Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35933 State: PUBLISHED Published: 2021-01-01T01:24:35 Last Updated: 2024-08-04T17:16:13.434Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/newslett
ameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/newsletter-plugin-vulnerabilities-affect-over-300000-sites/
CVE ID: CVE-2020-35934 State: PUBLISHED Published: 2021-01-01T01:25:05 Last Updated: 2024-08-04T17:16:13.475Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin). Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/high-
t plugin). Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/
CVE ID: CVE-2020-35935 State: PUBLISHED Published: 2021-01-01T01:25:14 Last Updated: 2024-08-04T17:16:13.422Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.) Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access
m Container: References: - https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/
CVE ID: CVE-2020-35936 State: PUBLISHED Published: 2021-01-01T01:25:23 Last Updated: 2024-08-04T17:16:13.449Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-gri
- CVE Program Container: References: - https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins/
CVE ID: CVE-2020-35937 State: PUBLISHED Published: 2021-01-01T01:25:32 Last Updated: 2024-08-04T17:16:13.421Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-gri
CVE ID: CVE-2020-35938 State: PUBLISHED Published: 2021-01-01T01:25:40 Last Updated: 2024-08-04T17:16:13.401Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/10/high-severity-vulnerab
onal Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins/
CVE ID: CVE-2020-35939 State: PUBLISHED Published: 2021-01-01T01:25:47 Last Updated: 2024-08-04T17:16:13.461Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/10/high-severity-vulnerab
CVE ID: CVE-2020-35942 State: PUBLISHED Published: 2021-02-09T17:49:23 Last Updated: 2024-08-04T17:16:13.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.) Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/severe-vulnerabilities-patched-in-nextgen-gallery-affect-over-800000-wordpress-sites/
CVE ID: CVE-2020-35943 State: PUBLISHED Published: 2021-02-09T17:49:27 Last Updated: 2024-08-04T17:16:13.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.) Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/severe-vulnerabilities-patched-in-nextgen-gallery-affect-over-800000-wordpress-sites/
CVE ID: CVE-2020-35944 State: PUBLISHED Published: 2021-01-01T03:28:58 Last Updated: 2024-08-04T17:16:13.446Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/05/high-severity-vulnerabilities-in-pagelayer-plugin-affect-over-200000-wordpress-sites/ - https://wpscan.com/vulnerability/10240
CVE ID: CVE-2020-35945 State: PUBLISHED Published: 2021-01-01T03:28:27 Last Updated: 2024-08-04T17:16:13.484Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/critical-vulnerability-exposes-over-700000-si
VE Program Container: References: - https://www.wordfence.com/blog/2020/08/critical-vulnerability-exposes-over-700000-sites-using-divi-extra-and-divi-builder/ - https://wpscan.com/vulnerability/10342
CVE ID: CVE-2020-35946 State: PUBLISHED Published: 2021-01-01T03:28:09 Last Updated: 2024-08-04T17:16:13.464Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/07/2-million-users-affected-by-vulnerability-in-all-in-one-seo-pack/ - https://wpscan.com/vulnerability/10320
CVE ID: CVE-2020-35947 State: PUBLISHED Published: 2021-01-01T03:27:57 Last Updated: 2024-08-04T17:16:13.919Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur. Ad
e greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/05/high-severity-vulnerabilities-in-pagelayer-plugin-affect-over-200000-wordpress-sites/ - https://wpscan.com/vulnerability/10239
CVE ID: CVE-2020-35948 State: PUBLISHED Published: 2021-01-01T03:27:47 Last Updated: 2024-08-04T17:16:13.477Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump. Additional Analyst Notes: - CVE P
e. Alternatively, an attacker could create an exploit chain to obtain a database dump. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin/ - https://wpscan.com/vulnerability/10412 - http://packetstormsecurity.com/files/163336/WordPress-XCloner-4.2.12-Remote-Code-Execution.html - https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2020-35948
CVE ID: CVE-2020-35949 State: PUBLISHED Published: 2021-01-01T03:27:33 Last Updated: 2024-08-04T17:16:13.464Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wo
er could use text/plain for a .php file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/ - https://wpscan.com/vulnerability/10349
CVE ID: CVE-2020-35950 State: PUBLISHED Published: 2021-01-01T03:27:16 Last Updated: 2024-08-04T17:16:13.468Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin/ - https://wpscan.com/vulnerability/10413
CVE ID: CVE-2020-35951 State: PUBLISHED Published: 2021-01-01T03:27:03 Last Updated: 2024-08-04T17:16:13.461Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files
h allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files). Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/ - https://wpscan.com/vulnerability/10348
CVE ID: CVE-2020-35952 State: PUBLISHED Published: 2021-01-03T03:49:31 Last Updated: 2024-08-04T17:16:13.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPFusion/PHPFusion/issues/2346
CVE ID: CVE-2020-35962 State: PUBLISHED Published: 2021-01-03T06:55:42 Last Updated: 2024-08-04T17:16:13.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum token, lacks access control for fee swapping and thus allows price manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://blocksecteam.medium.com/loopring-lrc-protocol-incident-66e9470bd51f - https://etherscan.io/address/0x4b89f8996892d137c3de1312d1dd4e4f4ffca171
CVE ID: CVE-2020-35963 State: PUBLISHED Published: 2021-01-03T18:15:48 Last Updated: 2024-08-04T17:16:13.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261 - https://fluentbit.io/announcements/v1.6.4/ - https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af
CVE ID: CVE-2020-35964 State: PUBLISHED Published: 2021-01-03T18:57:03 Last Updated: 2024-08-04T17:16:13.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/27a99e2c7d450fef15594671eef4465c8a166bd7 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622 - https://security.gentoo.org/glsa/202105-24
CVE ID: CVE-2020-35965 State: PUBLISHED Published: 2021-01-04T01:07:31 Last Updated: 2024-08-04T17:16:13.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/b0a8b40294ea212c1938348ff112ef1b9bf16bb3 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26532 - https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b - https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html - https://security
457f7f1856d997261e6ac672bba49e8b - https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html - https://security.gentoo.org/glsa/202105-24 - https://www.debian.org/security/2021/dsa-4990
CVE ID: CVE-2020-35970 State: PUBLISHED Published: 2021-06-03T20:55:47 Last Updated: 2024-08-04T17:16:13.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/53
CVE ID: CVE-2020-35971 State: PUBLISHED Published: 2021-06-03T20:55:39 Last Updated: 2024-08-04T17:16:13.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/54
CVE ID: CVE-2020-35972 State: PUBLISHED Published: 2021-06-03T20:55:33 Last Updated: 2024-08-04T17:16:13.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/55
CVE ID: CVE-2020-35973 State: PUBLISHED Published: 2021-06-03T20:55:19 Last Updated: 2024-08-04T17:16:13.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BLL-l/vulnerability_wiki/blob/main/zzcms/user_manage_xss.md
CVE ID: CVE-2020-35979 State: PUBLISHED Published: 2021-04-21T15:05:56 Last Updated: 2024-08-04T17:16:14.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1662 - https://github.com/gpac/gpac/commit/b15020f54aff24aaeb64b80771472be8e64a7adc
CVE ID: CVE-2020-35980 State: PUBLISHED Published: 2021-04-21T00:00:00 Last Updated: 2024-08-04T17:16:13.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1661 - https://github.com/gpac/gpac/commit/5aba27604d957e960d8069d85ccaf868f8a7b07a - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2020-35981 State: PUBLISHED Published: 2021-04-21T15:05:56 Last Updated: 2024-08-04T17:16:13.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1659 - https://github.com/gpac/gpac/commit/dae9900580a8888969481cd72035408091edb11b
CVE ID: CVE-2020-35982 State: PUBLISHED Published: 2021-04-21T15:05:56 Last Updated: 2024-08-04T17:16:13.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1660 - https://github.com/gpac/gpac/commit/a4eb327049132359cae54b59faec9e2f14c5a619
CVE ID: CVE-2020-35984 State: PUBLISHED Published: 2021-07-09T21:55:55 Last Updated: 2024-08-04T17:16:13.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/rukovoditel/issues/4
CVE ID: CVE-2020-35985 State: PUBLISHED Published: 2021-07-09T21:55:54 Last Updated: 2024-08-04T17:16:13.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/rukovoditel/issues/3
CVE ID: CVE-2020-35986 State: PUBLISHED Published: 2021-07-09T21:55:52 Last Updated: 2024-08-04T17:16:13.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/rukovoditel/issues/2
CVE ID: CVE-2020-35987 State: PUBLISHED Published: 2021-07-09T21:55:51 Last Updated: 2024-08-04T17:16:13.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/rukovoditel/issues/1
CVE ID: CVE-2020-35990 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:02:22.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attackers to cause a denial of service (DoS) via crafted .pdf file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxitsoftware.com/support/security-bulletins.php - http://foxit.com
CVE ID: CVE-2020-35992 State: PUBLISHED Published: 2022-08-23T01:02:02 Last Updated: 2024-08-04T17:16:13.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database. Additional Analyst Notes: - CVE Program Contai