rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-13597 Calico nodes IPv6 traffic redirection from route advertisment
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Problem types: cwe_id: CWE-201
description: CWE-201 Information Exposure Through Sent Data
Affected products: vendor: Tigera Inc
product: Calico
vendor: Tigera Inc
product: Calico Enterprise
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-06-03T16:44:38.089Z
CVE-2020-13598 FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat
FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat. Zephyr versions >= v1.14.2, >= v2.3.0 contain Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7fhv-rgxr-x56h
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow (CWE-121)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-05-24T21:40:26.773Z
CVE-2020-13599 Security problem with settings and littlefs
Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5qhg-j6wc-4f6q
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions (CWE-276)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-05-24T21:40:27.423Z
CVE-2020-13600 Malformed SPI in response for eswifi can corrupt kernel memory
Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx4p-j86p-2mhr
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-05-24T21:40:28.051Z
CVE-2020-13601 Possible read out of bounds in dns read
Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-05-24T21:40:28.696Z
CVE-2020-13602 Remote Denial of Service in LwM2M do_write_op_tlv
Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-g9mg-fj58-6fqh
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
cwe_id: CWE-835
description: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2021-05-24T21:40:29.344Z
CVE-2020-13603 Integer Overflow in memory allocating functions
Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94vp-8gc2-rm45
Problem types: cwe_id: CWE-190
description: Integer Overflow or Wraparound (CWE-190)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-05-24T21:40:30.045Z
CVE-2020-13614 
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-26T22:08:39.000Z
CVE-2020-13615 
lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-26T22:08:30.000Z
CVE-2020-13616 
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-26T22:08:18.000Z
CVE-2020-13617 
The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed login attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T18:02:00.000Z
CVE-2020-13619 
php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-01T16:54:07.000Z
CVE-2020-13620 
Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-24T17:12:01.000Z
CVE-2020-13622 
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-26T23:15:14.000Z
CVE-2020-13623 
JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-26T23:15:04.000Z
CVE-2020-13625 
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T16:03:22.000Z
CVE-2020-13626 
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-09T05:02:52.000Z
CVE-2020-13627 
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T15:12:35.000Z
CVE-2020-13628 
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T15:12:39.000Z
CVE-2020-13630 
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T14:42:44.000Z
CVE-2020-13631 
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T14:42:28.000Z
CVE-2020-13632 
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T14:42:17.000Z
CVE-2020-13633 
Fork before 5.8.3 allows XSS via navigation_title or title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T15:04:47.000Z
CVE-2020-13634 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xF1002558
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-29T16:05:59.000Z
CVE-2020-13637 
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T16:34:30.000Z
CVE-2020-13638 
lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-13T19:53:36.000Z
CVE-2020-13639 
A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T03:56:44.000Z
CVE-2020-13640 
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T14:34:05.000Z
CVE-2020-13641 
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T03:11:16.000Z
CVE-2020-13642 
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T03:11:57.000Z
CVE-2020-13643 
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T03:11:48.000Z
CVE-2020-13644 
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T03:11:33.000Z
CVE-2020-13645 
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T11:55:39.000Z
CVE-2020-13646 
In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020f8, 0x830020E0, 0x830020E4, or 0x8300210c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T20:46:04.000Z
CVE-2020-13649 
parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T14:13:59.000Z
CVE-2020-13650 
An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery (SSRF) that allows use of the application as a proxy. Sent to an external server, a forged request discloses application credentials. For a request to an internal component, the request is blind, but through the error message it's possible to determine whether the request targeted a open service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T18:08:00.000Z
CVE-2020-13651 
An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be used to generate the JNLP file used by a client to obtain the right Java application. By providing an attacker-controlled URL, the client will obtain a rogue JNLP file specifying the installation of malicious JAR archives and executed with full privileges on the client computer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T18:07:55.000Z
CVE-2020-13652 
An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200528, 2019R2 before p20200430, and 2020R1 before p20200507. A cross-site scripting (XSS) vulnerability exists in the login menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T18:07:50.000Z
CVE-2020-13653 
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-02T15:15:44.000Z
CVE-2020-13654 
XWiki Platform before 12.8 mishandles escaping in the property displayer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T00:00:00.000Z
CVE-2020-13655 
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:19:03.000Z
CVE-2020-13656 
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write vulnerability that leads to both local and remote code (via RPC) execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-12T22:26:29.000Z
CVE-2020-13657 
An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard links. The vulnerability allows local users to take control of arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T17:51:57.000Z
CVE-2020-13658 
In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T18:52:41.000Z
CVE-2020-13659 
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T12:50:44.000Z
CVE-2020-13660 
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T18:53:25.000Z
CVE-2020-13661 
Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by --utility-and-browser --utility-cmd-prefix= and the pathname of a locally installed program. The victim must interactively choose the Open On Browser option. Fixed in version 5.0.20204.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T18:18:58.000Z
CVE-2020-13662 
Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
Problem types: description: Open Redirect
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-05-05T14:32:03.000Z
CVE-2020-13663 
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
Problem types: description: Cross Site Request Forgery
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-06-11T15:07:25.000Z
CVE-2020-13664 
Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.
Problem types: description: Arbitrary PHP code execution
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-05-05T14:56:39.000Z
CVE-2020-13665 
Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.
Problem types: description: Access bypass
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-05-05T14:14:09.000Z
CVE-2020-13666 
Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Problem types: description: Cross-site scripting
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-05-05T13:50:13.000Z
CVE-2020-13667 
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
Problem types: description: Access bypass
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-05-17T16:52:34.000Z
CVE-2020-13668 Access bypass in Drupal Core 8/9
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Problem types: description: Access Bypass
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:15:14.000Z