Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22HESSYU7T4D6GGENUVEX3X3H6FGBECH/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-11989 State: PUBLISHED Published: 2020-06-22T18:06:37 Last Updated: 2024-08-04T11:48:57.710Z Vendors: Apache Software Foundation Products: Apache Shiro Problem Types: Authentication Bypass by Primary Weakness Description: Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cuser.shiro.apache.org%3E - https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cdev.shiro.apache.org%
ttps://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/rc8b39ea8b3ef71ddc1cd74ffc866546182683c8adecf19c263fe7ac0%40%3Ccommits.shiro.apache.org%3E - https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E - https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cuser.shiro.apache.org%3E - https://lists.apache.org/thread.html/rcf3d8041e1232201fe5d74fc612a193e435784d64002409b448b58fe%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r408fe60bc8fdfd7c74135249
3e435784d64002409b448b58fe%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r408fe60bc8fdfd7c74135249d646d7abadb807ebf90f6fd2b014df21%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3%40%3Ccommits.shiro.apache.org%3E
CVE ID: CVE-2020-11990 State: PUBLISHED Published: 2020-12-01T16:46:08 Last Updated: 2024-08-04T11:48:57.611Z Vendors: n/a Products: Apache Cordova ( cordova-plugin-camera ) Problem Types: Exposure of Sensitive Information Description: We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally. Additional Analyst Notes: - CVE Program Container: References: - https://cordova.apache.org/news/2020/09/18/camera-plugin-release.html - http://jvn.jp/en/jp/JVN597
tainer: References: - https://cordova.apache.org/news/2020/09/18/camera-plugin-release.html - http://jvn.jp/en/jp/JVN59779918/index.html
CVE ID: CVE-2020-11991 State: PUBLISHED Published: 2020-09-11T13:28:20 Last Updated: 2024-08-04T11:48:57.582Z Vendors: n/a Products: Apache Cocoon Problem Types: Information Disclosure Description: When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E
CVE ID: CVE-2020-11992 State: REJECTED Published: 2020-07-09T13:36:39 Last Updated: 2020-07-09T13:36:39 Description: No description available.
CVE ID: CVE-2020-11993 State: PUBLISHED Published: 2020-08-07T15:32:55 Last Updated: 2024-08-04T11:48:57.265Z Vendors: n/a Products: Apache HTTP Server Problem Types: Push Diary Crash on Specifically Crafted HTTP/2 Header Description: Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers. Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-202
Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993 - https://security.gentoo.org/glsa/202008-04 - https://lists.apache.org/thread.html/r9e9f1a7609760f0f80562eaaec2aa3c32d525c3e0fca98b475240c71%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3E - https://usn.ubuntu.com/4458-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NKWG2EXAQQB6LMLA
-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NKWG2EXAQQB6LMLATKZ7KLSRGCSHVAN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVFDBVM6E3JF3O7RYLRPRCH3RDRHJJY/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html - https://www.debian.org/security/2020/dsa-4757 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200814-0005/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.html - https://www.oracle.com/security-a
4-0005/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.html - https://www.oracle.com/security-alerts/cpujan2021.html - http://packetstormsecurity.com/files/160393/Apache-2-HTTP2-Module-Concurrent-Pool-Usage.html - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1
e8775%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.h
71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2020-11994 State: PUBLISHED Published: 2020-07-08T15:13:02 Last Updated: 2024-08-04T11:48:57.522Z Vendors: n/a Products: Apache Camel Problem Types: Server-Side Template Injection and arbitrary file disclosure Description: Server-Side Template Injection and arbitrary file disclosure on Camel templating components Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-11995 State: PUBLISHED Published: 2021-01-11T09:40:19.000Z Last Updated: 2025-02-13T16:27:27.063Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: CWE-502 Description: A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in
se special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E
CVE ID: CVE-2020-11996 State: PUBLISHED Published: 2020-06-26T16:27:20 Last Updated: 2024-08-04T11:48:57.318Z Vendors: Apache Products: Apache Tomcat Problem Types: Denial of Service Description: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E - ht
apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r
f527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff10571150
0%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.o
lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html - https://www.debian.org/security/2020/dsa-4727 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html - https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20200709-0002/ - https://usn.ubuntu.com/4596-1/ - https://www.oracle.com/
ml - https://security.netapp.com/advisory/ntap-20200709-0002/ - https://usn.ubuntu.com/4596-1/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2%40%3Cnotifications.ofbiz.apache.org%3E
CVE ID: CVE-2020-11997 State: PUBLISHED Published: 2021-01-19T21:12:29 Last Updated: 2024-08-04T11:48:57.093Z Vendors: n/a Products: Apache Guacamole Problem Types: Information Disclosure Description: Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r
see other users. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r1a9ae9d1608c9f846875c4191cd738f95543d1be06b52dc1320e8117%40%3Cannounce.guacamole.apache.org%3E
CVE ID: CVE-2020-11998 State: PUBLISHED Published: 2020-09-10T18:10:22 Last Updated: 2024-08-04T11:48:57.796Z Vendors: n/a Products: Apache ActiveMQ Problem Types: Arbitrary code execution via JMX Description: A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In oth
loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13 Additional Analyst Notes: - CVE Program Container: References: - http://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txt - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Cco
q.apache.org%3E - https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-11999 State: PUBLISHED Published: 2020-06-15T19:11:50 Last Updated: 2024-08-04T11:48:57.804Z Vendors: n/a Products: FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software Problem Types: CWE-20 Description: FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 3
ryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to specify a filename to execute unauthorized code and modify files or data. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-163-02
CVE ID: CVE-2020-12000 State: PUBLISHED Published: 2020-06-09T17:54:03 Last Updated: 2024-08-04T11:48:57.852Z Vendors: n/a Products: Ignition 8 Gateway Problem Types: CWE-502 Description: The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-147-01
CVE ID: CVE-2020-12001 State: PUBLISHED Published: 2020-06-15T19:14:18 Last Updated: 2024-08-04T11:48:57.384Z Vendors: n/a Products: FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software Problem Types: CWE-20 Description: FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 3
ryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. The parsing mechanism that processes certain file types does not provide input sanitation. This may allow an attacker to use specially crafted files to traverse the file system and modify or expose sensitive data or execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-163-02 - https://www.zerodayinitiative.com/advisories/ZDI-20-733/
CVE ID: CVE-2020-12002 State: PUBLISHED Published: 2020-05-08T11:50:42 Last Updated: 2024-08-04T11:48:57.668Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-121 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-590/ - https://www.zerodayinitiative.com/advisories/ZDI-20-624/ - https://www.zerodayinitiativ
ive.com/advisories/ZDI-20-590/ - https://www.zerodayinitiative.com/advisories/ZDI-20-624/ - https://www.zerodayinitiative.com/advisories/ZDI-20-625/ - https://www.zerodayinitiative.com/advisories/ZDI-20-619/ - https://www.zerodayinitiative.com/advisories/ZDI-20-634/ - https://www.zerodayinitiative.com/advisories/ZDI-20-633/ - https://www.zerodayinitiative.com/advisories/ZDI-20-592/ - https://www.zerodayinitiative.com/advisories/ZDI-20-591/ - https://www.zerodayinitiative.com/advisories/ZDI-20-622/
CVE ID: CVE-2020-12003 State: PUBLISHED Published: 2020-06-15T19:16:36 Last Updated: 2024-08-04T11:48:58.276Z Vendors: n/a Products: FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software Problem Types: CWE-22 Description: FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 3
ryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to use specially crafted requests to traverse the file system and expose sensitive data on the local hard drive. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-163-02
CVE ID: CVE-2020-12004 State: PUBLISHED Published: 2020-06-09T17:16:04 Last Updated: 2024-08-04T11:48:57.637Z Vendors: n/a Products: Ignition 8 Gateway Problem Types: CWE-306 Description: The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-147-01 - http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html
CVE ID: CVE-2020-12005 State: PUBLISHED Published: 2020-06-15T19:22:59 Last Updated: 2024-08-04T11:48:57.603Z Vendors: n/a Products: FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software Problem Types: CWE-434 Description: FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version
oryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. A vulnerability exists in the communication function that enables users to upload EDS files by FactoryTalk Linx. This may allow an attacker to upload a file with bad compression, consuming all the available CPU resources, leading to a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-163-02
CVE ID: CVE-2020-12006 State: PUBLISHED Published: 2020-05-08T11:41:41 Last Updated: 2024-08-04T11:48:57.582Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-23 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-589/ - https://www.zerodayinitiative.com/advisories/ZDI-20-605/ - https://www.zerodayinitiative.com/advisories/ZDI-20-595/