rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-35666 
Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id[$ne]=1 value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T19:49:28.000Z
CVE-2020-35667 
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:51:37.000Z
CVE-2020-35668 
RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has not yet been introduced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T22:32:13.000Z
CVE-2020-35669 
An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T02:05:30.000Z
CVE-2020-35674 
BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T03:05:28.000Z
CVE-2020-35675 
BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T03:05:09.000Z
CVE-2020-35676 
BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once the arbitrary Javascript is executed in the context of the admin, this will cause the attacker to gain administrative privileges, effectively leading into an application takeover. This affects app/membership_signup.php and app/admin/pageViewMembers.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T03:04:56.000Z
CVE-2020-35677 
BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the payload. One might think this completely mitigates the privilege-escalation impact as there is only one high-privileged role. However, it was discovered that the endpoint responsible for creating the group lacks CSRF protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T03:04:43.000Z
CVE-2020-35678 
Autobahn|Python before 20.12.3 allows redirect header injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-27T00:00:10.000Z
CVE-2020-35679 
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T15:53:23.000Z
CVE-2020-35680 
smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T15:53:03.000Z
CVE-2020-35681 
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T02:03:14.000Z
CVE-2020-35682 
Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-13T18:18:15.000Z
CVE-2020-35683 
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the ICMP checksum. When the IP payload size is set to be smaller than the size of the IP header, the ICMP checksum computation function may read out of bounds, causing a Denial-of-Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-19T11:13:13.000Z
CVE-2020-35684 
An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the length of the TCP payload within the TCP checksum computation function. When the IP payload size is set to be smaller than the size of the IP header, the TCP checksum computation function may read out of bounds (a low-impact write-out-of-bounds is also possible).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-19T11:19:01.000Z
CVE-2020-35685 
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-19T11:21:08.000Z
CVE-2020-35686 
The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may allow escalation of privilege via a fake DLL. (As a resolution, Windows Update is being submitted for all affected products to update to 2.0.9.18 or later.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T05:05:26.000Z
CVE-2020-35687 
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T16:52:43.000Z
CVE-2020-35693 
On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T18:02:08.000Z
CVE-2020-35698 
Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: Affected Source code of the website CMS which is been used by many to host their online courses using the Thinkific Platform. The attack vector is: To exploit the vulnerability any user has to just visit the link - https://hacktify.thinkific.com/account/billing?success=%E2%80%AA%3Cscript%3Ealert(1)%3C/script%3E. ¶¶ Thinkific is a Website based Learning Platform Product which is used by thousands of users worldwide. There is a Cross Site Scripting (XSS) based vulnerability in the code of the CMS where any attacker can execute a XSS attack. Proof of Concept & Steps to Reproduce: Step1 : Go to Google.com Step 2 : Search for this Dork site:thinkific.com -www Step 3 : You will get a list of websites which are running on the thinkific domains. Step 4 : Create account and signin in any of the website Step 5 : Add this endpoint at the end of the domain and you will see that there is a XSS Alert /account/billing?success=%E2%80%AA<script>alert(1)</script> Step 6 : Choose any domains from google for any website this exploit will work on all the websites as it is a code based flaw in the CMS Step 7 : Thousands of websites are vulnerable due to this vulnerable code in the CMS itself which is giving rise to the XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-25T00:00:00.000Z
CVE-2020-35700 
A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T08:08:15.000Z
CVE-2020-35701 
An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T15:57:51.000Z
CVE-2020-35702 
DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T01:02:58.000Z
CVE-2020-35704 
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T05:24:56.000Z
CVE-2020-35705 
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T05:24:47.000Z
CVE-2020-35706 
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T05:24:38.000Z
CVE-2020-35707 
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T05:24:30.000Z
CVE-2020-35708 
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T05:24:04.000Z
CVE-2020-35709 
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T18:42:48.000Z
CVE-2020-35710 
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T18:58:04.000Z
CVE-2020-35711 
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T22:59:09.000Z
CVE-2020-35712 
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-25T23:46:36.000Z
CVE-2020-35713 
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T00:47:04.000Z
CVE-2020-35714 
Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T00:46:45.000Z
CVE-2020-35715 
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the upload_settings.cgi page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T00:46:34.000Z
CVE-2020-35716 
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a long /goform/langSwitch langSelectionOnly parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T00:46:22.000Z
CVE-2020-35717 
zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-01T09:15:21.000Z
CVE-2020-35719 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:55:15.000Z
CVE-2020-35720 
Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when creating or modifying a user via the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:55:38.000Z
CVE-2020-35721 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseAssets.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:56:08.000Z
CVE-2020-35722 
CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:56:50.000Z
CVE-2020-35723 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportPreview.do file via the referer parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:57:12.000Z
CVE-2020-35724 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter (or indirectly via the cpr, tcp, or abs parameter). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:57:43.000Z
CVE-2020-35725 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:58:08.000Z
CVE-2020-35726 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:58:31.000Z
CVE-2020-35727 
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseDirs.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T02:58:51.000Z
CVE-2020-35728 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-27T04:32:36.000Z
CVE-2020-35729 
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-27T04:40:44.000Z
CVE-2020-35730 
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T19:37:08.000Z
CVE-2020-35733 
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-15T13:35:08.000Z
CVE-2020-35734 
Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-15T20:49:31.000Z
CVE-2020-35735 
Vidyo 02-09-/D allows clickjacking via the portal/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T18:05:24.000Z
CVE-2020-35736 
GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-27T19:07:12.000Z
CVE-2020-35737 
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T19:39:17.000Z
CVE-2020-35738 
WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T03:54:10.000Z
CVE-2020-35740 HGiga MailSherlock - XSS -1
HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: HGiga
product: MailSherlock MSR45/SSR45
vendor: HGiga
product: MailSherlock MSR45/SSR45
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Robin Tung, Dio Lin of CHT Security Co., Ltd.
Published: 2020-12-31T07:45:49.988Z