rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8268 
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
Problem types: cwe_id: CWE-471
description: Modification of Assumed-Immutable Data (MAID) (CWE-471)
Affected products: vendor: n/a
product: json8-merge-patch
Published: 2020-11-09T14:06:21.000Z
CVE-2020-8269 
An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: n/a
product: Citrix Virtual Apps and Desktops
Published: 2020-11-16T00:35:24.000Z
CVE-2020-8270 
An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342
Problem types: cwe_id: CWE-78
description: OS Command Injection (CWE-78)
Affected products: vendor: n/a
product: Citrix Virtual Apps and Desktops
Published: 2020-11-16T00:35:35.000Z
CVE-2020-8271 
Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8
Problem types: cwe_id: CWE-23
description: Relative Path Traversal (CWE-23)
Affected products: vendor: n/a
product: Citrix SD-WAN Center
Published: 2020-11-16T00:32:58.000Z
CVE-2020-8272 
Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Citrix SD-WAN Center
Published: 2020-11-16T00:33:14.000Z
CVE-2020-8273 
Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8.
Problem types: cwe_id: CWE-78
description: OS Command Injection (CWE-78)
Affected products: vendor: n/a
product: Citrix SD-WAN Center
Published: 2020-11-16T00:33:33.000Z
CVE-2020-8274 
Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Citrix Secure Mail for Android
Published: 2021-01-06T20:59:16.000Z
CVE-2020-8275 
Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Citrix Secure Mail for Android
Published: 2021-01-06T20:58:54.000Z
CVE-2020-8276 
The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window.
Problem types: cwe_id: CWE-312
description: Cleartext Storage of Sensitive Information (CWE-312)
Affected products: vendor: n/a
product: https://github.com/brave/brave-core
Published: 2020-11-09T14:05:23.000Z
CVE-2020-8277 
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-11-19T00:32:13.000Z
CVE-2020-8278 
Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Social
Published: 2020-11-19T00:32:35.000Z
CVE-2020-8279 
Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: Nextcloud Social
Published: 2020-11-19T00:32:22.000Z
CVE-2020-8280 
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Contacts
Published: 2021-01-06T20:59:57.000Z
CVE-2020-8281 
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Contacts
Published: 2021-01-06T20:58:09.000Z
CVE-2020-8282 
A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where, due to missing CSRF protections, an attacker would have been able to perform unauthorized remote code execution.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: EdgePower
Published: 2020-12-14T19:41:42.000Z
CVE-2020-8283 
An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: n/a
product: Citrix Virtual Apps and Desktops
Published: 2020-12-14T19:40:18.000Z
CVE-2020-8284 
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2020-12-14T19:38:26.000Z
CVE-2020-8285 
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Problem types: cwe_id: CWE-674
description: Uncontrolled Recursion (CWE-674)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2020-12-14T19:39:04.000Z
CVE-2020-8286 
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2020-12-14T19:39:28.000Z
CVE-2020-8287 
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2021-01-06T00:00:00.000Z
CVE-2020-8288 
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Rocket.Chat server
Published: 2021-01-21T19:13:16.000Z
CVE-2020-8289 
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: Backblaze
Published: 2020-12-27T01:20:50.000Z
CVE-2020-8290 
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: n/a
product: Backblaze
Published: 2020-12-27T01:22:39.000Z
CVE-2020-8291 
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Rocket.Chat server
Published: 2021-10-18T12:48:17.000Z
CVE-2020-8292 
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - DOM (CWE-79)
Affected products: vendor: n/a
product: Rocket.Chat server
Published: 2021-01-21T19:13:28.000Z
CVE-2020-8293 
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2021-01-26T16:33:25.000Z
CVE-2020-8294 
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2021-02-03T16:42:57.000Z
CVE-2020-8295 
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2021-01-26T17:10:36.000Z
CVE-2020-8296 
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
Problem types: cwe_id: CWE-257
description: Storing Passwords in a Recoverable Format (CWE-257)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2021-03-03T17:40:33.000Z
CVE-2020-8297 
Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user.
Problem types: cwe_id: CWE-639
description: Insecure Direct Object Reference (IDOR) (CWE-639)
Affected products: vendor: n/a
product: Nextcloud Deck
Published: 2021-02-23T18:28:59.000Z
CVE-2020-8298 
fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: fs-path
Published: 2021-03-04T19:09:22.000Z
CVE-2020-8299 
Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP Edition
Published: 2021-06-16T13:08:22.000Z
CVE-2020-8300 
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway
Published: 2021-06-16T13:08:16.000Z
CVE-2020-8315 
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T18:35:58.000Z
CVE-2020-8316 
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated privileges.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Lenovo
product: Vantage
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Lenovo thanks T Shiomitsu for reporting this issue.
Published: 2020-04-14T21:05:19.630Z
CVE-2020-8317 
A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Lenovo
product: Drivers Management
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Can Huang and Xinhui Han at Wangxuan Institute of Computer Technology, Peking University for reporting this issue.
Published: 2020-07-24T16:10:25.529Z
CVE-2020-8318 
A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version that could allow an authenticated user to execute code with elevated privileges.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: LenovoSystemUpdatePlugin for Lenovo System Interface Foundation
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Ceri Coburn at Pen Test Partners for reporting this issue.
Published: 2020-04-14T21:05:20.039Z
CVE-2020-8319 
A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to execute code with elevated privileges.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: Lenovo System Interface Foundation
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Ceri Coburn at Pen Test Partners for reporting this issue.
Published: 2020-04-14T21:05:20.446Z
CVE-2020-8320 
An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.
Problem types: cwe_id: CWE-489
description: CWE-489 Leftover Debug Code
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Avery Mosher at SkySafe Inc.
Published: 2020-06-09T19:50:34.958Z
CVE-2020-8321 
A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution.
Problem types: description: Arbitrary code execution
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks yngwei (@yngweijw), driedfish (@d3af1sh), and MengHao, Li of IIE VARAS
Published: 2020-06-09T19:50:35.401Z
CVE-2020-8322 
A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution.
Problem types: description: Arbitrary code execution
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks yngwei (@yngweijw), driedfish (@d3af1sh), and MengHao, Li of IIE VARAS
Published: 2020-06-09T19:50:35.842Z
CVE-2020-8323 
A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow arbitrary code execution.
Problem types: description: Arbitrary code execution
Affected products: vendor: Lenovo
product: BIOS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks yngwei (@yngweijw), driedfish (@d3af1sh), and MengHao, Li of IIE VARAS
Published: 2020-06-09T19:50:36.286Z
CVE-2020-8324 
A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could allow unsigned DLL files to be executed.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Lenovo
product: LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Lenovo thanks Ceri Coburn at Pen Test Partners for reporting this issue.
Published: 2020-04-14T21:05:20.866Z
CVE-2020-8326 
An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Lenovo
product: Drivers Management
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jinwei Chen of Bangcle Security for reporting this issue.
Published: 2020-07-24T16:10:25.935Z
CVE-2020-8327 
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to execute code with elevated privileges.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Lenovo
product: Vantage
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jonas Lykkegård for reporting this issue.
Published: 2020-04-14T21:05:21.274Z
CVE-2020-8329 
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted.
Problem types: description: denial of service
Affected products: vendor: Lenovo
product: Printer LJ4010DN
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Lenovo thanks Xiaoyu He, Erick Bauman, and Linyu Li for reporting these issues.
Published: 2020-05-28T16:10:14.544Z