rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7062 Null Pointer Dereference in PHP Session Upload Progress
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Reported by ryat@php.net
Published: 2020-02-27T20:25:15.153Z
CVE-2020-7063 Files added to tar with Phar::buildFromIterator have all-access permissions
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
Problem types: cwe_id: CWE-281
description: CWE-281 Improper Preservation of Permissions
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Reported by dr at loopia dot rs
Published: 2020-02-27T20:25:15.606Z
CVE-2020-7064 Use-of-uninitialized-value in exif
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: From https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19581
Published: 2020-04-01T03:35:13.144Z
CVE-2020-7065 mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: anatoly dot trosinenko at gmail dot com
Published: 2020-04-01T03:35:13.554Z
CVE-2020-7066 get_headers() silently truncates after a null byte
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.
Problem types: cwe_id: CWE-170
description: CWE-170 Improper Null Termination
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: 64796c6e69 at gmail dot com
Published: 2020-04-01T03:35:14.021Z
CVE-2020-7067 OOB Read in urldecode()
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-196
description: CWE-196 Unsigned to Signed Conversion Error
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: bigshaq at wearehackerone dot com
Published: 2020-04-27T20:38:39.634Z
CVE-2020-7068 Use of freed hash key in the phar_parse_zipfile function
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: grigoritchy at gmail dot com
Published: 2020-09-09T17:58:42.837Z
CVE-2020-7069 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Reported by bizxing at web dot de
Published: 2020-10-02T14:14:45.340Z
CVE-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Reported by fletchto99 at gmail dot com
Published: 2020-10-02T14:14:45.406Z
CVE-2020-7071 FILTER_VALIDATE_URL accepts URLs with invalid userinfo
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Reported by  jifan dot jf at alibaba-inc dot com
Published: 2021-02-15T04:10:16.239Z
CVE-2020-7079 
An improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0 may lead to code execution through maliciously crafted DLL files.
Problem types: description: Improper signature validation vulnerability
Affected products: vendor: n/a
product: Autodesk Dynamo BIM
Published: 2020-04-17T17:54:37.000Z
CVE-2020-7080 
A buffer overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitrary code execution on a system running it.
Problem types: description: Buffer Overflow vulnerability
Affected products: vendor: n/a
product: Autodesk FBX-SDK
Published: 2020-04-17T17:52:17.000Z
CVE-2020-7081 
A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it.
Problem types: description: Type confusion vulnerability
Affected products: vendor: n/a
product: Autodesk FBX-SDK
Published: 2020-04-17T17:52:36.000Z
CVE-2020-7082 
A use-after-free vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to code execution on a system running it.
Problem types: description: Use-After-Free vulnerability
Affected products: vendor: n/a
product: Autodesk FBX-SDK
Published: 2020-04-17T17:52:49.000Z
CVE-2020-7083 
An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.
Problem types: description: Integer overflow vulnerability
Affected products: vendor: n/a
product: Autodesk FBX-SDK
Published: 2020-04-17T17:53:07.000Z
CVE-2020-7084 
A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.
Problem types: description: NULL pointer dereference vulnerability
Affected products: vendor: n/a
product: Autodesk FBX-SDK
Published: 2020-04-17T17:53:26.000Z
CVE-2020-7085 
A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution on a system running it.
Problem types: description: Heap overflow vulnerability
Affected products: vendor: n/a
product: Autodesk FBX-SDK
Published: 2020-04-17T17:53:49.000Z
CVE-2020-7104 
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-17T22:10:48.000Z
CVE-2020-7105 
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-16T03:36:35.000Z
CVE-2020-7106 
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-16T03:55:12.000Z
CVE-2020-7107 
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-16T04:01:50.000Z
CVE-2020-7108 
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-16T04:07:16.000Z
CVE-2020-7109 
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T16:08:57.000Z
CVE-2020-7110 
ClearPass is vulnerable to Stored Cross Site Scripting by allowing a malicious administrator, or a compromised administrator account, to save malicious scripts within ClearPass that could be executed resulting in a privilege escalation attack. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
Problem types: description: persisted cross site scripting
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-04-16T16:14:49.000Z
CVE-2020-7111 
A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
Problem types: description: server side injection leading to remote code execution
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-04-16T16:14:16.000Z
CVE-2020-7113 
A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher.
Problem types: description: interception and modification of http packets
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-04-16T16:14:37.000Z
CVE-2020-7114 
A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in ClearPass by crafting HTTP packets. As a result of this attack, a possible complete cluster compromise might occur. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
Problem types: description: network database compromise
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-04-16T16:14:06.000Z
CVE-2020-7115 
The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
Problem types: description: Unauthenticated Remote Command Execution in the Web Interface
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-06-03T12:43:13.000Z
CVE-2020-7116 
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
Problem types: description: Authenticated Remote Command Execution
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-06-03T12:51:07.000Z
CVE-2020-7117 
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
Problem types: description: Authenticated Remote Command Execution
Affected products: vendor: n/a
product: ClearPass Policy Manager
Published: 2020-06-03T12:49:47.000Z
CVE-2020-7119 
A vulnerability exists in the Aruba Analytics and Location Engine (ALE) web management interface 2.1.0.2 and earlier firmware that allows an already authenticated administrative user to arbitrarily modify files as an underlying privileged operating system user.
Problem types: description: Remote Arbitrary File Modification
Affected products: vendor: n/a
product: Aruba ALE ClearPass C1000 S-1200 R4 HW-Based Appliance
Published: 2020-09-04T12:01:08.000Z
CVE-2020-7120 
A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users to cause a buffer overflow condition. A successful exploit could allow a local attacker to execute arbitrary code within the context the binary is running in, which is a lower privileged account.
Problem types: description: Local Authenticated Buffer Overflow in Clearpass Onguard
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-02-23T18:08:36.000Z
CVE-2020-7121 
Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. Successful exploitation of these vulnerabilities could result in Local Denial of Service of the LLDP (Link Layer Discovery Protocol) process in the switch. This applies to firmware versions prior to 10.04.3021.
Problem types: description: Multiple Memory Corruption Vulnerabilities in the LLDP Implementation
Affected products: vendor: n/a
product: Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and 8400
Published: 2020-09-23T12:36:57.000Z
CVE-2020-7122 
Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. Successful exploitation of these vulnerabilities could result in Local Denial of Service of the CDP (Cisco Discovery Protocol) process in the switch. This applies to firmware versions prior to 10.04.1000.
Problem types: description: Multiple Memory Corruption Vulnerabilities in the CDP Implementation
Affected products: vendor: n/a
product: Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and 8400
Published: 2020-09-23T12:35:21.000Z
CVE-2020-7123 
A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
Problem types: description: local escalation of privilege
Affected products: vendor: n/a
product: Aruba ClearPass Policy Manager
Published: 2021-04-28T14:04:33.000Z
CVE-2020-7124 
A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote unauthorized access
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-10-26T15:23:31.000Z
CVE-2020-7125 
A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote escalation of privilege
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-10-26T15:23:51.000Z
CVE-2020-7126 
A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote server-side request forgery (ssrf)
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-10-26T15:24:20.000Z
CVE-2020-7127 
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote unauthenticated arbitrary code execution
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-10-26T15:28:17.000Z
CVE-2020-7128 
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote unauthenticated arbitrary code execution
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-11-04T19:21:02.000Z
CVE-2020-7129 
A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote execution of arbitrary commands
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-11-04T19:20:57.000Z
CVE-2020-7130 
HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. HPE OneView Global Dashboard - After Upgrade or Install of OVGD Version 1.9, Appliance Firewall May Leave Ports Open. This is resolved in OVGD 1.91 or later.
Problem types: description: Remote disclosure of information
Affected products: vendor: n/a
product: HPE OneView Global Dashboard
Published: 2020-03-04T20:21:40.000Z
CVE-2020-7131 
This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. All J/H-series NonStop systems have a security vulnerability associated with an open UDP port 17185 on the Maintenance LAN which could result in information disclosure, denial-of-service attacks or local memory corruption against the affected system and a complete control of the system may also be possible. This vulnerability exists only if one gains access to the Maintenance LAN to which Blade Maintenance Entity, Integrated Maintenance Entity or Maintenance Entity product is connected. **Workaround:** Block the UDP port 17185(In the Maintenance LAN Network Switch/Firewall). Fix: Install following SPRs, which are already available: * T1805A01^AAI (Integrated Maintenance Entity) * T4805A01^AAZ (Blade Maintenance Entity). These SPRs are also usable with the following RVUs: * J06.19.00 ? J06.23.01. No fix planned for the following RVUs: J06.04.00 ? J06.18.01. No fix planned for H-Series NonStop systems. No fix planned for the product T2805 (Maintenance Entity).
Problem types: description: remote denial of service (dos); remote disclosure of information; remote local memory corruption
Affected products: vendor: n/a
product: Integrated Maintenance Entity T1805; Maintenance Entity T2805; Blade Maintenance Entity FW T4805
Published: 2020-04-24T17:48:59.000Z
CVE-2020-7132 
A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE Onboard Administrator. * OA 4.95 (Linux and Windows).
Problem types: description: remote cross-site scripting (xss)
Affected products: vendor: n/a
product: HPE Onboard Administrator
Published: 2020-04-23T17:47:51.000Z
CVE-2020-7133 
A unauthorized remote access vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.
Problem types: description: unauthorized remote access
Affected products: vendor: n/a
product: HPE IOT + GCP
Published: 2020-04-24T18:36:56.000Z
CVE-2020-7134 
A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.
Problem types: description: remote  access to sensitive data
Affected products: vendor: n/a
product: HPE IOT + GCP
Published: 2020-04-24T18:37:53.000Z