CVE-2020-27958

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://discourse.osc.edu/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198Release Notes, Vendor Advisory
https://github.com/OSC/Open-OnDemand/commits/masterRelease Notes, Third Party Advisory
https://listsprd.osu.edu/pipermail/ood-users/Broken Link, Vendor Advisory
https://discourse.osc.edu/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198Release Notes, Vendor Advisory
https://github.com/OSC/Open-OnDemand/commits/masterRelease Notes, Third Party Advisory
https://listsprd.osu.edu/pipermail/ood-users/Broken Link, Vendor Advisory

Timeline

Published: Feb 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-27968.2Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affect CVE-2020-279697.3Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing CVE-2020-27976.1Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that CVE-2020-279705.3Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar CVE-2020-279746.1NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.CVE-2020-279758.8osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.CVE-2020-279769.8osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the CVE-2020-279777.8CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry va CVE-2020-279787.5Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trig CVE-2020-27987.2Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services). Supported versions that are a CVE-2020-279805.4Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious a CVE-2020-279826.1IceWarp 11.4.5.0 allows XSS via the language parameter.