Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35713 State: PUBLISHED Published: 2020-12-26T00:47:04 Last Updated: 2024-08-04T17:09:15.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page. Additional Analyst Notes: - CVE Program Container: References: - https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html - https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthent
_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions
CVE ID: CVE-2020-35714 State: PUBLISHED Published: 2020-12-26T00:46:45 Last Updated: 2024-08-04T17:09:15.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program. Additional Analyst Notes: - CVE Program Container: References: - https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html - https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-
rnalReleaseNotes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions
CVE ID: CVE-2020-35715 State: PUBLISHED Published: 2020-12-26T00:46:34 Last Updated: 2024-08-04T17:09:15.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the upload_settings.cgi page. Additional Analyst Notes: - CVE Program Container: References: - https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html - https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unau
Notes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions
CVE ID: CVE-2020-35716 State: PUBLISHED Published: 2020-12-26T00:46:22 Last Updated: 2024-08-04T17:09:15.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a long /goform/langSwitch langSelectionOnly parameter. Additional Analyst Notes: - CVE Program Container: References: - https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html - https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6
lReleaseNotes_RE6500_1.0.012.001.txt - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions
CVE ID: CVE-2020-35717 State: PUBLISHED Published: 2021-01-01T09:15:21 Last Updated: 2024-08-04T17:09:15.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true). Additional Analyst Notes: - CVE Program Container: References: - https://www.electronjs.org/apps/zonote - https://github.com/zonetti/zonote - https://github.com/hmartos/cve-2020-35717 - https://medium.com/bugbountywriteup/remote-code-execution-through-cross-site-scripting-in-electron-f3b891ad637
CVE ID: CVE-2020-35719 State: PUBLISHED Published: 2021-01-11T02:55:15 Last Updated: 2024-08-04T17:09:15.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advi
lnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35720 State: PUBLISHED Published: 2021-01-11T02:55:38 Last Updated: 2024-08-04T17:09:15.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when creating or modifying a user via the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/adviso
erabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35721 State: PUBLISHED Published: 2021-01-11T02:56:08 Last Updated: 2024-08-04T17:09:15.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseAssets.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnera
t-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35722 State: PUBLISHED Published: 2021-01-11T02:56:50 Last Updated: 2024-08-04T17:09:15.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multi
ies-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35723 State: PUBLISHED Published: 2021-01-11T02:57:12 Last Updated: 2024-08-04T17:09:15.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportPreview.do file via the referer parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vuln
uest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35724 State: PUBLISHED Published: 2021-01-11T02:57:43 Last Updated: 2024-08-04T17:09:15.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter (or indirectly via the cpr, tcp, or abs parameter). NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/se
gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35725 State: PUBLISHED Published: 2021-01-11T02:58:08 Last Updated: 2024-11-19T15:08:03.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/a
-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35726 State: PUBLISHED Published: 2021-01-11T02:58:31 Last Updated: 2024-08-04T17:09:15.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/s
4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35727 State: PUBLISHED Published: 2021-01-11T02:58:51 Last Updated: 2024-08-04T17:09:15.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseDirs.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/ad
vulnerabilities-in-quest-policy-authority-for-unified-communications - https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE ID: CVE-2020-35728 State: PUBLISHED Published: 2020-12-27T04:32:36.000Z Last Updated: 2025-08-27T20:33:46.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2999 - https://li
anic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2999 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210129-0007/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-35729 State: PUBLISHED Published: 2020-12-27T04:40:44 Last Updated: 2024-08-04T17:09:15.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md - https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code - http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html - http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html - http://packetstormse
ction.html - http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html - http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html
CVE ID: CVE-2020-35730 State: PUBLISHED Published: 2020-12-28T19:37:08.000Z Last Updated: 2025-10-21T23:35:31.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://roundcube.net/download/ - https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491 - h
github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491 - https://www.alexbirnberg.com/roundcube-xss.html - https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 - https://github.com/roundcube/roundcubemail/releases/tag/1.3.16 - https://github.com/roundcube/roundcubemail/releases/tag/1.2.13 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/
CVE ID: CVE-2020-35733 State: PUBLISHED Published: 2021-01-15T13:35:08 Last Updated: 2024-08-04T17:09:15.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority. Additional Analyst Notes: - CVE Program Container: References: - https://www.erlang.org/news - https://www.erlang.org/downloads - https://github.com/erlang/otp/releases - https://erlang.org/pipermail/erlang-questions/2021-January/100357.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4CXZWUOZELT7A5
.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4CXZWUOZELT7A5ZN6DJRQHX7L35V4PW/
CVE ID: CVE-2020-35734 State: PUBLISHED Published: 2021-02-15T20:49:31 Last Updated: 2024-08-04T17:09:15.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://batflat.org/en/changelog - https://secator.pl/index
ISA ADP Vulnrichment: - CVE Program Container: References: - https://batflat.org/en/changelog - https://secator.pl/index.php/2021/02/15/batflat-v-1-3-6-authenticated-remote-code-execution-public-disclosure/ - https://github.com/sruupl/batflat/issues/98 - http://packetstormsecurity.com/files/161457/Batflat-CMS-1.3.6-Remote-Code-Execution.html
CVE ID: CVE-2020-35735 State: PUBLISHED Published: 2020-12-29T18:05:24 Last Updated: 2024-08-04T17:09:15.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vidyo 02-09-/D allows clickjacking via the portal/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://blog.vidyo.com/category/product-updates/ - https://github.com/italoantunes/CVE
CVE ID: CVE-2020-35736 State: PUBLISHED Published: 2020-12-27T19:07:12 Last Updated: 2024-08-04T17:09:15.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liftoff/GateOne/issues/747 - https://rmb122.com/2019/08/28/Ogeek-Easy-Realworld-Challenge-1-2-Writeup/
CVE ID: CVE-2020-35737 State: PUBLISHED Published: 2020-12-30T19:39:17 Last Updated: 2024-08-04T17:09:15.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486 - http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html - https://www.exploit-db.com/exploits/49378
CVE ID: CVE-2020-35738 State: PUBLISHED Published: 2020-12-28T03:54:10 Last Updated: 2024-08-04T17:09:15.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/91 - https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2YZLKYE66E
00013.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2YZLKYE66EU4XRHTABV5LB2G7ZDZ422F/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PENN4ZXRPZULEJOYTTLUZMBZ5H46QTUC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76B7K6F74FDQATG7FECXR5KPIG52O2VL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VDFY4NGGDUTLVID5PNVU7LL2G2ZJLZFY/
CVE ID: CVE-2020-35740 State: PUBLISHED Published: 2020-12-31T07:45:49.988226Z Last Updated: 2024-09-16T23:36:40.227Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: HGiga Products: MailSherlock MSR45/SSR45 Problem Types: CWE-79 Description: HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html
CVE ID: CVE-2020-35741 State: PUBLISHED Published: 2020-12-31T07:45:50.593744Z Last Updated: 2024-09-16T22:55:57.902Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: HGiga Products: MailSherlock MSR45/SSR45 Problem Types: CWE-79 Description: HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html
CVE ID: CVE-2020-35742 State: PUBLISHED Published: 2020-12-31T07:45:51.201796Z Last Updated: 2024-09-16T18:03:00.267Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: HGiga Products: MailSherlock MSR45/SSR45 Problem Types: CWE-89 Description: HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html
CVE ID: CVE-2020-35743 State: PUBLISHED Published: 2020-12-31T07:45:51.808995Z Last Updated: 2024-09-17T02:37:09.672Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: HGiga Products: MailSherlock MSR45/SSR45 Problem Types: CWE-89 Description: HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html
CVE ID: CVE-2020-35745 State: PUBLISHED Published: 2021-01-07T20:29:14 Last Updated: 2024-08-04T17:09:15.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpgurukul.com/hospital-management-system-in-php/ - https://medium.com/%40ashketchum/privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0 - https://www.youtube.com/watch?
privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0 - https://www.youtube.com/watch?v=vnSsg6iwV9Y&feature=youtu.be&ab_channel=ashketchum
CVE ID: CVE-2020-35748 State: PUBLISHED Published: 2021-01-15T16:50:42 Last Updated: 2024-08-04T17:09:15.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/arkango/ - https://docs.google.com/document/d/1xUTEmWqfy3u3KBSTjxCAGe3gIF15awFmzgCXrKfVl2U/edit?usp=sharing