Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-17529 State: PUBLISHED Published: 2020-12-09T16:35:14.000Z Last Updated: 2025-02-13T16:27:37.563Z Vendors: Apache Software Foundation Products: Apache NuttX (incubating) Problem Types: CWE-787 Description: Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying and invalid fragmentation offset value specified in the IP header. This is only impacts builds with both CONFIG_EXPERIMENTAL and CONFIG_NET_TCP_REASSEMBLY build flags enabled. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r4d71ae3ab96b589835b94ba7ac4cb
nalyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r4d71ae3ab96b589835b94ba7ac4cb88a704e7307bceefeab749366f3%40%3Cdev.nuttx.apache.org%3E - https://lists.apache.org/thread.html/r4d71ae3ab96b589835b94ba7ac4cb88a704e7307bceefeab749366f3%40%3Cdev.nuttx.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/12/09/5
CVE ID: CVE-2020-17530 State: PUBLISHED Published: 2020-12-11T01:11:04.000Z Last Updated: 2025-10-21T23:35:31.563Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: Remote Code Execution Description: Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwiki.apache.org/confluence/display/WW/S2-061 - http://jvn.jp/en/jp/JVN43969166/index.html - https://www.oracle.com/security-alerts/cpujan2021.html - http://packetstormsecurity.com/files/160721/Apache-Struts-2
l - https://www.oracle.com/security-alerts/cpujan2021.html - http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html - https://security.netapp.com/advisory/ntap-20210115-0005/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - http://www.openwall.com/lists/oss-security/2022/04/12/6 - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-17531 State: PUBLISHED Published: 2020-12-08T00:00:00 Last Updated: 2024-08-04T14:00:48.808Z Vendors: Apache Software Foundation Products: Apache Tapestry Problem Types: CWE-502 Description: A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version. Additional Analy
rable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3E - https://lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3E - https://security.netapp.com/advisory/ntap-20210115-0007/ - http://www.openwall.com/lists/oss-security/2022/12/02/1
CVE ID: CVE-2020-17532 State: PUBLISHED Published: 2021-01-25T09:25:14.000Z Last Updated: 2025-02-13T16:27:38.219Z Vendors: Apache Software Foundation Products: Apache ServiceComb-Java-Chassis Problem Types: CWE-20 Description: When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5 Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2021/q1/60 - https://issues.apache.org/jira/browse/SCB-2145
CVE ID: CVE-2020-17533 State: PUBLISHED Published: 2020-12-29T11:30:13 Last Updated: 2024-08-04T14:00:48.650Z Vendors: Apache Software Foundation Products: Apache Accumulo Problem Types: CWE-252 Description: Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting
lowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3E - https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/12/29/1
CVE ID: CVE-2020-17534 State: PUBLISHED Published: 2021-01-11T15:33:28 Last Updated: 2024-08-04T14:00:49.085Z Vendors: n/a Products: Apache NetBeans HTML/Java API Problem Types: Information Disclosure Description: There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file: https://github.com/apache/netbeans-html4j/commit
temporary directory atomically without dealing with the temporary file: https://github.com/apache/netbeans-html4j/commit/fa70e507e5555e1adb4f6518479fc408a7abd0e6 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra6119c0cdfccf051a846fa11b61364f5df9e7db93c310706a947f86a%40%3Cdev.netbeans.apache.org%3E
CVE ID: CVE-2020-17535 State: REJECTED Published: 2021-01-04T15:32:06 Last Updated: 2021-01-04T15:32:06 Description: No description available.
CVE ID: CVE-2020-17536 State: REJECTED Published: 2021-01-04T15:32:48 Last Updated: 2021-01-04T15:32:48 Description: No description available.
CVE ID: CVE-2020-17537 State: REJECTED Published: 2021-01-04T15:33:27 Last Updated: 2021-01-04T15:33:27 Description: No description available.
CVE ID: CVE-2020-17538 State: PUBLISHED Published: 2020-08-13T02:10:10.000Z Last Updated: 2025-03-24T20:28:54.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=701792 - https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=9f39ed4a92578a020ae10459643e1fe72573d134 - https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html - https:
h=9f39ed4a92578a020ae10459643e1fe72573d134 - https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html - https://www.debian.org/security/2020/dsa-4748 - https://security.gentoo.org/glsa/202008-20 - https://usn.ubuntu.com/4469-1/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/tree/contrib/lips4/gdevlips.c?h=ghostscript-9.18#n148
CVE ID: CVE-2020-17541 State: PUBLISHED Published: 2021-06-01T14:44:41 Last Updated: 2024-08-04T14:00:48.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/121.html - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392
CVE ID: CVE-2020-17542 State: PUBLISHED Published: 2021-04-23T20:23:48 Last Updated: 2024-08-04T14:00:48.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/16890
CVE ID: CVE-2020-17551 State: PUBLISHED Published: 2020-10-07T16:05:28 Last Updated: 2024-08-04T14:00:48.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.impresscms.org/ - https://github.com/ImpressCMS/impresscms/issues/659
CVE ID: CVE-2020-17563 State: PUBLISHED Published: 2021-04-22T21:20:56 Last Updated: 2024-08-04T14:00:48.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id=". Additional Analyst Notes: - CVE Program Container: References: - http://blog.51cto.com/12653365/2328557
CVE ID: CVE-2020-17564 State: PUBLISHED Published: 2021-04-22T21:21:05 Last Updated: 2024-08-04T14:00:49.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component. Additional Analyst Notes: - CVE Program Container: References: - http://blog.51cto.com/12653365/2328557
CVE ID: CVE-2020-17752 State: PUBLISHED Published: 2021-06-24T19:16:56 Last Updated: 2024-08-04T14:00:48.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart contract implemented at address 0xB49E984A83d7A638E7F2889fc8328952BA951AbE, an implementation for MillionCoin (MON). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hellowuzekai/blockchains/blob/master/balance.md - https://etherscan.io/address/0xB49E984A83d7A638E7F2889fc8328952BA951AbE
CVE ID: CVE-2020-17753 State: PUBLISHED Published: 2021-06-24T19:16:31 Last Updated: 2024-08-04T14:00:49.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount of tokens to an arbitrary address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hellowuzekai/blockchains/blob/master/Phishing.md - https://etherscan.io/address/0x5a50C7D96fC68ea2F0bEE06D86CD971c31F85604 - https://etherscan.io/address/0x07c1C8c2BCe6290DAA554118b7d208041615CE54 - https://etherscan.io/address/0x86b784AEF0e9c9A581550bA
etherscan.io/address/0x07c1C8c2BCe6290DAA554118b7d208041615CE54 - https://etherscan.io/address/0x86b784AEF0e9c9A581550bA07fb85B64c780c320 - https://etherscan.io/address/0x403E518F21F5Ce308085Dcf6637758C61f92446A - https://etherscan.io/address/0x340DbA127F099DAB9DC8599C75b16e44D9b02Fdb - https://etherscan.io/address/0xD7aA007C3e7ab454FFE3E20F0b28F926Db295477
CVE ID: CVE-2020-17759 State: PUBLISHED Published: 2021-06-24T19:16:12 Last Updated: 2024-08-04T14:00:48.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941. Additional Analyst Notes: - CVE Program Container: References: - https://evernote.com/intl/zh-cn/security/updates/
CVE ID: CVE-2020-17891 State: PUBLISHED Published: 2021-05-14T19:25:42 Last Updated: 2024-08-04T14:00:48.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sandboxescape/TP-Link-wireless-router-Archer-C1200---Cross-Site-Scripting/
CVE ID: CVE-2020-17901 State: PUBLISHED Published: 2020-11-30T18:22:24 Last Updated: 2024-08-04T14:00:48.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/PbootCMS/blob/master/CSRF.md
CVE ID: CVE-2020-17952 State: PUBLISHED Published: 2021-07-26T19:48:20 Last Updated: 2024-08-04T14:00:48.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twothink/twothink/issues/1
CVE ID: CVE-2020-17999 State: PUBLISHED Published: 2021-04-28T15:23:20 Last Updated: 2024-08-04T14:00:48.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/27
CVE ID: CVE-2020-18013 State: PUBLISHED Published: 2021-07-27T15:02:53 Last Updated: 2024-08-04T14:00:48.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/YangSirrr/opendebug/blob/master/whatsns/Main.md
CVE ID: CVE-2020-18019 State: PUBLISHED Published: 2021-04-28T13:23:00 Last Updated: 2024-08-04T14:00:48.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/si1ence90/xinhu1.8.3_SqlInject
CVE ID: CVE-2020-18020 State: PUBLISHED Published: 2021-04-28T13:22:47 Last Updated: 2024-08-04T14:00:49.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to the "admin.php" component. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/koyshe/phpshe/issues/IQ8S8
CVE ID: CVE-2020-18022 State: PUBLISHED Published: 2021-04-28T15:18:42 Last Updated: 2024-08-04T14:00:49.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hpj233/qibocms/blob/master/v7
CVE ID: CVE-2020-18032 State: PUBLISHED Published: 2021-04-29T17:20:02 Last Updated: 2024-08-04T14:00:48.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/graphviz/graphviz/-/issues/1700 - https://lists.debian.org/debian-lts-announce/2021/05/msg00014.html - https://www.debian.org/security/2021/dsa-4914 - https://lists.fedoraproject.org/archive
announce/2021/05/msg00014.html - https://www.debian.org/security/2021/dsa-4914 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5PQPHJHPU46FK3R5XBP3XDT4X37HMPC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGY2IGARE6RZHTF2UEZEWLMQCDILFK6A/ - https://security.gentoo.org/glsa/202107-04
CVE ID: CVE-2020-18035 State: PUBLISHED Published: 2021-04-29T22:53:25 Last Updated: 2024-08-04T14:00:49.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zchuanzhao/jeesns/issues/8
CVE ID: CVE-2020-18048 State: PUBLISHED Published: 2021-09-02T17:46:59 Last Updated: 2024-08-04T14:00:49.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bertanddip/CraigMS/issues/1 - https://cwe.mitre.org/data/definitions/77.html
CVE ID: CVE-2020-18065 State: PUBLISHED Published: 2021-08-25T19:17:46 Last Updated: 2024-08-04T14:00:49.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PopojiCMS/PopojiCMS/issues/16
CVE ID: CVE-2020-18066 State: PUBLISHED Published: 2021-06-29T17:47:31 Last Updated: 2024-08-04T14:00:49.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/94fzb/zrlog/issues/42
CVE ID: CVE-2020-18070 State: PUBLISHED Published: 2021-04-29T23:28:58 Last Updated: 2024-08-04T14:00:49.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/46
CVE ID: CVE-2020-18077 State: PUBLISHED Published: 2021-12-17T16:13:57 Last Updated: 2024-08-04T14:00:49.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cve-vul/vul/blob/master/FTPShell/FTPShell_Server_6.83_DOS.md
CVE ID: CVE-2020-18078 State: PUBLISHED Published: 2021-12-17T16:13:58 Last Updated: 2024-08-04T14:00:48.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cve-vul/vul/blob/master/SEMCMS/back_password_reset.md
CVE ID: CVE-2020-18081 State: PUBLISHED Published: 2021-12-17T16:15:44 Last Updated: 2024-08-04T14:00:49.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cve-vul/vul/blob/master/SEMCMS/backstage_access_control.md
CVE ID: CVE-2020-18084 State: PUBLISHED Published: 2021-04-30T20:37:38 Last Updated: 2024-08-04T14:00:48.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/9
CVE ID: CVE-2020-18102 State: PUBLISHED Published: 2021-05-10T19:18:24 Last Updated: 2024-08-04T14:00:49.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FantasticLBP/Hotels_Server/issues/3
CVE ID: CVE-2020-18106 State: PUBLISHED Published: 2021-08-27T19:10:31 Last Updated: 2024-08-04T14:00:48.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FeMiner/wms/issues/7
CVE ID: CVE-2020-18114 State: PUBLISHED Published: 2021-08-27T20:30:10 Last Updated: 2024-08-04T14:00:48.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. Additional Analyst Notes: - CVE Program Container: References: - https://blog.csdn.net/qq_36093477/article/details/86681178
CVE ID: CVE-2020-18116 State: PUBLISHED Published: 2021-08-27T20:30:12 Last Updated: 2024-08-04T14:00:49.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.csdn.net/qq_36093477/article/details/98035255
CVE ID: CVE-2020-18121 State: PUBLISHED Published: 2021-08-30T16:04:44 Last Updated: 2024-08-04T14:00:49.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Indexhibit/indexhibit/issues/17
CVE ID: CVE-2020-18123 State: PUBLISHED Published: 2021-08-30T16:04:42 Last Updated: 2024-08-04T14:00:49.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Indexhibit/indexhibit/issues/18
CVE ID: CVE-2020-18124 State: PUBLISHED Published: 2021-08-30T16:04:43 Last Updated: 2024-08-04T14:00:49.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Indexhibit/indexhibit/issues/19