Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25454 State: PUBLISHED Published: 2020-11-18T20:52:25 Last Updated: 2024-08-04T15:33:05.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/160107/Grocy-Household-Management-Solution-2.7.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-25459 State: PUBLISHED Published: 2022-06-16T20:36:30 Last Updated: 2024-08-04T15:33:05.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FederatedAI/FATE/commit/6feccf6d752184a6f9365d56a76fe627983e7139
CVE ID: CVE-2020-25461 State: PUBLISHED Published: 2020-12-04T16:58:08 Last Updated: 2024-08-04T15:33:05.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invalid Memory Access in the fxProxyGetter function in moddable/xs/sources/xsProxy.c in Moddable SDK before OS200908 causes a denial of service (SEGV). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Moddable-OpenSource/moddable/issues/441 - https://github.com/Moddable-OpenSource/moddable/releases/tag/OS200908
CVE ID: CVE-2020-25462 State: PUBLISHED Published: 2020-12-04T16:58:08 Last Updated: 2024-08-04T15:33:05.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap buffer overflow in the fxCheckArrowFunction function at moddable/xs/sources/xsSyntaxical.c:3562 in Moddable SDK before OS200903. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Moddable-OpenSource/moddable/issues/432 - https://github.com/Moddable-OpenSource/moddable/releases/tag/OS200903
CVE ID: CVE-2020-25463 State: PUBLISHED Published: 2020-12-04T16:58:08 Last Updated: 2024-08-04T15:33:05.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invalid Memory Access in fxUTF8Decode at moddable/xs/sources/xsCommon.c:916 in Moddable SDK before OS200908 causes a denial of service (SEGV). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Moddable-OpenSource/moddable/issues/440 - https://github.com/Moddable-OpenSource/moddable/releases/tag/OS200908
CVE ID: CVE-2020-25464 State: PUBLISHED Published: 2020-12-04T16:58:09 Last Updated: 2024-08-04T15:33:05.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Moddable-OpenSource/moddable/issues/431
CVE ID: CVE-2020-25465 State: PUBLISHED Published: 2020-12-04T16:58:09 Last Updated: 2024-08-04T15:33:05.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Moddable-OpenSource/moddable/issues/442 - https://github.com/Moddable-OpenSource/moddable/releases/tag/OS200908
CVE ID: CVE-2020-25466 State: PUBLISHED Published: 2020-10-23T14:23:16 Last Updated: 2024-08-04T15:33:05.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://crmeb.com - https://github.com/crmeb/CRMEB - https://github.com/crmeb/CRMEB/issues/22
CVE ID: CVE-2020-25467 State: PUBLISHED Published: 2021-06-10T15:41:29 Last Updated: 2024-08-04T15:33:05.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a crafted compressed file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/lrzip/+bug/1893641 - https://github.com/ckolivas/lrzip/issues/163 - https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html
CVE ID: CVE-2020-25470 State: PUBLISHED Published: 2020-10-26T13:37:10 Last Updated: 2024-08-04T15:33:05.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AntSwordProject/antSword/issues/256
CVE ID: CVE-2020-25472 State: PUBLISHED Published: 2020-11-24T14:28:07 Last Updated: 2024-08-04T15:33:05.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl - https://news.websec.nl - https://www.linkedin.com/feed/update/urn:li:activity:6736997788850122752
CVE ID: CVE-2020-25473 State: PUBLISHED Published: 2020-11-24T14:29:20 Last Updated: 2024-08-04T15:33:05.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/ - https://news.websec.nl/ - https://www.linkedin.com/feed/update/urn:li:activity:6736997788850122752
CVE ID: CVE-2020-25474 State: PUBLISHED Published: 2020-11-24T14:48:30 Last Updated: 2024-08-04T15:33:05.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl - https://news.websec.nl - https://www.linkedin.com/feed/update/urn:li:activity:6736997788850122752
CVE ID: CVE-2020-25475 State: PUBLISHED Published: 2020-11-24T14:49:16 Last Updated: 2024-08-04T15:33:05.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/ - https://www.linkedin.com/feed/update/urn:li:activity:6736997788850122752
CVE ID: CVE-2020-25476 State: PUBLISHED Published: 2021-01-07T16:04:39 Last Updated: 2024-08-04T15:33:05.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload. Additional Analyst Notes: - CVE Program Container: Refer
in case an admin visits the calendar that injected the payload. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119318646 - https://github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch - https://github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch
CVE ID: CVE-2020-25483 State: PUBLISHED Published: 2020-10-23T17:12:29 Last Updated: 2024-08-04T15:33:05.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server. Additional Analyst Notes: - CVE Program Container: References: - https://sunian19.github.io/2020/09/08/UCMS%20v.1.4.8%20Command%20execution/
CVE ID: CVE-2020-25487 State: PUBLISHED Published: 2020-09-22T16:54:00 Last Updated: 2024-08-04T15:33:05.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php. Additional Analyst Notes: - CVE Program Container: References: - http://phpgurukul.com - https://phpgurukul.com/zoo-management-system-using-php-and-mysql/ - https://github.com/Ko-kn3t/CVE-2020-25487
CVE ID: CVE-2020-25489 State: PUBLISHED Published: 2020-09-17T17:14:33 Last Updated: 2024-08-04T15:33:05.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sqreen/PyMiniRacer/compare/v0.2.0...v0.3.0 - https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/
CVE ID: CVE-2020-25490 State: PUBLISHED Published: 2020-09-17T16:58:56 Last Updated: 2024-08-04T15:33:05.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution inside the virtual machine. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/
CVE ID: CVE-2020-25491 State: PUBLISHED Published: 2022-09-16T19:37:31 Last Updated: 2024-08-04T15:33:05.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: 6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting (XSS) via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mhmtayberk/969add4b6c77f122a3a3a0cb00e2975b
CVE ID: CVE-2020-25493 State: PUBLISHED Published: 2021-02-11T16:33:50 Last Updated: 2024-08-04T15:33:05.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic. Additional Analyst Notes: - CVE Program Container: References: - http://oclean.com - https://play.google.com/store/apps/details?id=com.yunding.noopsychebrushforeign - https://github.com/c3r34lk1ll3r/decrypt-oclean-traffic
CVE ID: CVE-2020-25494 State: PUBLISHED Published: 2020-12-18T14:27:09 Last Updated: 2024-08-04T15:33:05.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/SCO%20Openserver%20OS%20Command%20Injection%20Vulnerability - http://packetstormsecurity.com/files/160635/SCO-Openserver-5.0.7-Command-Injection.html
CVE ID: CVE-2020-25495 State: PUBLISHED Published: 2020-12-18T14:28:09 Last Updated: 2024-08-04T15:33:05.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/SCO%20Openserver%20XSS%20%26%20HTML%20Injection%20vulnerability - http://packetstormsecurity.com/files/160634/SCO-Openserver-5.0.7-Cross-Site-Scripting.html
CVE ID: CVE-2020-25498 State: PUBLISHED Published: 2021-01-06T21:19:21 Last Updated: 2024-08-04T15:33:05.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter. Additional Analyst Notes: - CVE Program Container: References: - http://beetel.com - https://github.com/the-girl-who-lived/CVE-2020-25498 - https://youtu.be/qeVHvmS5wtI - https://youtu.be/u_6yBIMF74A
CVE ID: CVE-2020-25499 State: PUBLISHED Published: 2020-12-09T20:30:55 Last Updated: 2024-08-04T15:33:05.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router. Additional Analyst Notes: - CVE Program Container: References: - https://www.totolink.net/home/index/newsss/id/196.html - https://github.com/kdoos/Vulnerabilities/blob/main/RCE_TOTOLINK-A3002RU-V2
CVE ID: CVE-2020-25502 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T17:47:53.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a local attacker to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://endpoint.com - http://cybereason.com - https://www.cybereason.com/cybereason-vulnerability-disclosure
CVE ID: CVE-2020-25506 State: PUBLISHED Published: 2021-02-02T13:00:11.000Z Last Updated: 2025-10-21T23:35:29.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183 - https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675
CVE ID: CVE-2020-25507 State: PUBLISHED Published: 2020-12-28T19:33:43 Last Updated: 2024-08-04T15:33:05.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home
orce all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW). Additional Analyst Notes: - CVE Program Container: References: - https://docs.nomagic.com/display/TWCloud190/Installation+on+Linux+using+scripts - https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-002.md - https://sick.codes/sick-2020-002/ - https://community.nomagic.com/finding-and-fixing-wrong-file-permis
ICK-2020-002.md - https://sick.codes/sick-2020-002/ - https://community.nomagic.com/finding-and-fixing-wrong-file-permission-twc-installation-t7165.html - https://sick.codes/finding-a-vulnerability-in-teamwork-cloud-server-nomagic-3ds-which-is-used-by-gov-enterprise-to-design-rockets-missiles-and-satellites - https://web.archive.org/web/20201219155833/https://docs.nomagic.com/pages/viewpage.action?pageId=20846937 - https://web.archive.org/web/20201219095507/https://docs.nomagic.com/display/TWCloud185SP1/Installation+on+Centos+7.
CVE ID: CVE-2020-25514 State: PUBLISHED Published: 2020-09-22T17:54:18 Last Updated: 2024-08-04T15:33:05.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://simple.com - https://www.sourcecodester.com - https://github.com/Ko-kn3t/CVE-2020-25514
CVE ID: CVE-2020-25515 State: PUBLISHED Published: 2020-09-22T17:55:22 Last Updated: 2024-08-04T15:33:05.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books. Additional Analyst Notes: - CVE Program Container: References: - http://simple.com - https://www.sourcecodester.com - https://github.com/Ko-kn3t/CVE-2020-25515
CVE ID: CVE-2020-25516 State: PUBLISHED Published: 2020-10-29T12:30:57 Last Updated: 2024-08-04T15:33:05.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0781 - https://github.com/piuppi/Proof-of-Concepts/blob/main/WSO2/CVE-2020-25516.md
CVE ID: CVE-2020-25533 State: PUBLISHED Published: 2021-01-15T21:55:22 Last Updated: 2024-08-04T15:33:05.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by leveraging a race condition during crafted use of posix_spawn. Additional Analyst Notes: - CVE Program Container: References: - https:
ace condition during crafted use of posix_spawn. Additional Analyst Notes: - CVE Program Container: References: - https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/
CVE ID: CVE-2020-25537 State: PUBLISHED Published: 2020-11-30T17:17:11 Last Updated: 2024-08-04T15:33:05.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission. Additional Analyst Notes: - CVE Program Container: References: - https://sunian19.github.io/2020/09/11/UCMS%20v1.5.0%20Arbitrary%20file%20upload%20vulnerability/ - https://github.com/BigTiger2020/UCMS/blob/main/UCMS%20v1.5.0%20Arbitrary%20file%20upload%20vulnerability%20get%20shell.md
CVE ID: CVE-2020-25538 State: PUBLISHED Published: 2020-11-13T15:20:40 Last Updated: 2024-08-04T15:33:05.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html - http://packetstormsecurity.com/files/161162/CMSUno-1.6.2-Remote-Code-Execution.html
CVE ID: CVE-2020-25540 State: PUBLISHED Published: 2020-09-14T12:22:40 Last Updated: 2024-08-04T15:33:05.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zoujingli/ThinkAdmin/issues/244 - https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/ - http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html
CVE ID: CVE-2020-25557 State: PUBLISHED Published: 2020-11-13T15:25:13 Last Updated: 2024-08-04T15:33:05.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the application, attacker's code will be run. As a result of this vulnerability, authenticated user can run command on the server. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution.html - http://packetstormsecurity.com/files/161162/CMSUno-1.6.2-Remote-Code-Execution.html
CVE ID: CVE-2020-25559 State: PUBLISHED Published: 2020-09-16T12:38:57 Last Updated: 2024-08-04T15:33:05.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnuplot 5.5 is affected by double free when executing print_set_output. This may result in context-dependent arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/gnuplot/bugs/2312/
CVE ID: CVE-2020-25560 State: PUBLISHED Published: 2021-08-11T20:12:43 Last Updated: 2024-08-04T15:33:05.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on “ping”, “traceroute” and “snmp” functions and execute code on the server. We also observed the same is true if the JSESSIONID is completely removed. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cv
m Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25560-sapphireims-unauthenticated-remote-command-execution-on-server/
CVE ID: CVE-2020-25561 State: PUBLISHED Published: 2021-08-11T20:14:38 Last Updated: 2024-08-04T15:33:05.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25561-sapphireims-hardcoded-credentials/
CVE ID: CVE-2020-25562 State: PUBLISHED Published: 2021-08-11T20:20:59 Last Updated: 2024-08-04T15:33:05.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account resent. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25562-sapphireims-csrf/