Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-24769 State: PUBLISHED Published: 2022-03-30T01:39:33 Last Updated: 2024-08-04T15:19:09.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/burpheart/CVE/2020-08-13-01.md - https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/ - https://github.com/burpheart/CVE/blob/master/2020-08-13-01.md
CVE ID: CVE-2020-24770 State: PUBLISHED Published: 2022-03-30T01:39:17 Last Updated: 2024-08-04T15:19:09.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/burpheart/CVE/2020-08-13-02.md - https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/ - https://github.com/burpheart/CVE/blob/master/2020-08-13-02.md
CVE ID: CVE-2020-24771 State: PUBLISHED Published: 2022-03-30T01:39:14 Last Updated: 2024-08-04T15:19:09.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/burpheart/CVE/blob/master/2020-08-13-03.md - https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/ - https://cwe.mitre.org/data/definitions/306.html
CVE ID: CVE-2020-24772 State: PUBLISHED Published: 2022-03-21T14:48:27 Last Updated: 2024-08-04T15:19:09.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dreamacro/clash/issues/910
CVE ID: CVE-2020-24786 State: PUBLISHED Published: 2020-08-31T14:02:05 Last Updated: 2024-08-04T15:19:09.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely acces
fore build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/data-security/release-notes.html - https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-security-advisory-regarding-unauthenticated-product-integration-vulnerability - https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 - https://pitstop.
integration-vulnerability - https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 - https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements - https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-security-plus-security-advisory-regarding-unauthenticated-product-integration-vulnerability - https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability - https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-18-5-2020 - https://www.manageengine.com/pr
-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-18-5-2020 - https://www.manageengine.com/products/eventlog/features-new.html - https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-15-5-2020-1 - https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-18-5-2020 - https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability - https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17
//pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020
CVE ID: CVE-2020-24791 State: PUBLISHED Published: 2021-03-10T13:37:28 Last Updated: 2024-08-04T15:19:09.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/561 - https://github.com/leerina/vulnerability/blob/master/Fuel%20CMS%201.4.8%20SQLi%20vulnerability.txt - https://www.exploit-db.com/exploits/48778
CVE ID: CVE-2020-24794 State: PUBLISHED Published: 2020-09-09T14:52:21 Last Updated: 2024-08-04T15:19:09.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75. Additional Analyst Notes: - CVE Program Container: References: - https://devnet.kentico.com/download/hotfixes
CVE ID: CVE-2020-24804 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T20:10:14.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cms-dev/cms/issues/1160
CVE ID: CVE-2020-24807 State: PUBLISHED Published: 2020-10-06T17:10:17 Last Updated: 2024-08-04T15:19:09.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/socket.io-file - https://github.com/rico345100/socket.io-file - https://www.npmjs.com/advisories/1564 - https://github.c
socket.io-file - https://github.com/rico345100/socket.io-file - https://www.npmjs.com/advisories/1564 - https://github.com/advisories/GHSA-6495-8jvh-f28x
CVE ID: CVE-2020-24815 State: PUBLISHED Published: 2020-11-24T16:48:58 Last Updated: 2024-08-04T15:19:09.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020. Additional Analyst Notes: - CVE Program Container: References: - http://microstrategy.com - https://triskelelabs.com/extracting-your
nalyst Notes: - CVE Program Container: References: - http://microstrategy.com - https://triskelelabs.com/extracting-your-aws-access-keys-through-a-pdf-file/ - https://community.microstrategy.com/s/article/Securing-PDF-and-Excel-Export-with-Whitelists?language=en_US
CVE ID: CVE-2020-24821 State: PUBLISHED Published: 2021-08-04T14:52:24 Last Updated: 2024-08-04T15:19:09.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/52 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfcursorskip_form-at-dwarfcursorcc191
CVE ID: CVE-2020-24822 State: PUBLISHED Published: 2021-08-04T14:52:25 Last Updated: 2024-08-04T15:19:09.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/50 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfcursoruleb128-at-dwarfinternalhh154
CVE ID: CVE-2020-24823 State: PUBLISHED Published: 2021-08-04T14:52:26 Last Updated: 2024-08-04T15:19:09.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/51 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfto_string-at-dwarfvaluecc300
CVE ID: CVE-2020-24824 State: PUBLISHED Published: 2021-08-04T14:52:28 Last Updated: 2024-08-04T15:19:09.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: A global buffer overflow issue in the dwarf::line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/48 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#global-buffer-overflow-in-function-dwarfline_tableline_table-at-dwarflinecc107
CVE ID: CVE-2020-24825 State: PUBLISHED Published: 2021-08-04T14:52:29 Last Updated: 2024-08-04T15:19:09.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/46 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-line_tableline_table-at-dwarflinecc104
CVE ID: CVE-2020-24826 State: PUBLISHED Published: 2021-08-04T14:52:30 Last Updated: 2024-08-04T15:19:09.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/49 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-elfsectionas_strtab-at-elfelfcc284
CVE ID: CVE-2020-24827 State: PUBLISHED Published: 2021-08-04T14:52:31 Last Updated: 2024-08-04T15:19:09.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aclements/libelfin/issues/47 - https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfcursorskip_form-at-dwarfcursorcc181
CVE ID: CVE-2020-24829 State: PUBLISHED Published: 2021-08-04T20:02:38.000Z Last Updated: 2025-03-05T22:52:44.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1422 - https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2 - https://github.com/gpac/gpac/blob/v0.5.2/src/media_tools/mpegts.c#L2204
CVE ID: CVE-2020-24837 State: PUBLISHED Published: 2021-02-10T15:40:21 Last Updated: 2024-08-04T15:19:09.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function. Additional Analyst Notes: - CVE Program Container: References: - https://etherscan.io/address/0x9d79c6e2a0222b9ac7bfabc447209c58fe9e0dcc#code
CVE ID: CVE-2020-24838 State: PUBLISHED Published: 2021-02-10T15:40:34 Last Updated: 2024-08-04T15:19:09.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow. Additional Analyst Notes: - CVE Program Container: References: - https://etherscan.io/address/0xecaad8df0dee0b9ed45ffd1191b024701f21506c#code
CVE ID: CVE-2020-24841 State: PUBLISHED Published: 2021-02-16T12:25:39 Last Updated: 2024-08-04T15:19:09.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Additional Analyst Notes: - CVE Program Container: References: - http://sdg.com - https://www.exploit-db.com/exploits/48757
CVE ID: CVE-2020-24842 State: PUBLISHED Published: 2021-02-10T21:59:27 Last Updated: 2024-08-04T15:19:09.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-288-01
CVE ID: CVE-2020-24847 State: PUBLISHED Published: 2020-10-23T18:17:12 Last Updated: 2024-08-04T15:19:09.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xtr4nge/FruityWifi/issues/277
CVE ID: CVE-2020-24848 State: PUBLISHED Published: 2020-10-23T18:22:49 Last Updated: 2024-08-04T15:19:09.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xtr4nge/FruityWifi/issues/278 - https://gist.github.com/harsh-bothra/5be73cfd53f1c5bea307c702ae83ff42
CVE ID: CVE-2020-24849 State: PUBLISHED Published: 2020-11-05T14:19:40 Last Updated: 2024-08-04T15:19:09.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317. Additional Analyst Notes: - CVE Program Container: References: - http://fruitywifi.com/index_eng.html - https://github.com/xtr4nge/FruityWifi - https://gist.github.com/harsh-bothra/f899045b16bbba264628d79d52c07c22
CVE ID: CVE-2020-24855 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-05-12T14:18:03.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/easy-team/easywebpack-cli/issues/25
CVE ID: CVE-2020-24857 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-26T15:32:46.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerabilty found in IXPManager v.5.6.0 allows attackers to excute arbitrary code via the looking glass component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/inex/IXP-Manager/releases/tag/v5.7.0 - https://www.inex.ie/pipermail/ixpmanager-announce/2020/000016.html
CVE ID: CVE-2020-24860 State: PUBLISHED Published: 2020-10-01T13:55:24 Last Updated: 2024-08-04T15:19:09.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org - https://www.exploit-db.com/exploits/48851 - https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s - http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html
CVE ID: CVE-2020-24861 State: PUBLISHED Published: 2020-10-01T13:50:19 Last Updated: 2024-08-04T15:19:09.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page Additional Analyst Notes: - CVE Program Container: References: - http://get-simple.info - https://www.exploit-db.com/exploits/48850 - https://www.youtube.com/watch?v=8IMfD5KGt_U
CVE ID: CVE-2020-24862 State: PUBLISHED Published: 2021-06-02T16:50:08 Last Updated: 2024-08-04T15:19:09.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48752 - https://www.sourcecodester.com/php/14398/pharmacymedical-store-sale-point-using-phpmysql-bootstrap-framework.html - https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Stor
phpmysql-bootstrap-framework.html - https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Store+%26+Sale+Point+Using+PHP%2FMySQL+with+Bootstrap+Framework
CVE ID: CVE-2020-24863 State: PUBLISHED Published: 2020-09-03T14:34:32 Last Updated: 2024-08-04T15:19:09.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.midnightbsd.org/notes/ - https://github.com/MidnightBSD/src/blob/1691c07ff4f27b97220a5d65e217341e477f4014/sys/kern/vfs_syscalls.c - http://www.midnightbsd.o
hub.com/MidnightBSD/src/blob/1691c07ff4f27b97220a5d65e217341e477f4014/sys/kern/vfs_syscalls.c - http://www.midnightbsd.org/security/adv/MIDNIGHTBSD-SA-20:01.txt - https://www.freebsd.org/security/advisories/FreeBSD-EN-20:18.getfsstat.asc
CVE ID: CVE-2020-24870 State: PUBLISHED Published: 2021-06-02T15:32:11 Last Updated: 2024-08-04T15:19:09.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/330 - https://github.com/LibRaw/LibRaw/commit/4feaed4dea636cee4fee010f615881ccf76a096d - https://security.gentoo.org/glsa/202208-07
CVE ID: CVE-2020-24872 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T20:09:38.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lepton-cms.org/posts/new-security-release-144.php
CVE ID: CVE-2020-24876 State: PUBLISHED Published: 2020-09-03T16:07:10 Last Updated: 2024-08-04T15:19:09.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.pancakeapp.com/blog/entry/pancake-4.13.29-released - https://www.vaadata.com/blog/hardcoded-secret-leads-to-account-takeover/
CVE ID: CVE-2020-24877 State: PUBLISHED Published: 2021-03-15T16:41:22 Last Updated: 2024-08-04T15:19:09.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/h4ckdepy/zzzphp/issues/1
CVE ID: CVE-2020-24881 State: PUBLISHED Published: 2020-11-02T14:42:36 Last Updated: 2024-08-04T15:19:09.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/osTicket/osTicket/commit/d98c2d096aeb8876c6ab2f88317cd371d781f14d - https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0 - http://packetstormsecurity.com/files/160995/osTicket-1.14.2-Server-Side-Request-Forgery.html