Merge branch 'dashboard' of https://github.com/MostInterestingBotInTheWorld/nuclei-templates into dashboard

cves/2020/CVE-2020-13927.yaml

@@ -1,15 +1,16 @@
 id: CVE-2020-13927
 
 info:
-  name: Unauthenticated Airflow Experimental REST API
+  name: Airflow Experimental <1.10.11 - REST API Auth Bypass
   author: pdteam
   severity: critical
-  description: 'The previous default setting for Airflow''s Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the
-    default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing
-    users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default'
+  description: Airflow's Experimental API prior 1.10.11 allows all API requests without authentication.
+  remediation: From Airflow 1.10.11 forward, the default has been changed to deny all requests by default.  Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide.
   reference:
     - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
     - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
+    - https://airflow.apache.org/docs/1.10.11/security.html#api-authenticatio
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-13927
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -28,3 +29,5 @@ requests:
           - '"dag_id":'
           - '"items":'
         condition: and
+
+# Enhanced by mp on 2022/05/16

cves/2020/CVE-2020-13942.yaml

@@ -1,18 +1,19 @@
 id: CVE-2020-13942
 
 info:
-  name: Apache Unomi Remote Code Execution
+  name: Apache Unomi <1.5.2 - Remote Code Execution
   author: dwisiswant0
   severity: critical
   description: |
-    Remote Code Execution in Apache Unomi.
     Apache Unomi allows conditions to use OGNL and MVEL scripting which
     offers the possibility to call static Java classes from the JDK
     that could execute code with the permission level of the running Java process.
-    This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.
+    This vulnerability affects all versions of Apache Unomi prior to 1.5.2.
+  remediation: Apache Unomi users should upgrade to 1.5.2 or later.
   reference:
     - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
     - https://twitter.com/chybeta/status/1328912309440311297
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-13942
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -61,4 +62,6 @@ requests:
           - "(profile|session)(Id|Properties|Segments)"
           - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
         condition: and
-        part: body
+        part: body
+
+# Enhanced by mp on 2022/05/16