Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-23282 State: PUBLISHED Published: 2021-07-21T13:13:33 Last Updated: 2024-08-04T14:58:14.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password to connect to the application and get access to unauthorized information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ifmacedo/mconnect/blob/main/SQLinjection - https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/
CVE ID: CVE-2020-23283 State: PUBLISHED Published: 2021-07-21T12:49:49 Last Updated: 2024-08-04T14:58:14.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ifmacedo/mconnect/blob/main/bruteforce - https://www.linkedin.com/pulse/descobrindo-usu%C3%A1rios-brute-force-iran/
CVE ID: CVE-2020-23284 State: PUBLISHED Published: 2021-07-20T19:29:07 Last Updated: 2024-08-04T14:58:14.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that connect into the database which reveals internal and sensitive information without logging into the web application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ifmacedo/mconnect/blob/main/sensitiveDataExposure
CVE ID: CVE-2020-23302 State: PUBLISHED Published: 2021-06-10T22:12:36 Last Updated: 2024-08-04T14:58:14.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3748
CVE ID: CVE-2020-23303 State: PUBLISHED Published: 2021-06-10T22:12:50 Last Updated: 2024-08-04T14:58:14.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3749
CVE ID: CVE-2020-23306 State: PUBLISHED Published: 2021-06-10T22:12:59 Last Updated: 2024-08-04T14:58:14.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3753
CVE ID: CVE-2020-23308 State: PUBLISHED Published: 2021-06-10T22:13:10 Last Updated: 2024-08-04T14:58:14.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3819
CVE ID: CVE-2020-23309 State: PUBLISHED Published: 2021-06-10T22:13:19 Last Updated: 2024-08-04T14:58:14.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3820
CVE ID: CVE-2020-23310 State: PUBLISHED Published: 2021-06-10T22:13:30 Last Updated: 2024-08-04T14:58:14.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3821
CVE ID: CVE-2020-23311 State: PUBLISHED Published: 2021-06-10T22:13:41 Last Updated: 2024-08-04T14:58:14.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3822
CVE ID: CVE-2020-23312 State: PUBLISHED Published: 2021-06-10T22:13:49 Last Updated: 2024-08-04T14:58:14.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3824
CVE ID: CVE-2020-23313 State: PUBLISHED Published: 2021-06-10T22:13:56 Last Updated: 2024-08-04T14:58:14.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3823
CVE ID: CVE-2020-23314 State: PUBLISHED Published: 2021-06-10T22:14:08 Last Updated: 2024-08-04T14:58:14.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3825
CVE ID: CVE-2020-23315 State: PUBLISHED Published: 2022-01-20T21:14:48 Last Updated: 2024-08-04T14:58:14.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microsoft/ChakraCore/issues/6453
CVE ID: CVE-2020-23319 State: PUBLISHED Published: 2021-06-10T22:14:19 Last Updated: 2024-08-04T14:58:14.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion in '(flags >> CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags >> CBC_STACK_ADJUST_SHIFT)) <= context_p->stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3834
CVE ID: CVE-2020-23320 State: PUBLISHED Published: 2021-06-10T22:14:26 Last Updated: 2024-08-04T14:58:14.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3835
CVE ID: CVE-2020-23321 State: PUBLISHED Published: 2021-06-10T22:14:31 Last Updated: 2024-08-04T14:58:14.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3870
CVE ID: CVE-2020-23322 State: PUBLISHED Published: 2021-06-10T22:14:35 Last Updated: 2024-08-04T14:58:14.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion in 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3869
CVE ID: CVE-2020-23323 State: PUBLISHED Published: 2021-06-10T22:14:40 Last Updated: 2024-08-04T14:58:14.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-buffer-overflow at re-parser.c in re_parse_char_escape in JerryScript 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/3871
CVE ID: CVE-2020-23327 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-18T17:08:11.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zblogcn/zblogphp/issues/262
CVE ID: CVE-2020-23330 State: PUBLISHED Published: 2021-08-17T21:27:44 Last Updated: 2024-08-04T14:58:15.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom.cpp. It allows an attacker to cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/511
CVE ID: CVE-2020-23331 State: PUBLISHED Published: 2021-08-17T21:27:47 Last Updated: 2024-08-04T14:58:14.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_DescriptorListWriter::Action component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/509
CVE ID: CVE-2020-23332 State: PUBLISHED Published: 2021-08-17T21:27:47 Last Updated: 2024-08-04T14:58:14.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9. This issue can lead to a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/122.html - https://github.com/axiomatic-systems/Bento4/issues/510
CVE ID: CVE-2020-23333 State: PUBLISHED Published: 2021-08-17T21:27:48 Last Updated: 2024-08-04T14:58:14.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/507
CVE ID: CVE-2020-23334 State: PUBLISHED Published: 2021-08-17T21:27:48 Last Updated: 2024-08-04T14:58:14.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/508
CVE ID: CVE-2020-23341 State: PUBLISHED Published: 2021-08-17T21:45:59 Last Updated: 2024-08-04T14:58:15.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://minhtuanact.github.io/post/reflected-xss-in-atutor-2.2.4/
CVE ID: CVE-2020-23342 State: PUBLISHED Published: 2021-01-19T13:35:04 Last Updated: 2024-08-04T14:58:14.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. Additional Analyst Notes: - CVE Program Container: References: - http://anchorcms.com/ - https://anchorcms.com/ - https://twitter.com/NinadMishra5/status/1350077938176151558 - http://packetstormsecurity.com/files/161048/Anchor-CMS-0.12.7-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-23349 State: PUBLISHED Published: 2022-04-05T15:36:05 Last Updated: 2024-08-04T14:58:14.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be started by the com.sina.weibo.sdk.share.WbShareTransActivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sinaweibosdk/weibo_android_sdk/issues/406
CVE ID: CVE-2020-23352 State: PUBLISHED Published: 2021-01-27T15:25:14 Last Updated: 2024-08-04T14:58:15.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zblogcn/zblogphp/commit/a67607fc984f976d6b36b8870dffaabd9d6c9d5e
CVE ID: CVE-2020-23355 State: PUBLISHED Published: 2021-01-27T15:26:31 Last Updated: 2024-08-04T14:58:14.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully authenticate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Codiad/Codiad/issues/1121
CVE ID: CVE-2020-23356 State: PUBLISHED Published: 2021-01-27T15:27:03 Last Updated: 2024-08-04T14:58:15.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dignajar/nibbleblog/pull/148
CVE ID: CVE-2020-23359 State: PUBLISHED Published: 2021-01-27T15:29:03 Last Updated: 2024-08-04T14:58:14.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/renlok/WeBid/issues/530
CVE ID: CVE-2020-23360 State: PUBLISHED Published: 2021-01-27T15:29:31 Last Updated: 2024-08-04T14:58:15.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/osCommerce/oscommerce2/issues/658
CVE ID: CVE-2020-23361 State: PUBLISHED Published: 2021-01-27T15:30:07 Last Updated: 2024-08-04T14:58:15.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpList/phplist3/issues/668
CVE ID: CVE-2020-23362 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:50:00.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huyiwill/shopcms_lang/issues/1
CVE ID: CVE-2020-23363 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:47:19.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability found in Verytops Verydows all versions that allows an attacker to execute arbitrary code via a crafted script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Verytops/verydows/issues/17
CVE ID: CVE-2020-23369 State: PUBLISHED Published: 2021-05-10T22:14:11 Last Updated: 2024-08-04T14:58:15.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/46
CVE ID: CVE-2020-23370 State: PUBLISHED Published: 2021-05-10T22:14:03 Last Updated: 2024-08-04T14:58:14.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/45
CVE ID: CVE-2020-23371 State: PUBLISHED Published: 2021-05-10T22:13:51 Last Updated: 2024-08-04T14:58:15.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nangge/noneCms/issues/30
CVE ID: CVE-2020-23373 State: PUBLISHED Published: 2021-05-10T22:13:29 Last Updated: 2024-08-04T14:58:15.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nangge/noneCms/issues/33
CVE ID: CVE-2020-23374 State: PUBLISHED Published: 2021-05-10T22:13:06 Last Updated: 2024-08-04T14:58:14.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nangge/noneCms/issues/32
CVE ID: CVE-2020-23376 State: PUBLISHED Published: 2021-05-10T22:12:53 Last Updated: 2024-08-04T14:58:15.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nangge/noneCms/issues/35 - https://cwe.mitre.org/data/definitions/352.html
CVE ID: CVE-2020-23426 State: PUBLISHED Published: 2021-04-08T14:27:47 Last Updated: 2024-08-04T14:58:14.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ling-Yizhou/zzcms-vuln/blob/master/Privilege%20Escalation/priviege%20escalation.md
CVE ID: CVE-2020-23438 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-26T19:35:59.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cvewalkthrough.com/cve-2020-23438-wondershare-filmora-9-2-11-trojan-dll-hijacking-leading-to-privilege-escalation/
CVE ID: CVE-2020-23446 State: PUBLISHED Published: 2020-09-22T13:24:03 Last Updated: 2024-08-04T14:58:15.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API Additional Analyst Notes: - CVE Program Container: References: - http://verint.com - http://cvewalkthrough.com/variant-unauthenticated-information-disclosure-via-api/ - https://tejaspingulkar.blogspot.com/2020/09/cve-2020-23446-verint-workforce.html
CVE ID: CVE-2020-23447 State: PUBLISHED Published: 2021-01-26T17:15:11 Last Updated: 2024-08-04T14:58:15.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle. Users only need to write xss payload in their address information when buying goods, which is triggered when viewing the "View Recipient Information" of this order in "Order Management Office". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/newbee-ltd/newbee-mall/issues/33
CVE ID: CVE-2020-23448 State: PUBLISHED Published: 2021-01-26T17:15:53 Last Updated: 2024-08-04T14:58:15.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system's background /admin is in code AdminLoginInterceptor, which can be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/newbee-ltd/newbee-mall/issues/34
CVE ID: CVE-2020-23449 State: PUBLISHED Published: 2021-01-26T17:16:22 Last Updated: 2024-08-04T14:58:15.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/newbee-ltd/newbee-mall/issues/35
CVE ID: CVE-2020-23450 State: PUBLISHED Published: 2020-09-01T15:10:44 Last Updated: 2024-08-04T14:58:14.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization. Additional Analyst Notes: - CVE Program Container: References: - http://spiceworks.com - https://abuyv.com - https://abuyv.com/cve/spiceworks-stored-xss