deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15430
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9736.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-747/; https://www.zerodayinitiative.com/advisories/ZDI-20-747/
CVE: CVE-2020-15431
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9740.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-748/; https://www.zerodayinitiative.com/advisories/ZDI-20-748/
CVE: CVE-2020-15432
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the filespace parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9743.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-749/; https://www.zerodayinitiative.com/advisories/ZDI-20-749/
CVE: CVE-2020-15433
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the phpversion parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9715.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-750/; https://www.zerodayinitiative.com/advisories/ZDI-20-750/
CVE: CVE-2020-15434
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the canal parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9745.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-751/; https://www.zerodayinitiative.com/advisories/ZDI-20-751/
CVE: CVE-2020-15435
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_start parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9719.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-752/; https://www.zerodayinitiative.com/advisories/ZDI-20-752/
CVE: CVE-2020-15606
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9720.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-753/; https://www.zerodayinitiative.com/advisories/ZDI-20-753/
CVE: CVE-2020-15607
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9721.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-754/; https://www.zerodayinitiative.com/advisories/ZDI-20-754/
CVE: CVE-2020-15608
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the ai_service parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9724.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-755/; https://www.zerodayinitiative.com/advisories/ZDI-20-755/
CVE: CVE-2020-15609
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_stop parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9726.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-756/; https://www.zerodayinitiative.com/advisories/ZDI-20-756/
CVE: CVE-2020-15610
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the modulo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9728.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-757/; https://www.zerodayinitiative.com/advisories/ZDI-20-757/
CVE: CVE-2020-15611
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_restart parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9734.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-758/; https://www.zerodayinitiative.com/advisories/ZDI-20-758/
CVE: CVE-2020-15612
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. When parsing the userLogin parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9737.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-759/; https://www.zerodayinitiative.com/advisories/ZDI-20-759/
CVE: CVE-2020-15613
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9739.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-760/; https://www.zerodayinitiative.com/advisories/ZDI-20-760/
CVE: CVE-2020-15614
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the cha parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9718.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-761/; https://www.zerodayinitiative.com/advisories/ZDI-20-761/
CVE: CVE-2020-15615
Published: 2020-07-28
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9746.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-20-762/; https://www.zerodayinitiative.com/advisories/ZDI-20-762/
CVE: CVE-2020-15616
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the package parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9706.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-763/; https://www.zerodayinitiative.com/advisories/ZDI-20-763/
CVE: CVE-2020-15617
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the status parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9708.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-764/; https://www.zerodayinitiative.com/advisories/ZDI-20-764/
CVE: CVE-2020-15618
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9717.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-765/; https://www.zerodayinitiative.com/advisories/ZDI-20-765/
CVE: CVE-2020-15619
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the type parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9723.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-766/; https://www.zerodayinitiative.com/advisories/ZDI-20-766/
CVE: CVE-2020-15620
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the id parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9741.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-767/; https://www.zerodayinitiative.com/advisories/ZDI-20-767/
CVE: CVE-2020-15621
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the email parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9711.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-768/; https://www.zerodayinitiative.com/advisories/ZDI-20-768/
CVE: CVE-2020-15622
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the search parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9712.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-769/; https://www.zerodayinitiative.com/advisories/ZDI-20-769/
CVE: CVE-2020-15623
Published: 2020-07-28
Description: This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9722.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-20-770/; https://www.zerodayinitiative.com/advisories/ZDI-20-770/
CVE: CVE-2020-15624
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_new_account.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9727.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-771/; https://www.zerodayinitiative.com/advisories/ZDI-20-771/
CVE: CVE-2020-15625
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9729.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-772/; https://www.zerodayinitiative.com/advisories/ZDI-20-772/
CVE: CVE-2020-15626
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the term parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9730.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-773/; https://www.zerodayinitiative.com/advisories/ZDI-20-773/
CVE: CVE-2020-15627
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9738.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-774/; https://www.zerodayinitiative.com/advisories/ZDI-20-774/
CVE: CVE-2020-15628
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9710.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-20-775/; https://www.zerodayinitiative.com/advisories/ZDI-20-775/
CVE: CVE-2020-7685
Published: 2020-07-28
Description: This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1188
References: https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765; https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765
CVE: CVE-2020-10923
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.
CVSS Score: 8.8 (HIGH)
CWE: CWE-305
References: https://www.zerodayinitiative.com/advisories/ZDI-20-703/; https://www.zerodayinitiative.com/advisories/ZDI-20-703/
CVE: CVE-2020-10924
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-20-704/; https://www.zerodayinitiative.com/advisories/ZDI-20-704/
CVE: CVE-2020-10925
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.zerodayinitiative.com/advisories/ZDI-20-705/; https://www.zerodayinitiative.com/advisories/ZDI-20-705/
CVE: CVE-2020-10926
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://www.zerodayinitiative.com/advisories/ZDI-20-706/; https://www.zerodayinitiative.com/advisories/ZDI-20-706/