Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35674 State: PUBLISHED Published: 2020-12-24T03:05:28 Last Updated: 2024-08-04T17:09:14.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in
. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments. Additional Analyst Notes: - CVE Program Container: References: - https://labs.ingredous.com/2020/07/13/ois-sqli/
CVE ID: CVE-2020-35675 State: PUBLISHED Published: 2020-12-24T03:05:09 Last Updated: 2024-08-04T17:09:14.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application. Additional Analyst Notes: - CVE Program Container: References: - https://labs.ingredous.com/2020/07/13/ois-transfer-csrf/ - https://github.com/bigprof-software/online-invoicing-syste
- https://labs.ingredous.com/2020/07/13/ois-transfer-csrf/ - https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.0
CVE ID: CVE-2020-35676 State: PUBLISHED Published: 2020-12-24T03:04:56 Last Updated: 2024-08-04T17:09:14.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once the arbitrary Javascript is executed in the context of the admin, this will cause the attacker to gain administrative privileges, effectively leading into an application takeover. This affects app/membership_signup.php and app/admin/p
ive privileges, effectively leading into an application takeover. This affects app/membership_signup.php and app/admin/pageViewMembers.php. Additional Analyst Notes: - CVE Program Container: References: - https://labs.ingredous.com/2020/07/13/ois-membershipsignup-xss/ - https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.1
CVE ID: CVE-2020-35677 State: PUBLISHED Published: 2020-12-24T03:04:43 Last Updated: 2024-08-04T17:09:14.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the payload. One might think this completely mitigates the privilege-escalation impact as there is only one high-privileged role. However, it was discovered that the endpoint responsible for creating the group lacks CSRF protection. Additio
ged role. However, it was discovered that the endpoint responsible for creating the group lacks CSRF protection. Additional Analyst Notes: - CVE Program Container: References: - https://labs.ingredous.com/2020/07/13/ois-groupedit-xss/
CVE ID: CVE-2020-35678 State: PUBLISHED Published: 2020-12-27T00:00:10 Last Updated: 2024-08-04T17:09:14.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Autobahn|Python before 20.12.3 allows redirect header injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/crossbario/autobahn-python - https://github.com/crossbario/autobahn-python/compare/v20.12.2...v20.12.3 - https://pypi.org/project/autobahn/20.12.3/ - https://autobahn.readthedocs.io/en/latest/changelog.html - https://github.com/crossbario/autobahn-python/pull/1439
CVE ID: CVE-2020-35679 State: PUBLISHED Published: 2020-12-24T15:53:23 Last Updated: 2024-08-04T17:09:14.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups. Additional Analyst Notes: - CVE Program Container: References: - https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/ - https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html - https://github.com/openbsd/src/commit/79a034b4aed29e965f45a1
//www.mail-archive.com/misc%40opensmtpd.org/msg05188.html - https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/ - https://security.gentoo.org/glsa/202105-12
CVE ID: CVE-2020-35680 State: PUBLISHED Published: 2020-12-24T15:53:03 Last Updated: 2024-08-04T17:09:14.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer. Additional Analyst Notes: - CVE Program Container: References: - https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-
oolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/ - https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html - https://github.com/openbsd/src/commit/6c3220444ed06b5796dedfd53a0f4becd903c0d1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/ - https://security.gentoo.org/glsa/202105-12
CVE ID: CVE-2020-35681 State: PUBLISHED Published: 2021-02-22T02:03:14 Last Updated: 2024-08-04T17:09:14.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the
client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/django/channels/releases - https://channels.readthedocs.io/en/stable/releases/index.html - https://channels.readthedocs.io/en/stable/releases/3.0.3.html
CVE ID: CVE-2020-35682 State: PUBLISHED Published: 2021-03-13T18:18:15 Last Updated: 2024-08-04T17:09:14.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login). Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/on-premises/readme.html#11134
CVE ID: CVE-2020-35683 State: PUBLISHED Published: 2021-08-19T11:13:13 Last Updated: 2024-08-04T17:09:14.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the ICMP checksum. When the IP payload size is set to be smaller than the size of the IP header, the ICMP checksum computation function may read out of bounds, causing a Denial-of-Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.hcc-embedded.com - https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf - https:
er: References: - https://www.hcc-embedded.com - https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-35684 State: PUBLISHED Published: 2021-08-19T11:19:01 Last Updated: 2024-08-04T17:09:14.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the length of the TCP payload within the TCP checksum computation function. When the IP payload size is set to be smaller than the size of the IP header, the TCP checksum computation function may read out of bounds (a low-impact write-out-of-bounds is also possible). Additional Analyst Notes: - CVE Program Container: References: - https://www.hcc-embedded
t-of-bounds is also possible). Additional Analyst Notes: - CVE Program Container: References: - https://www.hcc-embedded.com - https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-35685 State: PUBLISHED Published: 2021-08-19T11:21:08 Last Updated: 2024-08-04T17:09:14.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.) Additional Analyst Notes: - CVE Program Container: References: - https://www.hcc-embedded.com - https://cert-
RFC 6528.) Additional Analyst Notes: - CVE Program Container: References: - https://www.hcc-embedded.com - https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-35686 State: PUBLISHED Published: 2021-01-13T05:05:26 Last Updated: 2024-08-04T17:09:14.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may allow escalation of privilege via a fake DLL. (As a resolution, Windows Update is being submitted for all affected products to update to 2.0.9.18 or later.) Additional Analyst Notes: - CVE Program Container: References: - https://www.soundresearch.com/wp-content/uploads/static/CVE-2020-35686.html
CVE ID: CVE-2020-35687 State: PUBLISHED Published: 2021-01-13T16:52:43 Last Updated: 2024-08-04T17:09:14.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPFusion/PHPFusion/issues/2347 - https://www.exploit-db.com/exploits/49426
CVE ID: CVE-2020-35693 State: PUBLISHED Published: 2020-12-24T18:02:08 Last Updated: 2024-08-04T17:09:14.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part o
h as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5. Additional Analyst Notes: - CVE Program Container: References: - https://githu
Pro (2018), Galaxy Note 4, and Galaxy S5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alwentiu/contact-tracing-research/blob/main/samsung.pdf
CVE ID: CVE-2020-35698 State: PUBLISHED Published: 2023-07-25T00:00:00 Last Updated: 2024-10-23T20:05:50.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: Affected Source code of the website CMS which is been used by many to host their online courses using the Thinkific Platform. The attack vector is: To exploit the vulnerability any user has to just visit the link - https://hacktify.thinkific.com/account/billing?success=%E2%80%AA%3Cscript%3Ealert(1)%3C/script%3E. ¶¶ Thinkific is a Website based Learning Platform P
/account/billing?success=%E2%80%AA%3Cscript%3Ealert(1)%3C/script%3E. ¶¶ Thinkific is a Website based Learning Platform Product which is used by thousands of users worldwide. There is a Cross Site Scripting (XSS) based vulnerability in the code of the CMS where any attacker can execute a XSS attack. Proof of Concept & Steps to Reproduce: Step1 : Go to Google.com Step 2 : Search for this Dork site:thinkific.com -www Step 3 : You will get a list of websites which are running on the thinkific domains. Step 4 : Create account and signin in any of the website Step 5 : Add this endpoint at the end of the domain and you will see that there is a XSS Alert /account/billing?success=%E2%80%AA<script>ale
dpoint at the end of the domain and you will see that there is a XSS Alert /account/billing?success=%E2%80%AA<script>alert(1)</script> Step 6 : Choose any domains from google for any website this exploit will work on all the websites as it is a code based flaw in the CMS Step 7 : Thousands of websites are vulnerable due to this vulnerable code in the CMS itself which is giving rise to the XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40rohitgautam26/cve-2020-35698-a922189c42ef
CVE ID: CVE-2020-35700 State: PUBLISHED Published: 2021-02-08T08:08:15 Last Updated: 2024-08-04T17:09:15.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/librenms/librenms/blob/master/app/Http/Controllers/Widgets/TopDevicesController.php - https://github.com/librenms/librenms/issues/12405 - https://www.horizon3.ai
ntrollers/Widgets/TopDevicesController.php - https://github.com/librenms/librenms/issues/12405 - https://www.horizon3.ai/disclosures/librenms-second-order-sqli - https://github.com/librenms/librenms/pull/12422 - https://github.com/librenms/librenms/releases/tag/21.1.0
CVE ID: CVE-2020-35701 State: PUBLISHED Published: 2021-01-11T15:57:51 Last Updated: 2024-08-04T17:09:15.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://asaf.me/2020/12/15/cacti-1-2-0-to-1-2-16-sql-injection/ - https://github.com/Cacti/cacti/issues/4022 - https://security.gentoo.org/glsa/202101-31 - https://lists.fedoraproject.org/archives/list/package-announce%40lis
4022 - https://security.gentoo.org/glsa/202101-31 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBKBR2MFZJ6C2I4I5PCRR6UERPY24XZN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DDD22Z56THHDTXAFM447UH3BVINURIF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7DPUWZBAMCXFKAKUAJSHL3CKTOLGAK6/
CVE ID: CVE-2020-35702 State: PUBLISHED Published: 2020-12-25T01:02:58 Last Updated: 2024-08-04T17:09:15.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects Additional Analyst Notes: - CVE Progr
t arbitrary times, and therefore the CVE remains useful to users of those projects Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011
CVE ID: CVE-2020-35704 State: PUBLISHED Published: 2020-12-25T05:24:56 Last Updated: 2024-08-04T17:09:15.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. Additional Analyst Notes: - CVE Program Container: References: - https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html - https://github.com/Bottelet/DaybydayCRM/releases
CVE ID: CVE-2020-35705 State: PUBLISHED Published: 2020-12-25T05:24:47 Last Updated: 2024-08-04T17:09:15.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. Additional Analyst Notes: - CVE Program Container: References: - https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html - https://github.com/Bottelet/DaybydayCRM/releases
CVE ID: CVE-2020-35706 State: PUBLISHED Published: 2020-12-25T05:24:38 Last Updated: 2024-08-04T17:09:15.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. Additional Analyst Notes: - CVE Program Container: References: - https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html - https://github.com/Bottelet/DaybydayCRM/releases
CVE ID: CVE-2020-35707 State: PUBLISHED Published: 2020-12-25T05:24:30 Last Updated: 2024-08-04T17:09:15.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. Additional Analyst Notes: - CVE Program Container: References: - https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html - https://github.com/Bottelet/DaybydayCRM/releases
CVE ID: CVE-2020-35708 State: PUBLISHED Published: 2020-12-25T05:24:04 Last Updated: 2024-08-04T17:09:15.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. Additional Analyst Notes: - CVE Program Container: References: - https://tufangungor.github.io/exploit/2020/12/15/phplist-3.5.9-sql-injection.html - https://sourceforge.net/projects/phplist/files/phplist/
CVE ID: CVE-2020-35709 State: PUBLISHED Published: 2020-12-25T18:42:48 Last Updated: 2024-08-04T17:09:15.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alexlang24/bloofoxCMS/issues/7
CVE ID: CVE-2020-35710 State: PUBLISHED Published: 2020-12-25T18:58:04 Last Updated: 2024-08-04T17:09:15.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data. Additional Analyst Notes: - CVE Program Container: References
something like "host":"192.168.###.###" in the POST data. Additional Analyst Notes: - CVE Program Container: References: - https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html - https://twitter.com/amadapa/status/1342407005110218753
CVE ID: CVE-2020-35711 State: PUBLISHED Published: 2020-12-25T22:59:09 Last Updated: 2024-08-04T17:09:15.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vorner/arc-swap/issues/45 - https://rustsec.org/advisories/RUSTSEC-2020-0091.html
CVE ID: CVE-2020-35712 State: PUBLISHED Published: 2020-12-25T23:46:36 Last Updated: 2024-08-04T17:09:15.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Additional Analyst Notes: - CVE Program Container: References: - https://support.esri.com/en/technical-article/000022931 - https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDEyODA2MA==