Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-29069 State: PUBLISHED Published: 2020-11-24T23:32:29 Last Updated: 2024-08-04T16:48:01.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: _get_flag_ip_localdb in server/mhn/ui/utils.py in Modern Honey Network (MHN) through 2020-11-23 allows attackers to cause a denial-of-service via an IP address that is absent from a local geolocation database, because the code tries to uppercase a return value even if that value is not a string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pwnlandia/mhn/issues/799
CVE ID: CVE-2020-29070 State: PUBLISHED Published: 2020-11-25T19:05:11 Last Updated: 2024-08-04T16:48:01.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gburton/CE-Phoenix/commits/master - https://forums.oscommerce.com/forum/17-news-and-announcements/ - https://github.com/aslanemre/cve-2020-29070/blob/main/CVE-2020-29070
CVE ID: CVE-2020-29071 State: PUBLISHED Published: 2020-11-25T02:48:04 Last Updated: 2024-08-04T16:48:01.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user. Additional Analyst Notes: - CVE Program Container: References: - https://lean0x2f.github.io/liquidfiles_advisory - https://man.liquidfile
t Notes: - CVE Program Container: References: - https://lean0x2f.github.io/liquidfiles_advisory - https://man.liquidfiles.com/release_notes/version_3-3-x.html
CVE ID: CVE-2020-29072 State: PUBLISHED Published: 2020-11-25T02:47:47 Last Updated: 2024-08-04T16:48:01.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js. Additional Analyst Notes: - CVE Program Container: References: - https://lean0x2f.github.io/liquidfiles_advisory - https://man.liquidfiles.com/release_notes/version_3-3-x.html
CVE ID: CVE-2020-29074 State: PUBLISHED Published: 2020-11-25T22:06:36 Last Updated: 2024-08-04T16:48:01.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a - https://www.debian.org/security/2020/dsa-4799 - https://lists.debian.org/debian-lts-announce/2020/12/msg00018.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MHVXHZE3YIP4RTWGQ24IDBSW44XPRDOC/ - https://lists
t.org/archives/list/package-announce%40lists.fedoraproject.org/message/MHVXHZE3YIP4RTWGQ24IDBSW44XPRDOC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2FLWSVH32O6JXLRQBYDQLP7XRSTLUPQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZL6NQTNK5PT63D2JX5YVV5OLUL76S5C/
CVE ID: CVE-2020-29075 State: PUBLISHED Published: 2021-02-23T03:18:50.226528Z Last Updated: 2024-09-16T19:26:00.840Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Adobe Products: Acrobat Reader DC Problem Types: CWE-20 Description: Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure vulnerability, that could enable an attacker to get a DNS interaction and track if the user has opened or closed a PDF file when loaded from the filesystem without a prompt. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program
m without a prompt. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb20-75.html
CVE ID: CVE-2020-29127 State: PUBLISHED Published: 2020-11-30T06:30:43 Last Updated: 2024-08-04T16:48:01.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid={XXXXXXXXXX}&csppage=cgi_PgOverview&csplang=en is visited from a different web browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.first.org/members/teams/fujitsu_psirt - http://packetstormsecurity.com/files/160255/Fujitsu-Eternus-Storage-DX200-S4-Broken-Authe
/members/teams/fujitsu_psirt - http://packetstormsecurity.com/files/160255/Fujitsu-Eternus-Storage-DX200-S4-Broken-Authentication.html - https://cxsecurity.com/issue/WLB-2020110215 - https://seccops.com/fujitsu-eternus-storage-dx200-s4-broken-authentication/
CVE ID: CVE-2020-29128 State: PUBLISHED Published: 2020-11-26T05:01:00 Last Updated: 2024-08-04T16:48:01.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: petl before 1.68, in some configurations, allows resolution of entities in an XML document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/petl-developers/petl/pull/527 - https://petl.readthedocs.io/en/stable/changes.html - https://github.com/petl-developers/petl/issues/526 - https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8 - https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8 - https://github.com/petl-developers/petl/security/ad
ers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8 - https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347 - https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md
CVE ID: CVE-2020-29129 State: PUBLISHED Published: 2020-11-26T19:03:55 Last Updated: 2024-08-04T16:48:01.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Additional Analyst Notes: - CVE Program Container: References: - https://lists.freedesktop.org/archives/slirp/2020-November/000115.html - http://www.openwall.com/lists/oss-security/2020/11/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/ - https://lists.fedoraproject.org/archives/li
nounce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-29130 State: PUBLISHED Published: 2020-11-26T00:00:00 Last Updated: 2024-08-04T16:48:01.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Additional Analyst Notes: - CVE Program Container: References: - https://lists.freedesktop.org/archives/slirp/2020-November/000115.html - http://www.openwall.com/lists/oss-security/2020/11/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/OPCOHDEONMHH6QPJZKRLLCNRGRYODG7X/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45S5IHSWYITJKMRT23HCHJQDI674AMTQ/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html - https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html
CVE ID: CVE-2020-29133 State: PUBLISHED Published: 2020-11-27T00:53:12 Last Updated: 2024-08-04T16:48:01.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fa1c0n1/fa1c0n-vim/blob/master/temp/core_tmp.md
CVE ID: CVE-2020-29134 State: PUBLISHED Published: 2021-03-05T15:50:35 Last Updated: 2024-08-04T16:48:01.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lucxssouza/CVE-2020-29134 - https://www.exploit-db.com/exploits/49622 - https://github.com/lucxssouza/CVE-2020-29134/blob/main/README.md - https://systemweakness.com/cve-2020-29134-totvs-fluig-platform-f298ea84b507
CVE ID: CVE-2020-29135 State: PUBLISHED Published: 2020-11-27T01:34:02 Last Updated: 2024-08-04T16:48:01.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/90-change-log/
CVE ID: CVE-2020-29136 State: PUBLISHED Published: 2020-11-27T01:34:24 Last Updated: 2024-08-04T16:48:01.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/90-change-log/ - https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosure/ - https://www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/
CVE ID: CVE-2020-29137 State: PUBLISHED Published: 2020-11-27T01:34:12 Last Updated: 2024-08-04T16:48:01.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/90-change-log/
CVE ID: CVE-2020-29138 State: PUBLISHED Published: 2020-11-27T15:07:58 Last Updated: 2024-08-04T16:48:01.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0, software NET_4.109.0, allows remote unauthenticated users to download the router configuration file via the /backupsettings.conf URI, when any valid session is running. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40alexandrevvo/improper-access-control-in-the-sagemcom-router-model-f-st3486-net-797968e8adc8
CVE ID: CVE-2020-29139 State: PUBLISHED Published: 2021-02-15T20:22:07 Last Updated: 2024-08-04T16:48:01.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads - https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732 - https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035 - https://murat.one/?p=70
CVE ID: CVE-2020-29140 State: PUBLISHED Published: 2021-02-15T20:17:06 Last Updated: 2024-08-04T16:48:01.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads - https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732 - https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035 - ht
r.org/t/openemr-6-0-0-has-been-released/15732 - https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035 - https://murat.one/?p=86
CVE ID: CVE-2020-29142 State: PUBLISHED Published: 2021-02-15T20:00:31 Last Updated: 2024-08-04T16:48:01.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when restrict_user_facility=on is in global settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads - https://murat.one/?p=90 - https://community.open-emr.org/t/openemr-6-0-0-has-been-rele
iki/index.php/OpenEMR_Downloads - https://murat.one/?p=90 - https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732 - https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035
CVE ID: CVE-2020-29143 State: PUBLISHED Published: 2021-02-15T20:27:06 Last Updated: 2024-08-04T16:48:01.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads - https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732 - https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035 - https://murat.one/?p=94
CVE ID: CVE-2020-29144 State: PUBLISHED Published: 2020-11-27T03:35:38 Last Updated: 2024-08-04T16:48:01.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework. Additional Analyst Notes: - CVE Program Container: References: - http://the-it-wonders.blogspot.com/2020/01/ericsson-bscs-ix-r18-billing-rating.html
CVE ID: CVE-2020-29145 State: PUBLISHED Published: 2020-11-27T03:35:21 Last Updated: 2024-08-04T16:48:01.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework. Additional Analyst Notes: - CVE Program Container: References: - http://the-it-wonders.blogspot.com/20
e beef framework. Additional Analyst Notes: - CVE Program Container: References: - http://the-it-wonders.blogspot.com/2020/01/ericsson-bscs-ix-r18-billing-rating.html
CVE ID: CVE-2020-29146 State: PUBLISHED Published: 2021-07-14T16:10:26 Last Updated: 2024-08-04T16:48:01.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header. Additional Analyst Notes: - CVE Program Container: References: - https://lowliness9.me/post/iDACsrRWO/
CVE ID: CVE-2020-29147 State: PUBLISHED Published: 2021-07-14T16:10:29 Last Updated: 2024-08-04T16:48:01.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://lowliness9.me/post/Ma16ZrNDN/
CVE ID: CVE-2020-29156 State: PUBLISHED Published: 2020-12-27T18:47:31 Last Updated: 2024-08-04T16:48:01.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ko-kn3t/CVE-2020-29156 - https://raw.githubusercontent.com/woocommerce/woocommerce/master/changelog.txt
CVE ID: CVE-2020-29157 State: PUBLISHED Published: 2021-07-14T19:59:14 Last Updated: 2024-08-04T16:48:01.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/blackcon/ae155656d21a2228aa25fdcb79c85159 - https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order
CVE ID: CVE-2020-29158 State: PUBLISHED Published: 2020-12-28T07:56:06 Last Updated: 2024-08-04T16:48:01.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2020-23 - https://github.com/zammad/zammad/commit/cf5a5e396058d4b134dd33d0a62b11c1733c98ab
CVE ID: CVE-2020-29159 State: PUBLISHED Published: 2020-12-28T07:55:44 Last Updated: 2024-08-04T16:48:01.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This behvaior was unintended. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2020-22 - https://github.com/zammad/zammad/commit/f0462d4c20c2968b52b5dc6a585f26c0409b4fc4
CVE ID: CVE-2020-29160 State: PUBLISHED Published: 2020-12-28T07:55:27 Last Updated: 2024-08-04T16:48:01.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2020-24 - https://github.com/zammad/zammad/commit/28944de180a88698509a656f61558bf9d7f810f4
CVE ID: CVE-2020-29163 State: PUBLISHED Published: 2021-02-03T12:26:58 Last Updated: 2024-08-04T16:48:01.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d - https://pacsone.net/download.htm
CVE ID: CVE-2020-29164 State: PUBLISHED Published: 2021-02-03T12:27:05 Last Updated: 2024-08-04T16:48:01.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d - https://pacsone.net/download.htm
CVE ID: CVE-2020-29165 State: PUBLISHED Published: 2021-02-03T12:27:11 Last Updated: 2024-08-04T16:48:01.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d - https://pacsone.net/download.htm
CVE ID: CVE-2020-29166 State: PUBLISHED Published: 2021-02-03T12:27:17 Last Updated: 2024-08-04T16:48:01.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d - https://pacsone.net/download.htm
CVE ID: CVE-2020-29168 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-19T14:16:24.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via the q parameter to the getuser.php endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql/%2C - https://projectworlds.in/wp-content/uploads/2020/05/PHP-Doctor-Appointment-System.zip - https://www.exploit-db.com/exploits/49059
CVE ID: CVE-2020-29171 State: PUBLISHED Published: 2021-02-10T14:23:40 Last Updated: 2024-08-04T16:48:01.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin - https://github.com/Arsenal21/all-in-one-wordpress-security/commit/4130906bc049b195467b4fc6980d6d304fbe28d5 - https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#de
/commit/4130906bc049b195467b4fc6980d6d304fbe28d5 - https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers
CVE ID: CVE-2020-29172 State: PUBLISHED Published: 2020-12-26T01:56:28 Last Updated: 2024-08-04T16:48:01.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. Additional Analyst Notes: - CVE Program Container: References: - https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration - https://wordpress.org/plugins/litespeed-cache/#developers
CVE ID: CVE-2020-29176 State: PUBLISHED Published: 2021-12-02T22:21:26 Last Updated: 2024-08-04T16:48:01.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/H9dawn/cve
CVE ID: CVE-2020-29177 State: PUBLISHED Published: 2021-12-02T22:21:27 Last Updated: 2024-08-04T16:48:01.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/H9dawn/cve