rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-24648 
A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: accessmgrservlet classname deserialization of untrusted data remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:36:07.000Z
CVE-2020-24649 
A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: remote bytemessageresource transformentity" input validation code execution vulnerability
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:36:13.000Z
CVE-2020-24650 
A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: legend expression language injection remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:36:19.000Z
CVE-2020-24651 
A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: syslogtempletselectwin expression language injection remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:36:26.000Z
CVE-2020-24652 
A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: addvsiinterfaceinfo expression language injection remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:36:33.000Z
CVE-2020-24653 
secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T04:04:26.000Z
CVE-2020-24654 
In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:22:10.000Z
CVE-2020-24655 
A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices (effectively bypassing the PIN requirement).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-10T01:32:44.000Z
CVE-2020-24656 
Maltego before 4.2.12 allows XXE attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T04:27:53.000Z
CVE-2020-24658 
Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays. When this feature is enabled, a protected function writes a guard value to the stack prior to (above) any vulnerable arrays in the stack. The guard value is checked for corruption on function return; corruption leads to an error-handler call. In certain circumstances, the reference value that is compared against the guard value is itself also written to the stack (after any vulnerable arrays). The reference value is written to the stack when the function runs out of registers to use for other temporary data. If both the reference value and the guard value are written to the stack, then the stack protection will fail to spot corruption when both values are overwritten with the same value. For both the reference value and the guard value to be corrupted, there would need to be both a buffer overflow and a buffer underflow in the vulnerable arrays (or some other vulnerability that causes two separated stack entries to be corrupted).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T17:21:20.000Z
CVE-2020-24659 
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-04T14:03:36.000Z
CVE-2020-24660 
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-14T12:51:48.000Z
CVE-2020-24661 
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T15:06:03.000Z
CVE-2020-24662 
SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS. This was fixed in TLM RP 3.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T14:22:30.000Z
CVE-2020-24663 
Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T15:11:41.000Z
CVE-2020-24664 
The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T18:56:43.000Z
CVE-2020-24665 
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, >= 8.3.0.0 GA
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T18:41:03.000Z
CVE-2020-24666 
The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in >= 9.1.0.1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T19:00:06.000Z
CVE-2020-24667 
Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T15:22:08.000Z
CVE-2020-24668 
Trace Financial Crest Bridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T15:09:01.000Z
CVE-2020-24669 
The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T18:46:36.000Z
CVE-2020-24670 
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T18:50:44.000Z
CVE-2020-24671 
Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T15:17:03.000Z
CVE-2020-24672 ABB Base Software for SoftControl Remote Code Execution vulnerability
A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue affects: .
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: ABB
product: Base Software for SoftControl
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-08T15:03:55.810Z
CVE-2020-24673 SQL Injection in Symphony Plus
In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:21:10.907Z
CVE-2020-24674 Improper Authorization in Symphony Plus
In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:20:16.269Z
CVE-2020-24675 Weak Authentication in Symphony Plus
In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History server) and ultimately write values to the controlled process.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:22:05.808Z
CVE-2020-24676 Insecure Windows Services in Symphony Plus
In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and result in privilege escalation, depending on the user that the service runs as.
Problem types: cwe_id: CWE-274
description: CWE-274 Improper Handling of Insufficient Privileges
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:15:22.929Z
CVE-2020-24677 Insecure Web Service in Symphony Plus
Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:16:37.411Z
CVE-2020-24678 Potential Privilege Escalation in Symphony Plus
An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:13:13.833Z
CVE-2020-24679 Denial of Service attack on Symphony Plus
A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-12-22T21:17:12.753Z
CVE-2020-24680 Improper Credential Storage in Symphony Plus
In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.
Problem types: cwe_id: CWE-255
description: CWE-255 Credentials Management
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
vendor: ABB
product: ABB Ability™ Symphony® Plus Historian
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:18:37.038Z
CVE-2020-24681 Automation Studio and PVI Multiple incorrect permission assignments for services
Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affects Automation Studio: from 4.6.0 through 4.6.X, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP.


Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: B&R Industrial Automation
product: Automation Studio
default_status: unaffected
vendor: B&R Industrial Automation
product: NET/PVI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: B&R would like to thank the following for working with us to help protect our customers: Mr. Andrew Hofmans
Published: 2024-02-02T06:58:24.173Z
CVE-2020-24682 Automation Studio and PVI Multiple unquoted service path vulnerabilities
Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4.


Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: B&R Industrial Automation
product: Automation Studio
default_status: unaffected
vendor: B&R Industrial Automation
product: NET/PVI
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: B&R would like to thank the following for working with us to help protect our customers: Mr. Andrew Hofmans
Published: 2024-02-02T07:11:44.086Z
CVE-2020-24683 Authentication Bypass in Symphony Plus
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: ABB
product: ABB Ability™ Symphony® Plus Operations
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-12-22T21:19:10.709Z
CVE-2020-24685 AC500 V2 unauthenticated crafter packet vulnerability
An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions.
Problem types: description: An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application.
cwe_id: CWE-789
description: CWE-789 Memory Allocation with Excessive Size Value
Affected products: vendor: ABB
product: AC500 V2 products with onboard Ethernet
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2021-02-09T03:57:16.000Z
CVE-2020-24686 AC500 V2 webserver denial of service vulnerability
The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibility of the PLC state. If a user attempts to login to the PLC while this vulnerability is exploited, the PLC will show an error state and refuse connections to Automation Builder. The execution of the PLC application is not affected by this vulnerability. This issue affects ABB AC500 V2 products with onboard Ethernet.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: ABB
product: AC500 V2 products with onboard Ethernet
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-02-26T15:10:58.000Z
CVE-2020-24692 
The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:43:12.000Z
CVE-2020-24693 
The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T07:08:35.000Z
CVE-2020-24696 
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:21:46.000Z