Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-corruption-bug-discovery-minidlna/ - https://www.debian.org/security/2020/dsa-4806 - https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html
CVE ID: CVE-2020-28927 State: PUBLISHED Published: 2020-11-23T19:36:04 Last Updated: 2024-08-04T16:47:59.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://magicpin.in - https://akshayj0111.medium.com/cve-2020-28927-6f64c25239bb
CVE ID: CVE-2020-28928 State: PUBLISHED Published: 2020-11-24T18:01:05 Last Updated: 2024-08-04T16:48:00.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow). Additional Analyst Notes: - CVE Program Container: References: - https://musl.libc.org/releases.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00050.html - https://lists.apache.org/thread.html/ra63e8dc5137d952afc55dbbfa63be83304ecf842d1eab1ff3ebb29e2%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread
7d952afc55dbbfa63be83304ecf842d1eab1ff3ebb29e2%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread.html/r90b60cf49348e515257b4950900c1bd3ab95a960cf2469d919c7264e%40%3Cnotifications.apisix.apache.org%3E - https://lists.apache.org/thread.html/r2134abfe847bea7795f0e53756d10a47e6643f35ab8169df8b8a9eb1%40%3Cnotifications.apisix.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW27QVY7ERPTSGKS4KAWE5TU7EJWHKVQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKQ3RVSMVZNZNO4D65W2CZZ4DMYFZN2Q/ - https://www.oracle.com//security-alerts/cpujul2021.html - http://www.op
.org/message/LKQ3RVSMVZNZNO4D65W2CZZ4DMYFZN2Q/ - https://www.oracle.com//security-alerts/cpujul2021.html - http://www.openwall.com/lists/oss-security/2020/11/20/4 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-28929 State: PUBLISHED Published: 2020-12-16T20:22:56 Last Updated: 2024-08-04T16:47:59.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI. Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-1
CVE ID: CVE-2020-28930 State: PUBLISHED Published: 2020-12-16T20:26:33 Last Updated: 2024-08-04T16:47:59.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-2
CVE ID: CVE-2020-28931 State: PUBLISHED Published: 2020-12-16T20:28:02 Last Updated: 2024-08-04T16:47:59.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website. Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-3
CVE ID: CVE-2020-28935 State: PUBLISHED Published: 2020-12-07T21:46:47.878342Z Last Updated: 2024-09-16T23:27:01.127Z Vendors: NLnet Labs Products: Unbound, NSD Problem Types: CWE-59 Description: NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was writt
ened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permissio
enial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt - https://www.nlnetlabs.nl/downloads/nsd/CVE-2020-28935.txt - https://security.gentoo.org/glsa/202101-38 - https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html
CVE ID: CVE-2020-28937 State: PUBLISHED Published: 2020-12-03T15:54:36 Last Updated: 2024-08-04T16:47:59.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information (PHI) stored in the application, via a direct request for the /tests/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bishopfox.com/advisories/openclinic-version-0.8.2
CVE ID: CVE-2020-28938 State: PUBLISHED Published: 2020-12-03T15:57:24 Last Updated: 2024-08-04T16:48:00.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bishopfox.com/advisories/openclinic-version-0.8.2
CVE ID: CVE-2020-28939 State: PUBLISHED Published: 2020-12-03T15:59:03 Last Updated: 2024-08-04T16:48:00.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability. This vulnerability allows authenticated users (with substantial privileges) to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bishopfox.com/advisories/openclinic-version-0.8.2
CVE ID: CVE-2020-28940 State: PUBLISHED Published: 2020-12-01T15:27:52 Last Updated: 2024-08-04T16:48:01.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads - https://www.westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-06-115 - https://www.zerodayinitiative.com/advisories/ZDI-20-1445/
CVE ID: CVE-2020-28941 State: PUBLISHED Published: 2020-11-19T15:23:28 Last Updated: 2024-08-04T16:48:00.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-linus&id=d4122754442799187d5d537a9c039a49a67e57f1 - https://www.openwall.com/l
x/kernel/git/gregkh/tty.git/commit/?h=tty-linus&id=d4122754442799187d5d537a9c039a49a67e57f1 - https://www.openwall.com/lists/oss-security/2020/11/19/3 - https://github.com/torvalds/linux/commit/d4122754442799187d5d537a9c039a49a67e57f1 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d4122754442799187d5d537a9c039a49a67e57f1 - http://www.openwall.com/lists/oss-security/2020/11/19/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/ - https://lists.debian.
chives/list/package-announce%40lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/ - https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
CVE ID: CVE-2020-28942 State: PUBLISHED Published: 2020-11-19T16:38:46 Last Updated: 2024-08-04T16:47:59.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain security model, the peer connector allows the restriction of client certificates (for the RA, not the end user) to a limited set of allowed CAs, thus restricting the accessibility of that RA to the rights it has within a specific role. While this works for other protocols such as CMP, it was found that the EJBCA enrollment over an EST implementation bypasses this check, allowi
her protocols such as CMP, it was found that the EJBCA enrollment over an EST implementation bypasses this check, allowing enrollment with a valid client certificate through any functioning and authenticated RA connected to the CA. NOTE: an attacker must already have a trusted client certificate and authorization to enroll against the targeted CA. Additional Analyst Notes: - CVE Program Container: References: - https://support.primekey.com/news/posts/40
CVE ID: CVE-2020-28943 State: PUBLISHED Published: 2021-04-30T21:03:47 Last Updated: 2024-08-04T16:48:00.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.10.4 and earlier allows SSRF via a snippet. Additional Analyst Notes: - CVE Program Container: References: - https://open-xchange.com - http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE ID: CVE-2020-28944 State: PUBLISHED Published: 2021-04-30T21:06:19 Last Updated: 2024-08-04T16:48:00.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. Additional Analyst Notes: - CVE Program Container: References: - https://open-xchange.com - http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE ID: CVE-2020-28945 State: PUBLISHED Published: 2021-05-03T19:38:27 Last Updated: 2024-08-04T16:47:59.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://onerror=Function.constructor, in a Notes item. Additional Analyst Notes: - CVE Program Container: References: - https://open-xchange.com - https://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE ID: CVE-2020-28946 State: PUBLISHED Published: 2020-12-08T19:40:22 Last Updated: 2024-08-04T16:48:01.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker (with network access to the device) to obtain the configuration file, including hashed credential data. Successful exploitation could allow access to hashed credential data with a single unauthenticated GET request. Additional Analyst Notes: - CVE Program Container: References: - https://plummac.com/project/ik-401/ - https://www.cert.pl/news/single/coraz-wiecej-urzadzen-przemyslowych-podlaczonych-do-internetu/
CVE ID: CVE-2020-28947 State: PUBLISHED Published: 2020-11-19T17:44:26 Last Updated: 2024-08-04T16:48:00.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/626ca544ffb5604ea01bb291f69811668b6b5631
CVE ID: CVE-2020-28948 State: PUBLISHED Published: 2020-11-19T18:14:33 Last Updated: 2024-08-04T16:48:00.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pear/Archive_Tar/issues/33 - https://www.drupal.org/sa-core-2020-013 - https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/ - https://lists.fedoraproject.org/archives/list/package-announce%
aproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/ - https://www.debian.org/security/2020/dsa-4817 - https://security.gentoo.org/glsa/202101-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/ - https://lists.fedo
/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
CVE ID: CVE-2020-28949 State: PUBLISHED Published: 2020-11-19T18:14:18.000Z Last Updated: 2025-10-21T23:35:32.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pear/Archive_Tar/issues/33 - https://www.drupal.org/sa-core-2020-013 - https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess
ce/2020/11/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/ - https://www.debian.org/security/2020/dsa-4817 - http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html - http
g/security/2020/dsa-4817 - http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html - https://security.gentoo.org/glsa/202101-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
CVE ID: CVE-2020-28950 State: PUBLISHED Published: 2020-12-04T21:11:56 Last Updated: 2024-08-04T16:48:00.656Z Vendors: n/a Products: Kaspersky Anti-Ransomware Tool Problem Types: Local Privilege Escalation (LPE) Description: The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720
CVE ID: CVE-2020-28951 State: PUBLISHED Published: 2020-11-19T19:01:57 Last Updated: 2024-08-04T16:48:00.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_package in file.c and uci_strdup in util.c. Additional Analyst Notes: - CVE Program Container: References: - https://git.openwrt.org/?p=project/uci.git%3Ba=commit%3Bh=a3e650911f5e6f67dcff09974df3775dfd615da6 - https://git.openwrt.org/?p=openwrt/openwrt.git%3Ba=commit%3Bh=5625f5bc36954d644cb80adf8de47854c65d91c3 - https://git.openwrt.org/?p=openwrt/openwrt.git%3Ba=log%3Bh=refs
Ba=commit%3Bh=5625f5bc36954d644cb80adf8de47854c65d91c3 - https://git.openwrt.org/?p=openwrt/openwrt.git%3Ba=log%3Bh=refs/tags/v18.06.9
CVE ID: CVE-2020-28952 State: PUBLISHED Published: 2021-03-09T19:31:33 Last Updated: 2024-08-04T16:48:01.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices. Additional Analyst Not
7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices. Additional Analyst Notes: - CVE Program Container: References: - https://developer.athom.com/firmware - https://homey.app/en-us/ - https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952
CVE ID: CVE-2020-28953 State: PUBLISHED Published: 2020-11-19T21:15:05 Last Updated: 2024-08-04T16:48:00.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: In BigBlueButton before 2.2.29, a user can vote more than once in a single poll. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.28...v2.2.29 - https://github.com/bigbluebutton/bigbluebutton/commit/d2cb02b3bd670265c6b1ba003f87fc261e0ac3e1
CVE ID: CVE-2020-28954 State: PUBLISHED Published: 2020-11-19T21:14:53 Last Updated: 2024-08-04T16:48:01.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.28...v2.2.29 - https://github.com/bigbluebutton/bigbluebutton/commit/e59bcd0c33a6a3203c011faa8823ba2cac1e4f37 - https://github.com/bigbluebutton/bigbluebutton/issues/10818 - https://github.com/bigbluebutton/bigbluebutton/commit/5c911dde
s://github.com/bigbluebutton/bigbluebutton/issues/10818 - https://github.com/bigbluebutton/bigbluebutton/commit/5c911ddeec4493f40f42e2f137800ed4692004a4
CVE ID: CVE-2020-28955 State: PUBLISHED Published: 2021-10-22T19:20:19 Last Updated: 2024-08-04T16:48:00.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2257
CVE ID: CVE-2020-28956 State: PUBLISHED Published: 2021-10-22T19:20:18 Last Updated: 2024-08-04T16:48:01.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2249
CVE ID: CVE-2020-28957 State: PUBLISHED Published: 2021-10-22T19:20:17 Last Updated: 2024-08-04T16:48:01.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2241
CVE ID: CVE-2020-28960 State: PUBLISHED Published: 2021-10-22T19:20:13 Last Updated: 2024-08-04T16:48:01.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via the id and cid parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2259
CVE ID: CVE-2020-28961 State: PUBLISHED Published: 2021-10-22T19:20:16 Last Updated: 2024-08-04T16:48:01.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2231
CVE ID: CVE-2020-28963 State: PUBLISHED Published: 2021-10-22T19:20:11 Last Updated: 2024-08-04T16:48:00.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2258
CVE ID: CVE-2020-28964 State: PUBLISHED Published: 2021-10-22T19:20:09 Last Updated: 2024-08-04T16:48:01.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function. This vulnerability allows attackers to escalate local process privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2236