Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Packaged Apps. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Packaged Apps, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Packaged Apps accessible data as well as unauthorized read access to a subset of Oracle Application Express Packaged Apps accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector:
on Express Packaged Apps accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2020-14899 State: PUBLISHED Published: 2020-10-21T14:04:31 Last Updated: 2024-09-26T20:00:45.519Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Oracle Corporation Products: Application Express (APEX) Problem Types: Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Data Reporter. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Data Reporter, attacks may significantly impact additional products. Successful attacks of this vulnerabilit
ion Express Data Reporter, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Data Reporter accessible data as well as unauthorized read access to a subset of Oracle Application Express Data Reporter accessible data. Description: Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Dat
d attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Data Reporter. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Data Reporter, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Data Reporter accessible data as well as unauthorized read access to a subset of Oracle Application Express Data Reporter accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector:
on Express Data Reporter accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2020-14900 State: PUBLISHED Published: 2020-10-21T14:04:31 Last Updated: 2024-09-26T20:00:34.259Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Oracle Corporation Products: Application Express (APEX) Problem Types: Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Group Calendar. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Group Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerabil
tion Express Group Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Group Calendar accessible data as well as unauthorized read access to a subset of Oracle Application Express Group Calendar accessible data. Description: Vulnerability in the Oracle Application Express Group Calendar component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Expres
ileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Group Calendar. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Group Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Group Calendar accessible data as well as unauthorized read access to a subset of Oracle Application Express Group Calendar accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS
pplication Express Group Calendar accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2020-14901 State: PUBLISHED Published: 2020-10-21T14:04:31 Last Updated: 2024-09-26T20:00:22.932Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Oracle Corporation Products: Database - Enterprise Edition Problem Types: Easily exploitable vulnerability allows high privileged attacker having Analyze Any privilege with network access via Oracle Net to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all RDBMS Security accessible data. Description: Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected
iption: Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having Analyze Any privilege with network access via Oracle Net to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all RDBMS Security accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2020-14926 State: PUBLISHED Published: 2020-06-19T17:03:03 Last Updated: 2024-08-04T13:00:52.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12324
CVE ID: CVE-2020-14927 State: PUBLISHED Published: 2020-06-19T17:02:54 Last Updated: 2024-08-04T13:00:52.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/issues/19
CVE ID: CVE-2020-14928 State: PUBLISHED Published: 2020-07-17T15:30:42 Last Updated: 2024-08-04T13:00:52.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226 - https://lists.debian.org/debian-lts-announce/2020/07/msg00012.html - https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d852
2020/07/msg00012.html - https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df - https://security-tracker.debian.org/tracker/DSA-4725-1 - https://security-tracker.debian.org/tracker/DLA-2281-1 - https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac - https://bugzilla.suse.com/show_bug.cgi?id=1173910 - https://www.debian.org/security/2020/dsa-4725 - https://usn.ubuntu.com/4429-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMBEZWA22EAYAZQWUX4KPEBER726KSIG/
CVE ID: CVE-2020-14929 State: PUBLISHED Published: 2020-06-19T18:58:59 Last Updated: 2024-08-04T13:00:51.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do. Additional Analyst Notes: - CVE Program Container: References: - http://mailman13.u.washington.edu/pipermail/alpine-info/2020-June/008989.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00025.html - https://lists.fedoraproject.org/archives/list/pack
https://lists.debian.org/debian-lts-announce/2020/06/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJLY6JDVGDNAJZ3UQDWYWSDBWOAOXMNX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFXQGKZZMP3VSTLZVO5Z7Z6USYIW37A6/
CVE ID: CVE-2020-14930 State: PUBLISHED Published: 2020-06-19T20:50:41 Last Updated: 2024-08-04T13:00:52.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48196 - https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Pas
es: - https://www.exploit-db.com/exploits/48196 - https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Password-Reset-Authentication-Bypass.html
CVE ID: CVE-2020-14931 State: PUBLISHED Published: 2020-06-19T21:03:24.000Z Last Updated: 2025-11-03T21:44:17.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nic_format_buff. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jaygreig86/dmitry/issues/4
CVE ID: CVE-2020-14932 State: PUBLISHED Published: 2020-06-20T12:07:23 Last Updated: 2024-08-04T13:00:52.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/06/20/1
CVE ID: CVE-2020-14933 State: PUBLISHED Published: 2020-06-20T12:07:06 Last Updated: 2024-08-04T13:00:52.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this because these two conditions for PHP object injection are not satisfied: existence of a PHP magic method (such as __wakeup or __destruct), and any attack-relevant classes must be declared before unserialize is called (or must be autoloaded). Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/06/20/1
CVE ID: CVE-2020-14934 State: PUBLISHED Published: 2020-08-18T16:25:51 Last Updated: 2024-08-04T13:00:52.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP agent. The function parsing the received SNMP request does not verify the input message's requested variables against the capacity of the internal SNMP engine buffer. If the number of variables in the request exceeds the allocated buffer, a memory write out of the buffer boundaries occurs. This write operation provides a possibility to overwrite other variables allocated in the .bss section by the application. Because the sender of the frame is in con
to overwrite other variables allocated in the .bss section by the application. Because the sender of the frame is in control of the content that will be written beyond the buffer limits, and there is no strict process memory separation, this issue may allow overwriting of sensitive memory areas of an IoT device. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1NIf0Y0S47Lu85uSi29kt9tgSh0jYZYfj/view?usp=sharing - https://github.com/contiki-ng/contiki-ng/issues/1352
CVE ID: CVE-2020-14935 State: PUBLISHED Published: 2020-08-18T16:32:37 Last Updated: 2024-08-04T13:00:52.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP bulk get request response encoding function. The function parsing the received SNMP request does not verify the input message's requested variables against the capacity of the internal SNMP engine buffer. When a bulk get request response is assembled, a stack buffer dedicated for OIDs (with a limited capacity) is allocated in snmp_engine_get_bulk(). When snmp_engine_get_bulk() is populating the stack buffer, an overflow condition may occur due to lack
gine_get_bulk(). When snmp_engine_get_bulk() is populating the stack buffer, an overflow condition may occur due to lack of input length validation. This makes it possible to overwrite stack regions beyond the allocated buffer, including the return address from the function. As a result, the code execution path may be redirected to an address provided in the SNMP bulk get payload. If the target architecture uses common addressing space for program and data memory, it may also be possible to supply code in the SNMP request payload, and redirect the execution path to the remotely injected code, by modifying the function's return address. Additional Analyst Notes: - CVE Program Container: Refer
tely injected code, by modifying the function's return address. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1qp3ZXaFRiR_imWg0lUbI7-D-hIT268EB/view?usp=sharing - https://github.com/contiki-ng/contiki-ng/issues/1353
CVE ID: CVE-2020-14936 State: PUBLISHED Published: 2020-08-18T16:35:20 Last Updated: 2024-08-04T13:00:52.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP agent. Functions parsing the OIDs in SNMP requests lack sufficient allocated target-buffer capacity verification when writing parsed OID values. The function snmp_oid_decode_oid() may overwrite memory areas beyond the provided target buffer, when called from snmp_message_decode() upon an SNMP request reception. Because the content of the write operations is externally provided in the SNMP requests, it enables a remote overwrite of an IoT device's memo
the write operations is externally provided in the SNMP requests, it enables a remote overwrite of an IoT device's memory regions beyond the allocated buffer. This overflow may allow remote overwrite of stack and statically allocated variables memory regions by sending a crafted SNMP request. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1FypWH_g475jSL0mDFzquaATCeRIHQ2kj/view?usp=sharing - https://github.com/contiki-ng/contiki-ng/issues/1351
CVE ID: CVE-2020-14937 State: PUBLISHED Published: 2020-08-18T15:27:37 Last Updated: 2024-08-04T13:00:52.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory access out of buffer boundaries issues was discovered in Contiki-NG 4.4 through 4.5, in the SNMP BER encoder/decoder. The length of provided input/output buffers is insufficiently verified during the encoding and decoding of data. This may lead to out-of-bounds buffer read or write access in BER decoding and encoding functions. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1mAkJBVZNv5PMVwLojru0njH38zEXpWui/view?usp=sharing - https://github.com/contiki-ng/contiki-ng/iss
rive.google.com/file/d/1mAkJBVZNv5PMVwLojru0njH38zEXpWui/view?usp=sharing - https://github.com/contiki-ng/contiki-ng/issues/1354
CVE ID: CVE-2020-14938 State: PUBLISHED Published: 2020-06-23T09:57:09 Last Updated: 2024-08-04T13:00:52.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in map.c in FreedroidRPG 1.0rc2. It assumes lengths of data sets read from saved game files. It copies data from a file into a fixed-size heap-allocated buffer without size verification, leading to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedroid.org/b/issue951 - https://logicaltrust.net/blog/2020/02/freedroid.html
CVE ID: CVE-2020-14939 State: PUBLISHED Published: 2020-06-23T09:56:50 Last Updated: 2024-08-04T13:00:52.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in savestruct_internal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game's state. A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading. Additional Analyst Notes: - CVE Program Container: References: - https://logicaltrust.net/blog/2020/02/freedroid.html - https://bugs.freedroid.org/b/issue953
CVE ID: CVE-2020-14940 State: PUBLISHED Published: 2020-06-23T09:56:36 Last Updated: 2024-08-04T13:00:52.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/tuxguitar/bugs/126/ - https://logicaltrust.net/blog/2020/06/tuxguitar.html
CVE ID: CVE-2020-14942 State: PUBLISHED Published: 2020-06-21T14:44:29 Last Updated: 2024-08-04T13:00:52.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tendenci/tendenci/issues/867
CVE ID: CVE-2020-14943 State: PUBLISHED Published: 2020-06-22T21:50:09 Last Updated: 2024-08-04T13:00:52.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Update User Profile. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14943%20-%20Stored%20XSS.md - http://packetstormsecurity.com/files/158217/BSA-Radar-1.6.7234.24750-Cross-Site-Scripting.html - https://www.exploit-db.com
p://packetstormsecurity.com/files/158217/BSA-Radar-1.6.7234.24750-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/48619
CVE ID: CVE-2020-14944 State: PUBLISHED Published: 2020-06-22T21:48:58 Last Updated: 2024-08-04T13:00:52.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of user accounts if successfully exploited. The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, and GetUser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%2
ities - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md - http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-14945 State: PUBLISHED Published: 2020-06-22T21:45:24 Last Updated: 2024-08-04T13:00:52.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights (i.e., the BankAdmin role) via modified SaveUser data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14945%20-%20Privilege%20Escalation.md - https://www.exploit-db
erhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14945%20-%20Privilege%20Escalation.md - https://www.exploit-db.com/exploits/48649
CVE ID: CVE-2020-14946 State: PUBLISHED Published: 2020-06-22T21:43:00 Last Updated: 2024-08-04T13:00:52.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath parameters in the URL, or while using a proxy. This vulnerability could be used to view local sensitive files or configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wsummerhill/BSA-Rad
iguration files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities - https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14946%20-%20Local%20File%20Inclusion.md - http://packetstormsecurity.com/files/158420/BSA-Radar-1.6.7234.24750-Local-File-Inclusion.html
CVE ID: CVE-2020-14947 State: PUBLISHED Published: 2020-06-30T20:44:34 Last Updated: 2024-08-04T13:00:52.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mhaskar/233436d3096d4a7beafe36ff61dc2c73 - https://drive.google.com/file/d/1-LVfL5ui5m2QfQxr0fDopzSECd4fTNrQ/view?usp=sharing - https://shells.systems/ocs-inventory-ng-v2-7-remote-command-execution-cve-2020-14947/ - http://p