Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28695 State: PUBLISHED Published: 2021-03-26T17:09:18 Last Updated: 2024-08-04T16:40:59.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root. Additional Analyst Notes: - CVE Program Container: References: - https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b
CVE ID: CVE-2020-28702 State: PUBLISHED Published: 2021-11-01T13:30:33 Last Updated: 2024-08-04T16:40:59.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tomoya92/pybbs/issues/137
CVE ID: CVE-2020-28705 State: PUBLISHED Published: 2021-03-10T13:37:57 Last Updated: 2024-08-04T16:40:59.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/576 - https://github.com/daylightstudio/FUEL-CMS/commit/fbf2d59215800f05d4359e8f984d5680d62f0f3b
CVE ID: CVE-2020-28707 State: PUBLISHED Published: 2021-01-19T21:58:38 Last Updated: 2024-08-04T16:40:59.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval t
as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object. Additional Analyst Notes: - CVE Program Container: References: - http://stockdio.com - https://wordpress.org/plugins/stockdio-historical-chart/#developers - https://jondow.eu/cve-2020-28707-xss-in-stockdio-historical-chart-plugin-for-wordpress-before-version-281/
CVE ID: CVE-2020-28713 State: PUBLISHED Published: 2021-06-08T18:57:57 Last Updated: 2024-08-04T16:40:59.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The web service does not authenticate requests, and allows attackers to send an indefinite amount of motion or doorbell events to a user's mobile application by either replaying or deliberately crafting false events. Additional Analyst Note
events to a user's mobile application by either replaying or deliberately crafting false events. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tj-oconnor/dbfbef4d3b271d53fefbd24e1f0024f0 - https://cloud.binary.ninja/embed/26671c64-6859-48fb-b58e-af35dc982b35
CVE ID: CVE-2020-28715 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-09T14:04:48.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://leeco.com - https://www.cnvd.org.cn/flaw/show/2602948
CVE ID: CVE-2020-28717 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:46:02.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in content1 parameter in demo.jsp in kindsoft kindeditor version 4.1.12, allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kindsoft/kindeditor/issues/321
CVE ID: CVE-2020-28722 State: PUBLISHED Published: 2021-05-12T19:20:40 Last Updated: 2024-08-04T16:40:59.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover via custom email templates. Additional Analyst Notes: - CVE Program Container: References: - https://www.r29k.com/articles/bb/stored-xss-in-deskpro
CVE ID: CVE-2020-28723 State: PUBLISHED Published: 2020-11-16T16:49:09 Last Updated: 2024-08-04T16:40:59.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/raminfp/fuzz-libpparam - https://github.com/CloudAvid/PParam/issues/9
CVE ID: CVE-2020-28724 State: PUBLISHED Published: 2020-11-18T14:26:01 Last Updated: 2024-08-04T16:40:59.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pallets/flask/issues/1639 - https://github.com/pallets/werkzeug/issues/822 - https://github.com/pallets/werkzeug/pull/890/files
CVE ID: CVE-2020-28726 State: PUBLISHED Published: 2020-11-24T16:45:06 Last Updated: 2024-08-04T16:40:59.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/seeddms/code/ci/877844cbba0749367b8ba0e4e0bde34a1dc838f1/
CVE ID: CVE-2020-28727 State: PUBLISHED Published: 2020-12-07T07:53:26 Last Updated: 2024-08-04T16:40:59.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php. Additional Analyst Notes: - CVE Program Container: References: - http://seeddms.com - https://sourceforge.net/p/seeddms/code/ci/32b03b1e5880e2f38cecf4ac7743f8f62f33043f/ - https://sourceforge.net/projects/seeddms/files/
CVE ID: CVE-2020-28734 State: PUBLISHED Published: 2020-12-30T18:35:17 Last Updated: 2024-08-04T16:40:59.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. Additional Analyst Notes: - CVE Program Container: References: - https://www.misakikata.com/codes/plone/python-en.html - https://github.com/plone/Products.CMFPlone/issues/3209 - https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
CVE ID: CVE-2020-28735 State: PUBLISHED Published: 2020-12-30T18:38:01 Last Updated: 2024-08-04T16:40:59.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). Additional Analyst Notes: - CVE Program Container: References: - https://www.misakikata.com/codes/plone/python-en.html - https://github.com/plone/Products.CMFPlone/issues/3209 - https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
CVE ID: CVE-2020-28736 State: PUBLISHED Published: 2020-12-30T18:40:52 Last Updated: 2024-08-04T16:40:59.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). Additional Analyst Notes: - CVE Program Container: References: - https://www.misakikata.com/codes/plone/python-en.html - https://github.com/plone/Products.CMFPlone/issues/3209 - https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
CVE ID: CVE-2020-28759 State: PUBLISHED Published: 2020-12-26T19:06:44 Last Updated: 2024-08-04T16:40:59.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. NOTE: another person has stated "I don't think there is an proof of overflow so far. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OAID/Tengine/issues/476
CVE ID: CVE-2020-28838 State: PUBLISHED Published: 2020-12-11T14:19:41 Last Updated: 2024-08-04T16:40:59.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart. Additional Analyst Notes: - CVE Program Container: References: - https://www.opencart.com/ - https://www.exploit-db.com/exploits/49228
CVE ID: CVE-2020-28840 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:44:25.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1900820 - https://github.com/Matthias-Wandel/jhead/commit/4827ed31c226dc5ed93603bd649e0e387a1778da - https://github.com/Matthias-Wandel/jhead/issues/8 - https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-xh27-x
https://github.com/Matthias-Wandel/jhead/issues/8 - https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-xh27-xwgj-gqw2
CVE ID: CVE-2020-28841 State: PUBLISHED Published: 2021-01-03T04:41:01 Last Updated: 2024-08-04T16:40:59.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to \\.\MyDrivers0_0_1. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2020-53152 - https://github.com/datadancer/WinSysVuln/blob/main/DriverGenius-MyDrivers64.md
CVE ID: CVE-2020-28845 State: PUBLISHED Published: 2020-11-20T19:03:49 Last Updated: 2024-08-04T16:40:59.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system. Additional Analyst Notes: - CVE Program Container: References: - http://the-it-wonders.blogspot.com/2020/11/netskope-csv-injection-in-admin-ui.html
CVE ID: CVE-2020-28846 State: PUBLISHED Published: 2021-08-17T15:49:02 Last Updated: 2024-08-04T16:40:59.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wh1tes/wh1te_blog/issues/8
CVE ID: CVE-2020-28847 State: PUBLISHED Published: 2022-04-05T15:37:26 Last Updated: 2024-08-04T16:41:00.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xCss/Valine/issues/348
CVE ID: CVE-2020-28848 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:42:39.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/5465
CVE ID: CVE-2020-28849 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T19:14:01.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/5477
CVE ID: CVE-2020-28851 State: PUBLISHED Published: 2021-01-02T05:42:40 Last Updated: 2024-08-04T16:40:59.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/42535 - https://security.netapp.com/advisory/ntap-20210212-0004/
CVE ID: CVE-2020-28852 State: PUBLISHED Published: 2021-01-02T05:45:53 Last Updated: 2024-08-04T16:40:59.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/42536 - https://security.netapp.com/advisory/ntap-20210212-0004/
CVE ID: CVE-2020-28856 State: PUBLISHED Published: 2020-12-14T17:59:04 Last Updated: 2024-08-04T16:40:59.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access controls. Additional Analyst Notes: - CVE Program Container: References: - http://openasset.com - http://seclists.org/fulldisclosure/2020/Dec/17 - http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Acces
org/fulldisclosure/2020/Dec/17 - http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Access-Control-Bypass.html - https://www.themissinglink.com.au/security-advisories-cve-2020-28856
CVE ID: CVE-2020-28857 State: PUBLISHED Published: 2020-12-14T18:53:18 Last Updated: 2024-08-04T16:40:59.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - http://openasset.com - http://seclists.org/fulldisclosure/2020/Dec/18 - http://packetstormsecurity.com/files/160455/OpenAsset-Digital-Asset-Management-Cross-Site-Scripting.html - https://www.themissinglink.com.au/security-advisories-cve-2020-28857
CVE ID: CVE-2020-28858 State: PUBLISHED Published: 2020-12-14T18:58:03 Last Updated: 2024-08-04T16:40:59.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions. Additional Analyst Notes: - CVE Program Container: References: - http://openasset.com - http://seclists.org/fulldisclosure/2020/Dec/19 - http://packetstormsecurity.com/files/160458/OpenAsset-Digital-Asset-Management-Cross-Site-Request-Forgery.html - https://www.themissinglink.com.au/security-adviso
8/OpenAsset-Digital-Asset-Management-Cross-Site-Request-Forgery.html - https://www.themissinglink.com.au/security-advisories-cve-2020-28858
CVE ID: CVE-2020-28859 State: PUBLISHED Published: 2020-12-14T19:01:59 Last Updated: 2024-08-04T16:40:59.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - http://openasset.com - https://www.themissinglink.com.au/security-advisories-cve-2020-28859
CVE ID: CVE-2020-28860 State: PUBLISHED Published: 2020-12-14T19:33:22 Last Updated: 2024-08-04T16:40:59.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection. Additional Analyst Notes: - CVE Program Container: References: - http://openasset.com - http://seclists.org/fulldisclosure/2020/Dec/21 - http://packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.html - https://www.themissinglink.com.au/security-advisories-cve-2020-28860
CVE ID: CVE-2020-28861 State: PUBLISHED Published: 2020-12-14T19:37:02 Last Updated: 2024-08-04T16:40:59.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application. Additional Analyst Notes: - CVE Program Container: References: - http://openasset.com - http://seclists.org/fulldisclosure/2020/Dec/22 - http://packetstormsecurity.com/files/160457/OpenAsset-Digital-Asset-Management-Insecure-Direct-Object-Reference.html - https://www.themissingl
rity.com/files/160457/OpenAsset-Digital-Asset-Management-Insecure-Direct-Object-Reference.html - https://www.themissinglink.com.au/security-advisories-cve-2020-28861
CVE ID: CVE-2020-28864 State: PUBLISHED Published: 2020-11-23T18:12:08 Last Updated: 2024-08-04T16:40:59.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file name. Additional Analyst Notes: - CVE Program Container: References: - https://winscp.net/forum/viewtopic.php?t=30085 - https://winscp.net/tracker/1924
CVE ID: CVE-2020-28865 State: PUBLISHED Published: 2022-06-16T20:36:18 Last Updated: 2024-08-04T16:40:59.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KFCFans/PowerJob/issues/99
CVE ID: CVE-2020-28870 State: PUBLISHED Published: 2021-02-10T00:19:43 Last Updated: 2024-08-04T16:40:59.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48946
CVE ID: CVE-2020-28871 State: PUBLISHED Published: 2021-02-10T00:00:00 Last Updated: 2024-08-04T16:41:00.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload. Additional Analyst Notes: - CVE Program Container: References: - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ - https://www.exploit-db.com/exploits/48980 - http://packetstormsecurity.com/files/163263/Monitorr-1.7.6m-Bypass-Information-Disclosure-Shell-Upload.html - http://pa
http://packetstormsecurity.com/files/163263/Monitorr-1.7.6m-Bypass-Information-Disclosure-Shell-Upload.html - http://packetstormsecurity.com/files/170974/Monitorr-1.7.6-Shell-Upload.html - http://packetstormsecurity.com/files/171429/Monitorr-1.7.6m-1.7.7d-Remote-Code-Execution.html
CVE ID: CVE-2020-28872 State: PUBLISHED Published: 2021-04-12T13:35:58 Last Updated: 2024-08-04T16:41:00.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid credentials. Additional Analyst Notes: - CVE Program Container: References: - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ - https://www.exploit-db.com/exploits/48981 - http://packetstormsecurity.com/files/163263/Monitorr-1.7.6m-Bypass-Information-Disclosure-Shell-Upload.html
CVE ID: CVE-2020-28873 State: PUBLISHED Published: 2021-03-17T12:31:52 Last Updated: 2024-08-04T16:40:59.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server. Additional Analyst Notes: - CVE Program Container: References: - http://fluxbb.com - https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation
CVE ID: CVE-2020-28874 State: PUBLISHED Published: 2021-01-21T15:01:48 Last Updated: 2024-08-04T16:41:00.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectsend/projectsend/commits/master - http://projectsend.com - https://github.com/varandinawer/CVE-2020-28874 - https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e - https://github.com/projectsend/projectsend/rel
projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e - https://github.com/projectsend/projectsend/releases/tag/r1295
CVE ID: CVE-2020-28877 State: PUBLISHED Published: 2020-11-20T15:48:04 Last Updated: 2024-08-04T16:41:00.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/peanuts62/TP-Link-poc
CVE ID: CVE-2020-28884 State: PUBLISHED Published: 2022-01-28T00:00:00 Last Updated: 2024-08-04T16:41:00.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3 - http