Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-23451 State: PUBLISHED Published: 2020-09-15T13:15:59 Last Updated: 2024-08-04T14:58:14.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function. Additional Analyst Notes: - CVE Program Container: References: - http://spiceworks.com - https://abuyv.com/cve/spiceworks-csrf-via-xss
CVE ID: CVE-2020-23452 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-11-26T16:06:19.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SeleniumHQ/selenium/issues/8259
CVE ID: CVE-2020-23466 State: PUBLISHED Published: 2022-08-19T01:08:35 Last Updated: 2024-08-04T14:58:15.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48522 - https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/
CVE ID: CVE-2020-23469 State: PUBLISHED Published: 2021-09-22T19:22:07 Last Updated: 2024-08-04T14:58:15.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gmate/gmate/issues/191 - https://cwe.mitre.org/data/definitions/1333.html
CVE ID: CVE-2020-23478 State: PUBLISHED Published: 2021-09-22T19:23:20 Last Updated: 2024-08-04T14:58:15.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leo-editor/leo-editor/issues/1597 - https://cwe.mitre.org/data/definitions/1333.html
CVE ID: CVE-2020-23481 State: PUBLISHED Published: 2021-09-22T19:47:33 Last Updated: 2024-08-04T14:58:15.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12317
CVE ID: CVE-2020-23489 State: PUBLISHED Published: 2020-11-16T17:04:08 Last Updated: 2024-08-04T14:58:15.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WWBN/AVideo/commit/ecc5f40470bbafff231133f58db1df70f47bfb33 - https://cube01.io/blog/Avideo-Remote-Code-Execution.html
CVE ID: CVE-2020-23490 State: PUBLISHED Published: 2020-11-16T17:03:52 Last Updated: 2024-08-04T14:58:15.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WWBN/AVideo/commit/218c98cbd4a4a2c15745852bcd0f29faf101bd8c - https://cube01.io/blog/Avideo-Remote-Code-Execution.html
CVE ID: CVE-2020-23512 State: PUBLISHED Published: 2020-09-15T13:40:33 Last Updated: 2024-08-04T14:58:15.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: VR CAM P1 Model P1 v1 has an incorrect access control vulnerability where an attacker can obtain complete access of the device from web (remote) without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.iotpentest.com/2020/05/vr-360-camera-general-wlak.html
CVE ID: CVE-2020-23517 State: PUBLISHED Published: 2021-03-26T01:08:38 Last Updated: 2024-08-04T14:58:15.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. Additional Analyst Notes: - CVE Program Container: References: - https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html
CVE ID: CVE-2020-23518 State: PUBLISHED Published: 2021-03-02T16:53:15 Last Updated: 2024-08-04T14:58:15.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47289
CVE ID: CVE-2020-23520 State: PUBLISHED Published: 2020-12-09T15:34:38 Last Updated: 2024-08-04T14:58:15.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/peacexie/imcat/issues/4
CVE ID: CVE-2020-23522 State: PUBLISHED Published: 2021-01-19T12:07:21 Last Updated: 2024-08-04T14:58:14.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pixelimity/pixelimity/issues/20 - http://packetstormsecurity.com/files/161276/Pixelimity-1.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2020-23533 State: PUBLISHED Published: 2021-04-06T15:34:59 Last Updated: 2024-08-04T14:58:15.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL. Additional Analyst Notes: - CVE Program Container: References: - https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0 - https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0 - http://mobitec.ie.cuhk
code.py?dl=0 - https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0 - http://mobitec.ie.cuhk.edu.hk/cve_2020/ - https://cwe.mitre.org/data/definitions/347.html
CVE ID: CVE-2020-23534 State: PUBLISHED Published: 2021-02-25T15:59:14 Last Updated: 2024-08-04T14:58:14.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery (SSRF) vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gopeak/masterlab/issues/254
CVE ID: CVE-2020-23539 State: PUBLISHED Published: 2021-04-08T16:45:38 Last Updated: 2024-08-04T14:58:14.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_REQ message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pokerfacett/MY_REQUEST/blob/df73fe140655ea44542b03ac186e6c2b47e97540/Realtek%208723ds%20BLE%20SDK%20denial%20of%20service%20attack.md
CVE ID: CVE-2020-23545 State: PUBLISHED Published: 2021-12-15T07:04:15 Last Updated: 2024-08-04T14:58:15.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM_W+0x0000000000000531. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research/blob/master/README.md - https://github.com/nhiephon/Research/blob/master/Irfanview/0x0000000000000531.MD
CVE ID: CVE-2020-23546 State: PUBLISHED Published: 2021-10-28T21:09:48 Last Updated: 2024-08-04T14:58:15.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM file, related to a "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at FORMATS!ReadMosaic+0x0000000000000981. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research/blob/master/README.md - http://irfanview.com
CVE ID: CVE-2020-23549 State: PUBLISHED Published: 2021-10-28T21:09:49 Last Updated: 2024-08-04T14:58:15.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted .cr2 file, related to a "Data from Faulting Address controls Branch Selection starting at FORMATS!GetPlugInInfo+0x00000000000047f6". Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research/blob/master/README.md
CVE ID: CVE-2020-23550 State: PUBLISHED Published: 2022-09-16T02:42:33 Last Updated: 2024-08-04T14:58:15.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e82. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23551 State: PUBLISHED Published: 2022-09-16T02:43:45 Last Updated: 2024-08-04T14:58:14.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e30. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23552 State: PUBLISHED Published: 2022-09-16T02:44:43 Last Updated: 2024-08-04T14:58:15.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e62. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23553 State: PUBLISHED Published: 2022-09-16T02:45:31 Last Updated: 2024-08-04T14:58:15.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007d33. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23554 State: PUBLISHED Published: 2022-09-16T02:46:22 Last Updated: 2024-08-04T14:58:15.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e20. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23555 State: PUBLISHED Published: 2022-09-16T02:47:29 Last Updated: 2024-08-04T14:58:15.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e6e. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23556 State: PUBLISHED Published: 2022-09-16T02:48:15 Last Updated: 2024-08-04T14:58:14.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e28. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23557 State: PUBLISHED Published: 2022-09-16T02:49:12 Last Updated: 2024-08-04T14:58:15.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000755d. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23558 State: PUBLISHED Published: 2022-09-16T02:50:02 Last Updated: 2024-08-04T14:58:15.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000007f4b. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23559 State: PUBLISHED Published: 2022-09-16T02:50:45 Last Updated: 2024-08-04T14:58:15.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000007d7f. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23560 State: PUBLISHED Published: 2022-09-16T02:51:48 Last Updated: 2024-08-04T14:58:15.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000001bcab. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23561 State: PUBLISHED Published: 2022-07-17T23:10:10 Last Updated: 2024-08-04T14:58:15.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000005722. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23562 State: PUBLISHED Published: 2022-07-17T23:11:07 Last Updated: 2024-08-04T14:58:15.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000aefe. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23563 State: PUBLISHED Published: 2022-07-17T23:11:45 Last Updated: 2024-08-04T14:58:14.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000002cba. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://github.com/nhiephon/Research
CVE ID: CVE-2020-23564 State: PUBLISHED Published: 2023-08-05T00:00:00 Last Updated: 2024-10-17T14:51:11.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/a1ertx55/cmstest/blob/master/semcms.md - https://github.com/a1ertx55/cmstest/blob/main/semcms.md
CVE ID: CVE-2020-23565 State: PUBLISHED Published: 2021-11-05T16:09:42 Last Updated: 2024-08-04T14:58:15.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a "Data from Faulting Address controls Branch Selection starting at JPEG2000!ShowPlugInSaveOptions_W+0x0000000000032850". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/3
CVE ID: CVE-2020-23566 State: PUBLISHED Published: 2021-11-05T16:09:43 Last Updated: 2024-08-04T14:58:14.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/1
CVE ID: CVE-2020-23567 State: PUBLISHED Published: 2021-11-05T16:09:44 Last Updated: 2024-08-04T14:58:15.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to "Integer Divide By Zero starting at JPEG2000!ShowPlugInSaveOptions_W+0x00000000000082ea" Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/2
CVE ID: CVE-2020-23572 State: PUBLISHED Published: 2021-11-08T20:46:52 Last Updated: 2024-08-04T14:58:14.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/beescms/issues/6
CVE ID: CVE-2020-23574 State: PUBLISHED Published: 2020-08-19T15:16:33 Last Updated: 2024-08-04T14:58:15.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uploadfile_name1.htm form to a length of 368 or more bytes. This will create a buffer overflow condition, causing the application to crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.hosaka.co.uk/2020/06/08/sysax-multi-server-buffer-overflow/
CVE ID: CVE-2020-23575 State: PUBLISHED Published: 2021-05-10T22:24:06 Last Updated: 2024-08-04T14:58:15.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48561
CVE ID: CVE-2020-23576 State: PUBLISHED Published: 2020-08-27T15:25:35 Last Updated: 2024-08-04T14:58:14.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab. Additional Analyst Notes: - CVE Program Container: References: - https://vimeo.com/427083932
CVE ID: CVE-2020-23580 State: PUBLISHED Published: 2021-07-08T18:43:03 Last Updated: 2024-08-04T14:58:15.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DengyigeFeng/vuln/issues/1
CVE ID: CVE-2020-23582 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T20:14:06.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huzaifahussain98/CVE-2020-23582
CVE ID: CVE-2020-23583 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:46:08.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huzaifahussain98/CVE-2020-23583
CVE ID: CVE-2020-23584 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:44:15.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huzaifahussain98/CVE-2020-23584
CVE ID: CVE-2020-23585 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:43:00.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network". Additional Analyst Notes: - CVE Program Conta
r to "gain full privileges" and to "fully compromise of router & network". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huzaifahussain98/CVE-2020-23585
CVE ID: CVE-2020-23586 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:41:52.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huzaifahussain98/CVE-2020-23586
CVE ID: CVE-2020-23587 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:40:34.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huzaifahussain98/CVE-2020-23587