Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5740 State: PUBLISHED Published: 2020-04-22T15:02:23 Last Updated: 2024-08-04T08:39:25.695Z Vendors: n/a Products: Plex Media Server (Windows) Problem Types: n/a Description: Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-25
CVE ID: CVE-2020-5741 State: PUBLISHED Published: 2020-05-08T12:02:59.000Z Last Updated: 2025-10-21T23:35:43.641Z Vendors: n/a Products: Plex Media Server (Windows) Problem Types: Authenticated Remote Python Deserialization Description: Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2020-32 - http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html
CVE ID: CVE-2020-5742 State: PUBLISHED Published: 2020-06-15T19:26:18 Last Updated: 2024-08-04T08:39:25.676Z Vendors: n/a Products: Plex Media Server Problem Types: Weak CORS Policy Description: Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-35
CVE ID: CVE-2020-5743 State: PUBLISHED Published: 2020-05-07T16:05:35 Last Updated: 2024-08-04T08:39:25.763Z Vendors: n/a Products: TCExam Problem Types: Authenticated Insecure Direct Object Reference Description: Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5744 State: PUBLISHED Published: 2020-05-07T16:03:57 Last Updated: 2024-08-04T08:39:25.603Z Vendors: n/a Products: TCExam Problem Types: Authenticated Directory Traversal / Arbitrary File Read Description: Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5745 State: PUBLISHED Published: 2020-05-07T16:10:39 Last Updated: 2024-08-04T08:39:25.680Z Vendors: n/a Products: TCExam Problem Types: Cross-site Request Forgery Description: Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5746 State: PUBLISHED Published: 2020-05-07T16:08:20 Last Updated: 2024-08-04T08:39:25.705Z Vendors: n/a Products: TCExam Problem Types: Authenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted test. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5747 State: PUBLISHED Published: 2020-05-07T16:02:17 Last Updated: 2024-08-04T08:39:25.679Z Vendors: n/a Products: TCExam Problem Types: Authenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted test. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5748 State: PUBLISHED Published: 2020-05-07T16:12:13 Last Updated: 2024-08-04T08:39:25.690Z Vendors: n/a Products: TCExam Problem Types: Unauthenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5749 State: PUBLISHED Published: 2020-05-07T16:15:02 Last Updated: 2024-08-04T08:39:25.748Z Vendors: n/a Products: TCExam Problem Types: Authenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted group. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5750 State: PUBLISHED Published: 2020-05-07T16:16:24 Last Updated: 2024-08-04T08:39:25.754Z Vendors: n/a Products: TCExam Problem Types: Unauthenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5751 State: PUBLISHED Published: 2020-05-07T16:13:46 Last Updated: 2024-08-04T08:39:25.758Z Vendors: n/a Products: TCExam Problem Types: Authenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted operator. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-31
CVE ID: CVE-2020-5752 State: PUBLISHED Published: 2020-05-21T14:03:16 Last Updated: 2024-08-04T08:39:25.779Z Vendors: n/a Products: Druva inSync Windows Client Problem Types: Unauthenticated Path Traversal Vulnerability Description: Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-34 - http://packetstormsecurity.com/files/157802/Druva-inSync-Windows-Client-6.6.3-Local-Privilege-Escalation.html - http://packetstormsecurity.com/files/160404/Druva-inSync-Wind
ync-Windows-Client-6.6.3-Local-Privilege-Escalation.html - http://packetstormsecurity.com/files/160404/Druva-inSync-Windows-Client-6.6.3-Privilege-Escalation.html
CVE ID: CVE-2020-5753 State: PUBLISHED Published: 2020-05-20T13:40:19 Last Updated: 2024-08-04T08:39:25.691Z Vendors: n/a Products: Signal Private Messenger Problem Types: Information Disclosure Description: Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-33
CVE ID: CVE-2020-5754 State: PUBLISHED Published: 2020-06-15T19:31:02 Last Updated: 2024-08-04T08:39:25.760Z Vendors: n/a Products: Webroot SecureAnywhere Problem Types: Incorrect Type Conversion or Cast Description: Webroot endpoint agents prior to version v9.0.28.48 allows remote attackers to trigger a type confusion vulnerability over its listening TCP port, resulting in crashing or reading memory contents of the Webroot endpoint agent. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-36
CVE ID: CVE-2020-5755 State: PUBLISHED Published: 2020-06-15T19:31:15 Last Updated: 2024-08-04T08:39:25.730Z Vendors: n/a Products: Webroot SecureAnywhere Problem Types: Local Privilege Escalation Description: Webroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\WrData\PKG" directory against renaming. This could allow attackers to trigger a crash or wait upon Webroot service restart to rewrite and hijack dlls in this directory for privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-36
CVE ID: CVE-2020-5756 State: PUBLISHED Published: 2020-07-17T20:16:27 Last Updated: 2024-08-04T08:39:25.704Z Vendors: Tenable Products: Grandstream GWN7000 Problem Types: CWE-489 Description: Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-41
CVE ID: CVE-2020-5757 State: PUBLISHED Published: 2020-07-17T20:35:44 Last Updated: 2024-08-04T08:39:25.872Z Vendors: n/a Products: Grandstream UCM6200 Series Problem Types: CWE-78 Description: Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-42
CVE ID: CVE-2020-5758 State: PUBLISHED Published: 2020-07-17T20:35:47 Last Updated: 2024-08-04T08:39:25.723Z Vendors: n/a Products: Grandstream UCM6200 Series Problem Types: CWE-78 Description: Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-42
CVE ID: CVE-2020-5759 State: PUBLISHED Published: 2020-07-17T20:35:51 Last Updated: 2024-08-04T08:39:25.757Z Vendors: n/a Products: Grandstream UCM6200 Series Problem Types: CWE-78 Description: Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-42
CVE ID: CVE-2020-5760 State: PUBLISHED Published: 2020-07-29T18:51:40 Last Updated: 2024-08-04T08:39:25.853Z Vendors: n/a Products: Grandstream HT800 Series Problem Types: CWE-78 Description: Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-43 - https://www.tenable.com/security/research/tra-2020-47
CVE ID: CVE-2020-5761 State: PUBLISHED Published: 2020-07-29T18:51:43 Last Updated: 2024-08-04T08:39:25.699Z Vendors: n/a Products: Grandstream HT800 Series Problem Types: CWE-835 Description: Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-43 - https://www.tenable.com/security/research/tra-2020-47
CVE ID: CVE-2020-5762 State: PUBLISHED Published: 2020-07-29T18:51:47 Last Updated: 2024-08-04T08:39:25.894Z Vendors: n/a Products: Grandstream HT800 Series Problem Types: CWE-476 Description: Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of the HTTP Authentication field. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-43 - https://www.tenable.com/security/research/tra-2020-47
CVE ID: CVE-2020-5763 State: PUBLISHED Published: 2020-07-29T18:51:50 Last Updated: 2024-08-04T08:39:25.821Z Vendors: n/a Products: Grandstream HT800 Series Problem Types: CWE-489 Description: Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by correctly answering a challenge prompt. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-43 - https://www.tenable.com/security/research/tra-2020-47
CVE ID: CVE-2020-5764 State: PUBLISHED Published: 2020-07-08T13:34:53 Last Updated: 2024-08-04T08:39:25.912Z Vendors: n/a Products: MX Player Android App Problem Types: Path Traversal Description: MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILE_LIST" with a "name" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In so
file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In some instances, an attacker can achieve remote code execution by writing ".odex" and ".vdex" files in the "oat" directory of the MX Player application. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-41
CVE ID: CVE-2020-5765 State: PUBLISHED Published: 2020-07-15T12:18:30 Last Updated: 2024-08-04T08:39:25.924Z Vendors: n/a Products: Tenable Nessus Problem Types: Stored XSS Description: Nessus 8.10.0 and earlier were found to contain a Stored XSS vulnerability due to improper validation of input during scan configuration. An authenticated, remote attacker could potentially exploit this vulnerability to execute arbitrary code in a user's session. Tenable has implemented additional input validation mechanisms to correct this issue in Nessus 8.11.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2020-05
CVE ID: CVE-2020-5766 State: PUBLISHED Published: 2020-07-13T14:20:33 Last Updated: 2024-08-04T08:39:25.919Z Vendors: n/a Products: SRS Simple Hits Counter Plugin for WordPress Problem Types: SQL Injection Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-42
CVE ID: CVE-2020-5767 State: PUBLISHED Published: 2020-07-17T21:22:59 Last Updated: 2024-08-04T08:39:25.909Z Vendors: n/a Products: Icegram Email Subscribers & Newsletters Plugin for WordPress Problem Types: Cross-site Request Forgery Description: Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-44-0
CVE ID: CVE-2020-5768 State: PUBLISHED Published: 2020-07-17T21:22:53 Last Updated: 2024-08-04T08:39:25.909Z Vendors: n/a Products: Icegram Email Subscribers & Newsletters Plugin for WordPress Problem Types: SQL Injection Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-44-0
CVE ID: CVE-2020-5769 State: PUBLISHED Published: 2020-07-17T21:23:06 Last Updated: 2024-08-04T08:39:25.822Z Vendors: n/a Products: Teltonika Gateway TRB245 Problem Types: Authenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by injecting malicious client-side code into the 'URL/ Host / Connection' form in the 'DATA TO SERVER' configuration section. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-43-0
CVE ID: CVE-2020-5770 State: PUBLISHED Published: 2020-08-03T19:57:28 Last Updated: 2024-08-04T08:39:25.879Z Vendors: n/a Products: Teltonika Gateway TRB245 Problem Types: Cross-site Request Forgery Description: Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-48
CVE ID: CVE-2020-5771 State: PUBLISHED Published: 2020-08-03T19:58:42 Last Updated: 2024-08-04T08:39:25.772Z Vendors: n/a Products: Teltonika Gateway TRB245 Problem Types: Inadequate Validation of Backup Archive Files Description: Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-48
CVE ID: CVE-2020-5772 State: PUBLISHED Published: 2020-08-03T19:53:01 Last Updated: 2024-08-04T08:39:25.871Z Vendors: n/a Products: Teltonika Gateway TRB245 Problem Types: Inadequate Validation of Package Files Description: Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-48
CVE ID: CVE-2020-5773 State: PUBLISHED Published: 2020-08-03T19:55:40 Last Updated: 2024-08-04T08:39:25.990Z Vendors: n/a Products: Teltonika Gateway TRB245 Problem Types: Improper User Access Control Description: Improper Access Control in Teltonika firmware TRB2_R_00.02.04.01 allows a low privileged user to perform unauthorized write operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-48
CVE ID: CVE-2020-5774 State: PUBLISHED Published: 2020-08-21T12:23:40 Last Updated: 2024-08-04T08:39:25.874Z Vendors: n/a Products: Tenable Nessus Problem Types: Insufficient Session Expiration Description: Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2020-06
CVE ID: CVE-2020-5775 State: PUBLISHED Published: 2020-08-21T17:36:56 Last Updated: 2024-08-04T08:39:25.766Z Vendors: n/a Products: Instructure Canvas Learning Management System (LMS) Problem Types: Server-Side Request Forgery Description: Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-49
CVE ID: CVE-2020-5776 State: PUBLISHED Published: 2020-09-01T20:34:52 Last Updated: 2024-08-04T08:39:25.860Z Vendors: n/a Products: MAGMI Problem Types: Cross-site Request Forgery (CSRF) Description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-51
CVE ID: CVE-2020-5777 State: PUBLISHED Published: 2020-09-01T20:34:44 Last Updated: 2024-08-04T08:39:25.908Z Vendors: n/a Products: MAGMI Problem Types: Remote Authentication Bypass. Description: MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections"
is can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-51
CVE ID: CVE-2020-5778 State: PUBLISHED Published: 2020-09-02T19:21:19 Last Updated: 2024-08-04T08:39:25.900Z Vendors: n/a Products: Trading Technologies Messaging Problem Types: Denial of Service Description: A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type 8 message sent to default TCP RequestPort 10200. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to terminate ttmd.exe. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-52
CVE ID: CVE-2020-5779 State: PUBLISHED Published: 2020-09-02T19:21:29 Last Updated: 2024-08-04T08:39:25.915Z Vendors: n/a Products: Trading Technologies Messaging Problem Types: Denial of Service Description: A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy_s() with an invalid parameter (i.e., a long src string parameter) as a part of processing a type 4 message sent to default TCP RequestPort 10200. It's been observed that ttmd.exe terminates as a result. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-52
CVE ID: CVE-2020-5780 State: PUBLISHED Published: 2020-09-10T14:10:03 Last Updated: 2024-08-04T08:39:25.865Z Vendors: n/a Products: Icegram Email Subscribers & Newsletters Plugin for WordPress Problem Types: Unauthenticated email forgery/spoofing in WordPress Email Subscribers plugin Description: Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-53