{"vulnerability": "CVE-2020-2947", "sightings": [{"uuid": "a8814aa5-aa4a-44eb-ae32-c056cfc097ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29471", "type": "seen", "source": "https://t.me/arpsyndicate/4832", "content": "#ExploitObserverAlert\n\nCVE-2020-29471\n\nDESCRIPTION: Exploit Observer has 8 entries in 4 file formats related to CVE-2020-29471. OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.\n\nFIRST-EPSS: 0.000910000\nNVD-IS: 2.7\nNVD-ES: 1.7\nARPS-PRIORITY: 0.8643997", "creation_timestamp": "2024-04-24T22:22:34.000000Z"}, {"uuid": "9c23de4d-eb9c-4828-b534-c8ba15dad243", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29470", "type": "seen", "source": "https://t.me/arpsyndicate/4825", "content": "#ExploitObserverAlert\n\nCVE-2020-29470\n\nDESCRIPTION: Exploit Observer has 8 entries in 4 file formats related to CVE-2020-29470. OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.\n\nFIRST-EPSS: 0.000910000\nNVD-IS: 2.7\nNVD-ES: 1.7\nARPS-PRIORITY: 0.8643997", "creation_timestamp": "2024-04-24T21:38:42.000000Z"}, {"uuid": "5541869a-ae96-4aad-839a-ac39cb4d2003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29475", "type": "seen", "source": "https://t.me/cibsecurity/21388", "content": "\u203c CVE-2020-29475 \u203c\n\nnopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-29T18:29:38.000000Z"}, {"uuid": "280c6aa4-8133-4637-9365-ac766e45c958", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29479", "type": "seen", "source": "https://t.me/cibsecurity/20840", "content": "\u203c CVE-2020-29479 \u203c\n\nAn issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root node, because this node has no parent. Unfortunately, permissions were not checked for certain operations on the root node. Unprivileged guests can get and modify permissions, list, and delete the root node. (Deleting the whole xenstore tree is a host-wide denial of service.) Achieving xenstore write access is also possible. All systems using oxenstored are vulnerable. Building and using oxenstored is the default in the upstream Xen distribution, if the Ocaml compiler is available. Systems using C xenstored are not vulnerable.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-15T20:40:34.000000Z"}]}