rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-14387 
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.
Problem types: cwe_id: CWE-297
description: CWE-297
Affected products: vendor: n/a
product: rsync
Published: 2021-05-27T19:44:53.000Z
CVE-2020-14388 
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: n/a
product: Red Hat 3scale API Management
Published: 2021-06-02T12:37:55.000Z
CVE-2020-14389 
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
Problem types: cwe_id: CWE-916
description: CWE-916
Affected products: vendor: n/a
product: keycloak
Published: 2020-11-17T00:00:00.000Z
CVE-2020-14390 
A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: kernel
Published: 2020-09-18T17:42:55.000Z
CVE-2020-14391 
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: gnome-settings-daemon
Published: 2021-02-08T22:12:36.000Z
CVE-2020-14392 
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.
Problem types: cwe_id: CWE-822
description: CWE-822
Affected products: vendor: n/a
product: perl-dbi
Published: 2020-09-16T13:00:20.000Z
CVE-2020-14393 
A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data.
Problem types: cwe_id: CWE-121
description: CWE-121 CWE-787
Affected products: vendor: n/a
product: perl-dbi
Published: 2020-09-16T13:27:17.000Z
CVE-2020-14394 
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: n/a
product: QEMU
Published: 2022-08-17T00:00:00.000Z
CVE-2020-14396 
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:13:40.000Z
CVE-2020-14397 
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:13:30.000Z
CVE-2020-14398 
An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:13:21.000Z
CVE-2020-14399 
An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:12:57.000Z
CVE-2020-14400 
An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:12:50.000Z
CVE-2020-14401 
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:12:41.000Z
CVE-2020-14402 
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:12:32.000Z
CVE-2020-14403 
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:12:21.000Z
CVE-2020-14404 
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:11:43.000Z
CVE-2020-14405 
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:11:35.000Z
CVE-2020-14408 
An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T19:21:23.000Z
CVE-2020-14409 
SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-19T00:00:00.000Z
CVE-2020-14410 
SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-19T00:00:00.000Z
CVE-2020-14412 
NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a psw parameter. (This can also be exploited via CSRF.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T16:33:21.000Z
CVE-2020-14413 
NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T16:37:26.000Z
CVE-2020-14414 
NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a pw parameter. (This can also be exploited via CSRF.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T16:41:37.000Z
CVE-2020-14415 
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T15:31:38.000Z
CVE-2020-14416 
In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T10:45:17.000Z
CVE-2020-14418 
A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-30T05:26:59.000Z
CVE-2020-14421 
aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T12:51:09.000Z
CVE-2020-14422 
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T00:00:00.000Z
CVE-2020-14423 
Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting password resets and invitations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T13:27:19.000Z
CVE-2020-14424 
Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T19:48:18.000Z
CVE-2020-14425 
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-02T17:01:34.000Z
CVE-2020-14426 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, RBK842 before 3.2.10.11, RBR840 before 3.2.10.11, and RBS840 before 3.2.10.11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:20:03.000Z
CVE-2020-14427 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:21:05.000Z
CVE-2020-14428 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:21:45.000Z
CVE-2020-14429 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects MK62 before 1.0.4.92, MK63 before 1.0.4.92, MR60 before 1.0.4.92, MS60 before 1.0.4.92, RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBS750 before 3.2.15.25, RBR750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:25:30.000Z
CVE-2020-14430 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:26:18.000Z
CVE-2020-14431 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:26:41.000Z
CVE-2020-14432 
Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:33:29.000Z
CVE-2020-14433 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBK842 before 3.2.15.25, RBR850 before 3.2.15.25, RBS850 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, and RBS750 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:33:53.000Z
CVE-2020-14434 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, RBS850 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, and RBS840 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:34:38.000Z
CVE-2020-14435 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.2.104, SRS60 before 2.5.2.104, SRR60 before 2.5.2.104, SRK60B03 before 2.5.2.104, SRK60B04 before 2.5.2.104, SRK60B05 before 2.5.2.104, and SRK60B06 before 2.5.2.104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:35:24.000Z
CVE-2020-14436 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, RBS850 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, and RBS840 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:35:43.000Z
CVE-2020-14437 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:37:40.000Z
CVE-2020-14438 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:38:07.000Z
CVE-2020-14439 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:38:47.000Z
CVE-2020-14440 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:39:13.000Z
CVE-2020-14441 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:39:36.000Z
CVE-2020-14442 
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T16:40:19.000Z
CVE-2020-14443 
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T17:26:58.000Z
CVE-2020-14444 
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T17:47:51.000Z
CVE-2020-14445 
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T17:47:40.000Z
CVE-2020-14446 
An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T17:47:32.000Z
CVE-2020-14447 
An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:04:19.000Z
CVE-2020-14448 
An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:05:34.000Z
CVE-2020-14449 
An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:07:03.000Z
CVE-2020-14450 
An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:07:52.000Z
CVE-2020-14451 
An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:08:36.000Z
CVE-2020-14452 
An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:09:31.000Z
CVE-2020-14453 
An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:10:05.000Z
CVE-2020-14454 
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:10:48.000Z
CVE-2020-14455 
An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:11:32.000Z