gerritcodereview.com/3.1.html#3110 - https://www.gerritcodereview.com/3.2.html#325 - https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33 - https://www.gerritcodereview.com/2.14.html#21422
CVE ID: CVE-2020-8923 State: PUBLISHED Published: 2020-03-26T11:31:55 Last Updated: 2024-08-04T10:12:10.987Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Google Products: Dart SDK Problem Types: CWE-79 Description: An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided d
ate, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627
CVE ID: CVE-2020-8927 State: PUBLISHED Published: 2020-09-15T09:15:12 Last Updated: 2024-08-04T10:12:11.066Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Google LLC Products: Brotli Problem Types: CWE-130 Description: A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limit
one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/brotli/releases/tag/v1.0.9 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/ - https://usn.ubuntu.com/4568-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproj
ge/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/ - https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html - https://www.debian.org/security/2020/dsa-4801 - https://list
ists.debian.org/debian-lts-announce/2020/12/msg00003.html - https://www.debian.org/security/2020/dsa-4801 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/
CVE ID: CVE-2020-8929 State: PUBLISHED Published: 2020-10-19T12:15:16 Last Updated: 2024-08-04T10:12:11.052Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Google LLC Products: Tink Problem Types: CWE-176 Description: A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting deterministic AEAD with a single key, and rely on a unique ciphertext-per-plaintext. Additional Analyst Notes: - CVE Program Container: References: - https:/
and rely on a unique ciphertext-per-plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899 - https://github.com/google/tink/security/advisories/GHSA-g5vf-v6wf-7w2r
CVE ID: CVE-2020-8933 State: PUBLISHED Published: 2020-06-22T13:45:26 Last Updated: 2024-08-04T10:12:10.996Z Vendors: Google LLC Products: guest-oslogin Problem Types: CWE-276 Description: A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update,
hen gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29 - https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 - https://cloud.google.com/support/bulletins/#gcp-2020-008 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00047.html
CVE ID: CVE-2020-8934 State: PUBLISHED Published: 2023-07-07T11:46:51.869Z Last Updated: 2024-09-26T19:17:54.926Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Google Products: Site Kit By Google Problem Types: CWE-252 Description: The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
vel of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-site-kit/site-kit-by-google-171-sensitive-information-disclosure
CVE ID: CVE-2020-8935 State: PUBLISHED Published: 2020-12-15T14:55:32 Last Updated: 2024-08-04T10:12:11.011Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: Arbitrary Memory overwrite in Ecall_restore Description: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/ed0926bff0e423cd122a18b3d2fc772817f66825
CVE ID: CVE-2020-8936 State: PUBLISHED Published: 2020-12-15T14:55:33 Last Updated: 2024-08-04T10:12:11.009Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-125 Description: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/goo
values from within the enclave. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/83036fd841d33baa7e039f842d131aa7881fdcc2
CVE ID: CVE-2020-8937 State: PUBLISHED Published: 2020-12-15T14:55:34 Last Updated: 2024-08-04T10:12:11.093Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 Additional Analyst Notes: - CVE P
e enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/a37fb6a0e7daf30134dbbf357c9a518a1026aa02
CVE ID: CVE-2020-8938 State: PUBLISHED Published: 2020-12-15T14:55:35 Last Updated: 2024-08-04T10:12:11.012Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: Arbitrary enclave memory write from untrusted environment Description: An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to FromkLinuxSockAddr with attacker controlled content and size of klinux_addr which allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 Additional Analyst Notes: - CVE Program Container: Refe
d upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/bda9772e7872b0d2b9bee32930cf7a4983837b39
CVE ID: CVE-2020-8939 State: PUBLISHED Published: 2020-12-15T14:55:35 Last Updated: 2024-08-04T10:12:11.010Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-125 Description: An out of bounds read on the enc_untrusted_inet_ntop function allows an attack to extend the result size that is used by memcpy() to read memory from within the enclave heap. We recommend upgrading past commit 6ff3b77ffe110a33a2f93848a6333f33616f02c4 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/6ff3b77ffe110a33a2f93848a6333f33616f02c4
CVE ID: CVE-2020-8940 State: PUBLISHED Published: 2020-12-15T14:55:36 Last Updated: 2024-08-04T10:12:10.977Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvmsg using an attacker controlled result parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading or past commit fa6485c5d16a7355eab047d4a44345a73bc9131e Additional An
within the secure enclave. We recommend upgrading or past commit fa6485c5d16a7355eab047d4a44345a73bc9131e Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/fa6485c5d16a7355eab047d4a44345a73bc9131e
CVE ID: CVE-2020-8941 State: PUBLISHED Published: 2020-12-15T14:55:37 Last Updated: 2024-08-04T10:12:10.981Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker controlled klinux_addr_buffer parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 8fed5e334131abaf9c5e17307642fbf6ce4a57ec Ad
mory addresses within the secure enclave. We recommend upgrading past commit 8fed5e334131abaf9c5e17307642fbf6ce4a57ec Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/8fed5e334131abaf9c5e17307642fbf6ce4a57ec
CVE ID: CVE-2020-8942 State: PUBLISHED Published: 2020-12-15T14:55:38 Last Updated: 2024-08-04T10:12:11.000Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was not validated against the requrested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit b1d120a2c7d7446d2cc58d517e20a1b184b82200 A
emory addresses within the secure enclave. We recommend upgrading past commit b1d120a2c7d7446d2cc58d517e20a1b184b82200 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/b1d120a2c7d7446d2cc58d517e20a1b184b82200
CVE ID: CVE-2020-8943 State: PUBLISHED Published: 2020-12-15T14:55:38 Last Updated: 2024-08-04T10:12:11.017Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvfrom whose return size was not validated against the requested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 6e158d558abd3c29a0208e30c97c9a8c5bd4230
g memory addresses within the secure enclave. We recommend upgrading past commit 6e158d558abd3c29a0208e30c97c9a8c5bd4230f Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/6e158d558abd3c29a0208e30c97c9a8c5bd4230f
CVE ID: CVE-2020-8944 State: PUBLISHED Published: 2020-12-15T14:55:39 Last Updated: 2024-08-04T10:12:10.992Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output which fails to check the range of a pointer. An attacker can use this pointer to write to arbitrary memory addresses including those within the secure enclave We recommend upgrading past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a Additional Analyst Notes: - CVE Program Container: Re
end upgrading past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/382da2b8b09cbf928668a2445efb778f76bd9c8a
CVE ID: CVE-2020-8945 State: PUBLISHED Published: 2020-02-12T17:20:43 Last Updated: 2024-08-04T10:12:10.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/proglottis/gpgme/pull/23 - https://bugzilla.redhat.com/show_bug.cgi?id=1795838 - https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1 - https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366
thub.com/proglottis/gpgme/compare/v0.1.0...v0.1.1 - https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/ - https://access.redhat.com/errata/RHSA-2020:0679 - https://access.redhat.com/errata/RHSA-2020:0689 - https://access.redhat.com/errata/RHSA-2020:0697 - https://lists
0679 - https://access.redhat.com/errata/RHSA-2020:0689 - https://access.redhat.com/errata/RHSA-2020:0697 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
CVE ID: CVE-2020-8946 State: PUBLISHED Published: 2020-02-12T17:29:52 Last Updated: 2024-08-04T10:12:11.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/02/netis-authenticated-rce-on-wf2471.html
CVE ID: CVE-2020-8947 State: PUBLISHED Published: 2020-02-12T17:52:37 Last Updated: 2024-08-04T10:12:10.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. Additional Analyst Notes: - CVE Program Container: References: - https://engindemirbilek.github.io/pandorafms-rce - https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/pandorafms-rce.html - http://packetstormsecurity.com/files/156326/Pandora-FMS
ilek/EnginDemirbilek.github.io/blob/master/pandorafms-rce.html - http://packetstormsecurity.com/files/156326/Pandora-FMS-7.0-Authenticated-Remote-Code-Execution.html
CVE ID: CVE-2020-8948 State: PUBLISHED Published: 2020-04-15T15:17:23 Last Updated: 2024-08-04T10:12:11.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) before build 5043 allows an unprivileged user to overwrite arbitrary files in arbitrary folders using hard links. An unprivileged user could leverage this vulnerability to execute arbitrary code with system privileges. Additional Analyst Notes: - CVE Program Container: References: - https://danishcyberdefence.dk/blog/sierra_wireless - https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bullet