Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25282 State: PUBLISHED Published: 2020-09-11T21:17:56 Last Updated: 2024-08-04T15:33:05.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for the LG Universal Integrated Circuit Card) allows attackers to bypass intended access restrictions on property values. The LG ID is LVE-SMP-200020 (September 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2020-25283 State: PUBLISHED Published: 2020-09-11T21:18:13 Last Updated: 2024-08-04T15:33:05.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions on a certain mode. The LG ID is LVE-SMP-200021 (September 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2020-25284 State: PUBLISHED Published: 2020-09-13T17:28:33 Last Updated: 2024-08-04T15:33:05.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f44d04e696feaf13d192d942c4f14ad2e117065a - https://twitter.com/grsecurity/status/1304537507560919041 - https://lists.debian.org/debian-lts-
2d942c4f14ad2e117065a - https://twitter.com/grsecurity/status/1304537507560919041 - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
CVE ID: CVE-2020-25285 State: PUBLISHED Published: 2020-09-13T17:28:21 Last Updated: 2024-08-04T15:33:05.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467 - https://twitter.com/grsecurity/status/1303749848898904067 - https://cdn.kernel.org/pub/linux/ker
50e8e2833699b54e15467 - https://twitter.com/grsecurity/status/1303749848898904067 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8 - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html - https://security.netapp.com/advisory/ntap-20201009-0002/ - https://usn.ubuntu.com/4576-1/ - https://usn.ubuntu.com/4579-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
CVE ID: CVE-2020-25286 State: PUBLISHED Published: 2020-09-13T17:48:09 Last Updated: 2024-08-04T15:33:05.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/47984
CVE ID: CVE-2020-25287 State: PUBLISHED Published: 2020-09-13T17:58:18 Last Updated: 2024-08-04T15:33:05.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admin_editor.php the_file=..%2Findex.php&open=Open request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jenaye/pligg/blob/master/README.md
CVE ID: CVE-2020-25288 State: PUBLISHED Published: 2020-09-30T20:26:59 Last Updated: 2024-08-04T15:33:05.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=27275 - http://github.com/mantisbt/mantisbt/commit/221cf323f16a9738a5b27aaba94758f11281d85c
CVE ID: CVE-2020-25289 State: PUBLISHED Published: 2020-09-13T19:35:21 Last Updated: 2024-08-04T15:33:05.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory (which has weak permissions). Additional Analyst Notes: - CVE Program Container: References: - http://zeifan.my/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-arb-file-eop.html
CVE ID: CVE-2020-25291 State: PUBLISHED Published: 2020-09-13T19:35:09 Last Updated: 2024-08-04T15:33:05.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in Qt 4.x. Additional Analyst Notes: - CVE Program Container: References: - http://zeifan.my/security/rce/heap/2020/09/03/wps-rce-heap.html
CVE ID: CVE-2020-25340 State: PUBLISHED Published: 2021-02-16T14:23:50 Last Updated: 2024-08-04T15:33:05.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ntop/nDPI/issues/994
CVE ID: CVE-2020-25343 State: PUBLISHED Published: 2020-10-07T13:55:32 Last Updated: 2024-08-04T15:33:05.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48773
CVE ID: CVE-2020-25351 State: PUBLISHED Published: 2021-08-20T18:10:46 Last Updated: 2024-08-04T15:33:05.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script. Additional Analyst Notes: - CVE Program Container: References: - https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE ID: CVE-2020-25352 State: PUBLISHED Published: 2021-08-20T18:10:48 Last Updated: 2024-08-04T15:33:05.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving. Additional Analyst Notes: - CVE Program Container: References: - https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE ID: CVE-2020-25353 State: PUBLISHED Published: 2021-08-20T18:10:49 Last Updated: 2024-08-04T15:33:05.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters. Additional Analyst Notes: - CVE Program Container: References: - https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE ID: CVE-2020-25359 State: PUBLISHED Published: 2021-08-20T18:10:52 Last Updated: 2024-08-04T15:33:05.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delete all the files with that extension in that path. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/36.html - https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE ID: CVE-2020-25362 State: PUBLISHED Published: 2021-06-02T16:50:09 Last Updated: 2024-08-04T15:33:05.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: The id paramater in Online Shopping Alphaware 1.0 has been discovered to be vulnerable to an Error-Based blind SQL injection in the /alphaware/details.php path. This allows an attacker to retrieve all databases. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql - https://www.exploit-db.com/exploits/48771 - https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html
CVE ID: CVE-2020-25366 State: PUBLISHED Published: 2021-11-04T10:12:10 Last Updated: 2024-08-04T15:33:05.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - https://github.com/sek1th/iot/blob/master/dir823g_upfw_dos.md
CVE ID: CVE-2020-25367 State: PUBLISHED Published: 2021-11-04T09:58:27 Last Updated: 2024-08-04T15:33:05.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login. Additional Analyst Notes: - CVE Program Container: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - https://github.com/sek1th/iot/blob/master/dir823g_3.md
CVE ID: CVE-2020-25368 State: PUBLISHED Published: 2021-11-04T10:19:44 Last Updated: 2024-08-04T15:33:05.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the PrivateLogin field to Login. Additional Analyst Notes: - CVE Program Container: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - https://github.com/sek1th/iot/blob/master/dir-823g_2.md
CVE ID: CVE-2020-25374 State: PUBLISHED Published: 2020-10-28T19:45:46 Last Updated: 2024-08-04T15:33:05.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time. Additional Analyst Notes: - CVE Program Container: References: - https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20SysReq/System%20Requirements%20-%20PSM.htm - https://medium.com/%40virajmota38/full-path-disclosure-8a9358e5a867
CVE ID: CVE-2020-25375 State: PUBLISHED Published: 2020-09-14T15:11:02 Last Updated: 2024-08-04T15:33:05.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field. Additional Analyst Notes: - CVE Program Container: References: - https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2
CVE ID: CVE-2020-25378 State: PUBLISHED Published: 2020-09-14T15:25:12 Last Updated: 2024-08-04T15:33:05.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/
CVE ID: CVE-2020-25379 State: PUBLISHED Published: 2020-09-14T15:29:10 Last Updated: 2024-08-04T15:33:05.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/
CVE ID: CVE-2020-25380 State: PUBLISHED Published: 2020-09-14T15:33:56 Last Updated: 2024-08-04T15:33:05.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed. Additional Analyst Notes: - CVE Program Container: References: - https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/
CVE ID: CVE-2020-25385 State: PUBLISHED Published: 2021-01-20T00:45:51 Last Updated: 2024-08-04T15:33:05.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting
CVE ID: CVE-2020-25391 State: PUBLISHED Published: 2021-07-09T21:56:09 Last Updated: 2024-08-04T15:33:05.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Pages' field under the 'Pages Content' module. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/cszcms/tickets/1/
CVE ID: CVE-2020-25392 State: PUBLISHED Published: 2021-07-09T21:56:07 Last Updated: 2024-08-04T15:33:05.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Article' field under the 'Article' plugin. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/cszcms/tickets/2/
CVE ID: CVE-2020-25394 State: PUBLISHED Published: 2021-07-09T21:56:06 Last Updated: 2024-08-04T15:33:05.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in moziloCMS 2.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Content" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mozilo/mozilo2.0/issues/28
CVE ID: CVE-2020-25398 State: PUBLISHED Published: 2020-11-05T15:08:32 Last Updated: 2024-08-04T15:33:05.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/h3llraiser/CVE-2020-25398
CVE ID: CVE-2020-25399 State: PUBLISHED Published: 2020-11-05T15:06:18 Last Updated: 2024-08-04T15:33:05.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/h3llraiser/CVE-2020-25399
CVE ID: CVE-2020-25400 State: PUBLISHED Published: 2020-11-17T17:58:46 Last Updated: 2024-08-04T15:33:05.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data such as access token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JordanKnott/taskcafe
CVE ID: CVE-2020-25406 State: PUBLISHED Published: 2020-11-18T15:51:09 Last Updated: 2024-08-04T15:33:05.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files. Additional Analyst Notes: - CVE Program Container: References: - https://www.misakikata.com/codes/File%20Upload.html
CVE ID: CVE-2020-25408 State: PUBLISHED Published: 2021-05-24T12:45:57 Last Updated: 2024-08-04T15:33:05.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or make a new entry of the student, faculty, teacher, subject, scores, location, and article data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/olotieno/College-Management-System-Php/ - https://nikhilkumar01.medium.com/cve-2020-25408-97eb7bcc23a6
CVE ID: CVE-2020-25409 State: PUBLISHED Published: 2021-05-24T12:39:12 Last Updated: 2024-08-04T15:33:05.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/olotieno/College-Management-System-Php/tree/master/College-Management-System%20in%20Php_5.5/College-Management-System%20in%20Php_5.5 - https://nikhilkumar01.medium.com/cve-2020-25409-5ecbe735c004
CVE ID: CVE-2020-25411 State: PUBLISHED Published: 2021-05-24T12:40:44 Last Updated: 2024-08-04T15:33:05.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-examination-systen-in-php - https://nikhilkumar01.medium.com/cve-2020-25411-a245bdf88fb5
CVE ID: CVE-2020-25412 State: PUBLISHED Published: 2020-09-16T13:53:04 Last Updated: 2024-08-04T15:33:05.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/gnuplot/bugs/2303/
CVE ID: CVE-2020-25414 State: PUBLISHED Published: 2021-06-17T14:21:36 Last Updated: 2024-08-04T15:33:05.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/469
CVE ID: CVE-2020-25422 State: PUBLISHED Published: 2021-10-28T18:30:09 Last Updated: 2024-08-04T15:33:05.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting (XSS) vulnerability in menuedit.php of Mara CMS 7.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/xss_payload/issues/2
CVE ID: CVE-2020-25427 State: PUBLISHED Published: 2022-01-10T21:01:52 Last Updated: 2024-08-04T15:33:05.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/8e585e623b1d666b4ef736ed609264639cb27701 - https://github.com/gpac/gpac/issues/1406
CVE ID: CVE-2020-25444 State: PUBLISHED Published: 2021-07-14T14:35:24 Last Updated: 2024-08-04T15:33:05.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profile” page, " (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e
CVE ID: CVE-2020-25445 State: PUBLISHED Published: 2021-07-14T14:40:48 Last Updated: 2024-08-04T15:33:05.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e
CVE ID: CVE-2020-25449 State: PUBLISHED Published: 2020-12-04T19:10:59 Last Updated: 2024-08-04T15:33:05.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column. Additional Analyst Notes: - CVE Program Container: References: - https://itsmeanonartist.tech/blogs/blog2.html - https://www.exploit-db.com/exploits/48791 - https://packetstormsecurity.com/files/159070/Cabot-0.11.12-Cross-Site-Scripting.html - https://www.exploitalert.com/view-details.html?id=36106
CVE ID: CVE-2020-25453 State: PUBLISHED Published: 2020-09-15T21:37:52 Last Updated: 2024-08-04T15:33:05.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackCatDevelopment/BlackCatCMS/issues/389 - http://packetstormsecurity.com/files/159237/BlackCat-CMS-1.3.6-Cross-Site-Request-Forgery.html