{"vulnerability": "CVE-2020-2945", "sightings": [{"uuid": "ecdc720e-5cb4-487c-badb-1c1abd206a01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29453", "type": "seen", "source": "https://t.me/cKure/6756", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Pre-Authorization Limited Arbitrary File Read in Jira Server - CVE-2020-29453.\n\nhttps://jira.atlassian.com/browse/JRASERVER-72014", "creation_timestamp": "2021-08-24T16:41:19.000000Z"}, {"uuid": "0a1dfab7-0583-4b51-8268-5ce7c14dbbeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29453", "type": "seen", "source": "https://t.me/cibsecurity/23953", "content": "\u203c CVE-2020-29453 \u203c\n\nThe CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-23T00:33:55.000000Z"}, {"uuid": "f9b4c1b6-2f01-4b46-9f5c-230ed79292df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29457", "type": "seen", "source": "https://t.me/cibsecurity/23682", "content": "\u203c CVE-2020-29457 \u203c\n\nA Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-16T22:48:15.000000Z"}, {"uuid": "d994a43d-9f20-4fbc-9bcc-44b9744f67b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29451", "type": "seen", "source": "https://t.me/cibsecurity/23583", "content": "\u203c CVE-2020-29451 \u203c\n\nAffected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-15T07:46:07.000000Z"}, {"uuid": "b2b415e7-34d0-4623-ae52-41ef14bf8760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29450", "type": "seen", "source": "https://t.me/cibsecurity/22250", "content": "\u203c CVE-2020-29450 \u203c\n\nAffected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-19T07:55:31.000000Z"}, {"uuid": "4d4213da-c4dc-4e1e-982f-394642adff84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20630", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-12T02:25:14.000000Z"}, {"uuid": "c3ec8d49-f718-4177-926a-9b55ab344144", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20538", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-12T00:25:20.000000Z"}, {"uuid": "bf42a118-814c-456b-b378-cda0e8985f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20610", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-12T01:25:08.000000Z"}, {"uuid": "c38c6363-d27c-4df2-bb00-3a525dfe141b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20590", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-12T01:04:58.000000Z"}, {"uuid": "19c85ef8-dfbf-4191-8a1f-221ebf71f55d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20571", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-12T00:45:40.000000Z"}, {"uuid": "8259c6bd-f6ef-4e7d-aa37-d983e7a20dca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20518", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T23:25:21.000000Z"}, {"uuid": "91e3a2f3-9fb5-4b6f-af01-efde4be0fbb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20551", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-12T00:35:46.000000Z"}, {"uuid": "9818f7cd-8032-4507-923e-826a61797abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20498", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T22:54:27.000000Z"}, {"uuid": "58ca2edc-64d6-408b-b20d-59c39fe69045", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29455", "type": "seen", "source": "https://t.me/cibsecurity/20479", "content": "\u203c CVE-2020-29455 \u203c\n\nA cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T22:38:52.000000Z"}, {"uuid": "be6f3229-b10f-4cd0-8c6e-15fdcc127713", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29458", "type": "seen", "source": "https://t.me/cibsecurity/17017", "content": "\u203c CVE-2020-29458 \u203c\n\nTextpattern CMS 4.6.2 allows CSRF via the prefs subsystem.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-02T12:54:48.000000Z"}, {"uuid": "4dc28b67-d0c7-429c-bbde-71f07faa4282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29456", "type": "seen", "source": "https://t.me/cibsecurity/17018", "content": "\u203c CVE-2020-29456 \u203c\n\nMultiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-02T12:54:49.000000Z"}]}