Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-19037 State: PUBLISHED Published: 2021-07-12T16:39:44 Last Updated: 2024-08-04T14:08:30.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/issues/135
CVE ID: CVE-2020-19038 State: PUBLISHED Published: 2021-07-12T16:45:48 Last Updated: 2024-08-04T14:08:30.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Deletion vulnerability in Halo 0.4.3 via delBackup. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/issues/136 - https://cwe.mitre.org/data/definitions/23.html
CVE ID: CVE-2020-19042 State: PUBLISHED Published: 2021-12-13T20:45:06 Last Updated: 2024-08-04T14:08:30.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zzb1999/CVE/blob/master/zzcms/XSS.md
CVE ID: CVE-2020-19046 State: PUBLISHED Published: 2021-08-31T13:15:37 Last Updated: 2024-08-04T14:08:30.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Aoyanm/audit/issues/1
CVE ID: CVE-2020-19047 State: PUBLISHED Published: 2021-08-31T13:15:38 Last Updated: 2024-08-04T14:08:30.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=system&action=admin_edit_act'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Aoyanm/audit/issues/2
CVE ID: CVE-2020-19048 State: PUBLISHED Published: 2021-08-31T13:16:34 Last Updated: 2024-08-04T14:08:30.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joelister/bug/issues/1
CVE ID: CVE-2020-19049 State: PUBLISHED Published: 2021-08-31T13:16:35 Last Updated: 2024-08-04T14:08:30.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joelister/bug/issues/2
CVE ID: CVE-2020-19107 State: PUBLISHED Published: 2021-05-05T21:12:17 Last Updated: 2024-08-04T14:08:30.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to edit_book.php, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/9
CVE ID: CVE-2020-19108 State: PUBLISHED Published: 2021-05-05T21:16:23 Last Updated: 2024-08-04T14:08:30.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online Book Store v1.0 via the pubid parameter to bookPerPub.php, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/10
CVE ID: CVE-2020-19109 State: PUBLISHED Published: 2021-05-05T21:20:25 Last Updated: 2024-08-04T14:08:30.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_edit.php, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/12
CVE ID: CVE-2020-19110 State: PUBLISHED Published: 2021-05-05T21:23:52 Last Updated: 2024-08-04T14:08:30.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/11
CVE ID: CVE-2020-19111 State: PUBLISHED Published: 2021-05-05T21:38:17 Last Updated: 2024-08-04T14:08:30.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php, which could let a remote mailicious user bypass authentication and obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/14 - https://cwe.mitre.org/data/definitions/287.html
CVE ID: CVE-2020-19112 State: PUBLISHED Published: 2021-05-05T21:43:07 Last Updated: 2024-08-04T14:08:30.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_delete.php, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/13
CVE ID: CVE-2020-19113 State: PUBLISHED Published: 2021-05-05T21:55:25 Last Updated: 2024-08-04T14:08:30.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/15
CVE ID: CVE-2020-19114 State: PUBLISHED Published: 2021-05-05T21:59:20 Last Updated: 2024-08-04T14:08:30.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online Book Store v1.0 via the publisher parameter to edit_book.php, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/8
CVE ID: CVE-2020-19118 State: PUBLISHED Published: 2021-07-27T18:10:03 Last Updated: 2024-08-04T14:08:30.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/14
CVE ID: CVE-2020-19131 State: PUBLISHED Published: 2021-09-07T14:06:26 Last Updated: 2024-08-04T14:08:30.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop". Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2831 - http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elibtiff%E4%B8%ADinvertimage%E5%87%BD%E6%95%B0%E5%A0%86%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%86%E6%9E%90/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html
CVE ID: CVE-2020-19137 State: PUBLISHED Published: 2021-09-08T20:18:22 Last Updated: 2024-08-04T14:08:30.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ShuaiJunlan/Autumn/issues/82
CVE ID: CVE-2020-19138 State: PUBLISHED Published: 2021-09-08T20:18:23 Last Updated: 2024-08-04T14:08:30.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/17796
CVE ID: CVE-2020-19142 State: PUBLISHED Published: 2020-12-10T21:07:35 Last Updated: 2024-08-04T14:08:30.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/65
CVE ID: CVE-2020-19143 State: PUBLISHED Published: 2021-09-09T14:25:44 Last Updated: 2024-08-04T14:08:30.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2851 - https://gitlab.com/libtiff/libtiff/-/issues/158 - https://gitlab.com/libtiff/libtiff/-/merge_requests/119 - https://security.netapp.com/advisory/ntap-20211004-0005/ - https://www.debian.org/security/2021/dsa-4997
CVE ID: CVE-2020-19144 State: PUBLISHED Published: 2021-09-09T14:25:45 Last Updated: 2024-08-04T14:08:30.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2852 - https://gitlab.com/libtiff/libtiff/-/issues/159 - https://security.netapp.com/advisory/ntap-20211004-0005/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html
CVE ID: CVE-2020-19146 State: PUBLISHED Published: 2021-09-15T13:52:47 Last Updated: 2024-08-04T14:08:30.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97884
CVE ID: CVE-2020-19147 State: PUBLISHED Published: 2021-09-15T13:52:48 Last Updated: 2024-08-04T14:08:30.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97883
CVE ID: CVE-2020-19148 State: PUBLISHED Published: 2021-09-15T13:52:49 Last Updated: 2024-08-04T14:08:30.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97879
CVE ID: CVE-2020-19150 State: PUBLISHED Published: 2021-09-15T13:52:49 Last Updated: 2024-08-04T14:08:30.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97885
CVE ID: CVE-2020-19151 State: PUBLISHED Published: 2021-09-15T13:52:51 Last Updated: 2024-08-04T14:08:30.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97881
CVE ID: CVE-2020-19154 State: PUBLISHED Published: 2021-09-15T13:52:51 Last Updated: 2024-08-04T14:08:30.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97882
CVE ID: CVE-2020-19155 State: PUBLISHED Published: 2021-09-15T13:52:52 Last Updated: 2024-08-04T14:08:30.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97886 - https://cwe.mitre.org/data/definitions/73.html
CVE ID: CVE-2020-19156 State: PUBLISHED Published: 2021-09-15T13:52:53 Last Updated: 2024-08-04T14:08:30.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Connections' component when the 'save()' function is called. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97852
CVE ID: CVE-2020-19157 State: PUBLISHED Published: 2021-09-15T13:52:54 Last Updated: 2024-08-04T14:08:30.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TL-swallow/swallow/issues/14
CVE ID: CVE-2020-19158 State: PUBLISHED Published: 2021-09-15T13:52:55 Last Updated: 2024-08-04T14:08:30.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TL-swallow/swallow/blob/master/S-CMS%20XSS1.docx
CVE ID: CVE-2020-19159 State: PUBLISHED Published: 2021-09-15T13:52:56 Last Updated: 2024-08-04T14:08:30.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TL-swallow/swallow/blob/master/laikecsrf
CVE ID: CVE-2020-19165 State: PUBLISHED Published: 2020-12-11T19:02:01 Last Updated: 2024-08-04T14:08:30.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel_id=1 userlevel_id[] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mint60/PHP/issues/1
CVE ID: CVE-2020-19185 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-04T14:08:30.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc1.md - https://security.netapp.com/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/De
tps://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://seclists.org/fulldisclosure/2023/Dec/10 - http://seclists.org/fulldisclosure/2023/Dec/11
CVE ID: CVE-2020-19186 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-11-27T14:26:20.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md - https://security.netapp.com/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/f
.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://seclists.org/fulldisclosure/2023/Dec/10 - http://seclists.org/fulldisclosure/2023/Dec/11
CVE ID: CVE-2020-19187 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-04T14:08:30.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc3.md - https://security.netapp.com/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 -
support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://seclists.org/fulldisclosure/2023/Dec/10 - http://seclists.org/fulldisclosure/2023/Dec/11
CVE ID: CVE-2020-19188 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-04T14:08:30.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc4.md - https://security.netapp.com/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 -
CVE ID: CVE-2020-19189 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-04T14:08:30.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md - https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html - https://security.netapp.com/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://
/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://seclists.org/fulldisclosure/2023/Dec/10 - http://seclists.org/fulldisclosure/2023/Dec/11
CVE ID: CVE-2020-19190 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-04T14:08:30.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md - https://security.netapp.com/advisory/ntap-20231006-0005/ - https://support.apple.com/kb/HT214038 - https://support.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://
.apple.com/kb/HT214036 - https://support.apple.com/kb/HT214037 - http://seclists.org/fulldisclosure/2023/Dec/9 - http://seclists.org/fulldisclosure/2023/Dec/10 - http://seclists.org/fulldisclosure/2023/Dec/11
CVE ID: CVE-2020-19199 State: PUBLISHED Published: 2021-05-10T17:29:45 Last Updated: 2024-08-04T14:08:30.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qinggan/phpok/issues/5
CVE ID: CVE-2020-19201 State: PUBLISHED Published: 2021-07-12T15:53:46 Last Updated: 2024-08-04T14:08:30.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules. Additional Analyst Notes: - CVE Program Container: References: - https://www.pfsense.org/download/ - https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.html - https://gist.github.com/dharmeshbaskaran
download/ - https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.html - https://gist.github.com/dharmeshbaskaran/fd3779006361d07651a883e8a040d916
CVE ID: CVE-2020-19202 State: PUBLISHED Published: 2021-06-17T15:22:58 Last Updated: 2024-08-04T14:08:30.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFire 2.21 (x86_64) - Core Update 130. It allows an authenticated WebGUI user with privileges to execute Stored Cross-site Scripting in the Captive Portal page. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/dharmeshbaskaran/2825ee8ae48b9065193c07a92b3a712c - https://blog.ipfire.org/post/ipfire-2-23-core-update-132-released