Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12074 State: PUBLISHED Published: 2020-04-23T02:00:49 Last Updated: 2024-08-04T11:48:57.846Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/03/vulnerability-patched-in-import-export-wordpress-users/
CVE ID: CVE-2020-12075 State: PUBLISHED Published: 2020-04-23T02:00:33 Last Updated: 2024-08-04T11:48:58.119Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin/
CVE ID: CVE-2020-12076 State: PUBLISHED Published: 2020-04-23T02:00:23 Last Updated: 2024-08-04T11:48:57.996Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin/
CVE ID: CVE-2020-12077 State: PUBLISHED Published: 2020-04-23T02:20:46 Last Updated: 2024-08-04T11:48:58.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/mappress-google-maps-for-wordpress/#developers - https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-patched-in-mappress-maps-plugin/
CVE ID: CVE-2020-12078 State: PUBLISHED Published: 2020-04-28T13:26:55 Last Updated: 2024-08-04T11:48:57.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address. Additional Analyst Notes: - CVE Program
ich means that the attacker can provide a payload instead of a valid IP address. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mhaskar/dca62d0f0facc13f6364b8ed88d5a7fd - https://shells.systems/open-audit-v3-3-1-remote-command-execution-cve-2020-12078/ - https://github.com/Opmantek/open-audit/commit/6ffc7f9032c55eaa1c37cf5e070809b7211c7e9a - http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html
CVE ID: CVE-2020-12079 State: PUBLISHED Published: 2020-04-23T03:54:07 Last Updated: 2024-08-04T11:48:58.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/beakerbrowser/beaker/issues/1519 - https://github.com/beakerbrowser/beaker/releases/tag/0.8.9
CVE ID: CVE-2020-12080 State: PUBLISHED Published: 2021-09-17T17:45:12 Last Updated: 2024-08-04T11:48:58.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-28 - https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2020-12080-Remediated-in-FlexNet-Publisher/ta-p/143873 - https://community.flexera.com/t5/FlexNet-Publisher-News/FlexNet-Publisher-2020-R2-11-17-0-is-here/ba-p/144
ta-p/143873 - https://community.flexera.com/t5/FlexNet-Publisher-News/FlexNet-Publisher-2020-R2-11-17-0-is-here/ba-p/144017/jump-to/first-unread-message
CVE ID: CVE-2020-12081 State: PUBLISHED Published: 2020-07-31T16:55:11 Last Updated: 2024-08-04T11:48:58.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2. The web portal link can be used to access to system files or other important files on the system. Additional Analyst Notes: - CVE Program Container: References: - https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2020-12081-Remediated-in-FlexNet-Publisher/ta-p/153505
CVE ID: CVE-2020-12082 State: PUBLISHED Published: 2021-09-17T17:45:14 Last Updated: 2024-08-04T11:48:57.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). Additional Analyst Notes: - CVE Program Container: References: - https://community.flexera.com/t5/Code-Insight-Knowledge-Base/CVE-2020-12082-Remediated-in-Code-Insight/ta-p/169353
CVE ID: CVE-2020-12083 State: PUBLISHED Published: 2021-09-17T17:45:15 Last Updated: 2024-08-04T11:48:57.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). Additional Analyst Notes: - CVE Program Container: References: - https://community.flexera.com/t5/Code-Insight-Knowledge-Base/CVE-2020-12083-Remediated-in-Code-Insight/ta-p/169356
CVE ID: CVE-2020-12100 State: PUBLISHED Published: 2020-08-12T15:07:52 Last Updated: 2024-08-04T11:48:57.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - http://www.openwall.com/lists/oss-security/2020/08/12/1 - https://www.debian.org/security/2020/dsa-4745 - https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html - https://usn.ubuntu.com/4456-1/ - https://usn
4745 - https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html - https://usn.ubuntu.com/4456-1/ - https://usn.ubuntu.com/4456-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/ - https://security.gentoo.org/glsa/202009-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/ - http://www.openwall.com/lists/oss-security/2021/01/04/3 - http://seclists.org/fulldisclosure/2021/Jan/18
CVE ID: CVE-2020-12101 State: PUBLISHED Published: 2020-04-30T13:40:34 Last Updated: 2024-08-04T11:48:57.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-012.txt - https://helpdesk.xt-commerce.com/index.php?/Knowledgebase/Article/View/1784/294/adressbuch-sicherheitspatch-17042020-fr-xtcommerce-51-bis-622 - http://seclists.org/fulldiscl
base/Article/View/1784/294/adressbuch-sicherheitspatch-17042020-fr-xtcommerce-51-bis-622 - http://seclists.org/fulldisclosure/2020/May/0 - http://packetstormsecurity.com/files/157534/xt-Commerce-5.4.1-6.2.1-6.2.2-Improper-Access-Control.html
CVE ID: CVE-2020-12102 State: PUBLISHED Published: 2020-04-28T21:01:16 Last Updated: 2024-08-04T11:48:58.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06 - https://github.com/prasathmani/tinyfilemanager/issues/357 - https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnera
://github.com/prasathmani/tinyfilemanager/issues/357 - https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/
CVE ID: CVE-2020-12103 State: PUBLISHED Published: 2020-04-28T21:07:28 Last Updated: 2024-08-04T11:48:58.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06 - https://github.com/prasathmani/tinyfilemanager/issues/357 - https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vu
https://github.com/prasathmani/tinyfilemanager/issues/357 - https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/
CVE ID: CVE-2020-12104 State: PUBLISHED Published: 2020-05-05T14:17:40 Last Updated: 2024-08-04T11:48:58.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-advanced-search/#developers - https://wpvulndb.com/vulnerabilities/10199
CVE ID: CVE-2020-12105 State: PUBLISHED Published: 2020-04-23T16:15:29 Last Updated: 2024-08-04T11:48:58.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/openconnect/openconnect/-/merge_requests/96 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html - https://security.gentoo.org/glsa/202006-15
CVE ID: CVE-2020-12106 State: PUBLISHED Published: 2020-08-12T18:12:56 Last Updated: 2024-08-04T11:48:58.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administrative functions such as, changing credentials of the Administrator account or connect the product to a rogue access point. Additional Analyst Notes: - CVE Program Container: References: - https://www.stengg.com/cybersecurity - https://www.stengg.com/media/1076253/vpncrypt-m10-cve-advisory-notice.pdf
CVE ID: CVE-2020-12107 State: PUBLISHED Published: 2020-08-12T18:14:29 Last Updated: 2024-08-04T11:48:58.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this module's Operating System. Additional Analyst Notes: - CVE Program Container: References: - https://www.stengg.com/cybersecurity - https://www.stengg.com/media/1076253/vpncrypt-m10-cve-advisory-notice.pdf
CVE ID: CVE-2020-12108 State: PUBLISHED Published: 2020-05-06T14:50:33 Last Updated: 2024-08-04T11:48:58.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Additional Analyst Notes: - CVE Program Container: References: - https://code.launchpad.net/mailman - https://mail.python.org/pipermail/mailman-announce/ - https://bugs.launchpad.net/mailman/+bug/1873722 - https://lists.debian.org/debian-lts-announce/2020/05/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00036.html - https://usn.ubuntu.com/4354-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg
020-05/msg00036.html - https://usn.ubuntu.com/4354-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00003.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00007.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74EQIVFB34Q4UYAQLCUWG55YLKAUWCHD/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html - https://www.debian.org/security/2021/dsa-4991
CVE ID: CVE-2020-12109 State: PUBLISHED Published: 2020-05-04T15:06:51 Last Updated: 2024-08-04T11:48:58.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - https://seclists.org/fulldisclosure/2020/May/2 - http://packetstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html - http://packetstormsecurity
etstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html - http://packetstormsecurity.com/files/159222/TP-Link-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html
CVE ID: CVE-2020-12110 State: PUBLISHED Published: 2020-05-04T13:49:45 Last Updated: 2024-08-04T11:48:58.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/May/3 - http://packetstormsecurity.com/files/157532/TP-LINK-Cloud-Cameras-NCXXX-Hardcoded-Encryption-Key.html
CVE ID: CVE-2020-12111 State: PUBLISHED Published: 2020-05-04T14:05:46 Last Updated: 2024-08-04T11:48:58.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - https://seclists.org/fulldisclosure/2020/May/4 - http://packetstormsecurity.com/files/157533/TP-LINK-Cloud-Cameras-NCXXX-SetEncryptKey-Command-Injection.html
CVE ID: CVE-2020-12112 State: PUBLISHED Published: 2020-04-23T17:53:59 Last Updated: 2024-08-04T11:48:58.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/thibeault_chenu/status/1249976515917422593 - https://twitter.com/bigbluebutton/status/1252706369486180353 - https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.4...v2.2.5 - https://cwe.mitre.org/data/definitions/23.html - https://github.com/tchenu/CVE-2020-12112
CVE ID: CVE-2020-12113 State: PUBLISHED Published: 2020-04-23T17:53:47 Last Updated: 2024-08-04T11:48:58.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.2.4 - https://github.com/bigbluebutton/bigbluebutton/pull/9017 - https://www.sakshamanand.com/cve-2020-12113/
CVE ID: CVE-2020-12114 State: PUBLISHED Published: 2020-05-04T11:42:03 Last Updated: 2024-08-04T11:48:58.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020
- https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - https://www.debian.org/security/2020/dsa-4699 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html - https://usn.ubuntu.com/4388-1/ - https://usn.ubuntu.com/4392-1/ - https://usn.ubuntu.com/4389-1/ - https://usn.ubuntu.com/4387-1/ - https://usn.ubuntu.com/4390-1/ - https://usn.ubuntu.com/4391-1/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20200608-0001/ - http://www.openwall.com/lists/oss-security/2020/05/04/2 - http://packetst
rity.netapp.com/advisory/ntap-20200608-0001/ - http://www.openwall.com/lists/oss-security/2020/05/04/2 - http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html
CVE ID: CVE-2020-12116 State: PUBLISHED Published: 2020-05-07T19:13:32 Last Updated: 2024-08-04T11:48:58.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me-complete.html - https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125125
CVE ID: CVE-2020-12117 State: PUBLISHED Published: 2020-05-01T13:41:37 Last Updated: 2024-08-04T11:48:58.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/support/support/security-advisory/nport-5100a-series-serial-device-servers-vulnerability - https://blog.scadafence.com/technical-blog-cve-2020-12117-
sory/nport-5100a-series-serial-device-servers-vulnerability - https://blog.scadafence.com/technical-blog-cve-2020-12117-industrial-iot-insecure-default-configurations
CVE ID: CVE-2020-12118 State: PUBLISHED Published: 2020-04-23T21:28:33 Last Updated: 2024-08-04T11:48:58.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/binance-chain/tss-lib/pull/89 - https://github.com/binance-chain/tss-lib/releases/tag/v1.2.0
CVE ID: CVE-2020-12119 State: PUBLISHED Published: 2020-07-02T14:42:13 Last Updated: 2024-08-04T11:48:58.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed to basic double spending attacks, amplified double spending attacks, and DoS attacks without user consent. Additional Analyst Notes: - CVE Program Container: References: - https://donjon.ledger.com/lsb/012/
CVE ID: CVE-2020-12120 State: PUBLISHED Published: 2020-04-27T14:22:48 Last Updated: 2024-08-04T11:48:58.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers. Additional Analyst Notes: - CVE Program Container: References: - https://addons.prestashop.com/en/delivery-date/27273-correos-express-solutions-of-urgent-transport.html - https://ia-informatica.com/it/CVE-2020-12120
CVE ID: CVE-2020-12122 State: PUBLISHED Published: 2021-02-05T19:02:00 Last Updated: 2024-08-04T11:48:58.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x2200019. (This also extends to the various other products from Max Secure that include MaxProc64.sys.) Additional Analyst Notes: - CVE Program Container: References: - https://www.maxpcsecure.com/spywaredetector.htm - https://github.com/FULLSHADE/Kernel-exploits - https://github.com/FULLSHADE/Kernel-exp
csecure.com/spywaredetector.htm - https://github.com/FULLSHADE/Kernel-exploits - https://github.com/FULLSHADE/Kernel-exploits/tree/master/MaxProc64.sys
CVE ID: CVE-2020-12123 State: PUBLISHED Published: 2020-10-02T08:11:18 Last Updated: 2024-08-04T11:48:58.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoints, because these endpoints do not contain CSRF tokens. If a user is authenticated in the router portal, then this attack will work. Additional Analyst Notes: - CVE Program Container: References: - https://www.wavlink.com/en_us/product/WL-WN530H4.html - https://cerne.xyz/bugs/CVE-2020-12123
CVE ID: CVE-2020-12124 State: PUBLISHED Published: 2020-10-02T08:11:57 Last Updated: 2024-08-04T11:48:58.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.wavlink.com/en_us/product/WL-WN530H4.html - https://cerne.xyz/bugs/CVE-2020-12124