rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10447 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-failed-login.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:04:57.000Z
CVE-2020-10448 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-referrers.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:04:58.000Z
CVE-2020-10449 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-search.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:04:59.000Z
CVE-2020-10450 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-traffic.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:01.000Z
CVE-2020-10451 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-user.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:02.000Z
CVE-2020-10452 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/save-article.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:03.000Z
CVE-2020-10453 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/search-users.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:04.000Z
CVE-2020-10454 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/sitemap-generator.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:06.000Z
CVE-2020-10455 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/translate.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:07.000Z
CVE-2020-10456 
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/trash-box.php by adding a question mark (?) followed by the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:08.000Z
CVE-2020-10457 
Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a dot-dot-slash sequence (../) via the POST parameter imgName (for the new name) and imgUrl (for the current file to be renamed).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:09.000Z
CVE-2020-10458 
Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence (../) via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:11.000Z
CVE-2020-10459 
Path Traversal in admin/assetmanager/assetmanager.php (vulnerable function saved in admin/assetmanager/functions.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to list the files that are stored on the webserver using a dot-dot-slash sequence (../) via the POST parameter inpCurrFolder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:13.000Z
CVE-2020-10460 
admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:15.000Z
CVE-2020-10461 
The way comments in article.php (vulnerable function in include/functions-article.php) are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored (Blind) XSS (injecting arbitrary web script or HTML) in admin/manage-comments.php, via the GET parameter cmt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:16.000Z
CVE-2020-10462 
Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:18.000Z
CVE-2020-10463 
Reflected XSS in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:20.000Z
CVE-2020-10464 
Reflected XSS in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:21.000Z
CVE-2020-10465 
Reflected XSS in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:23.000Z
CVE-2020-10466 
Reflected XSS in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:24.000Z
CVE-2020-10467 
Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:26.000Z
CVE-2020-10468 
Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:27.000Z
CVE-2020-10469 
Reflected XSS in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:28.000Z
CVE-2020-10470 
Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:29.000Z
CVE-2020-10471 
Reflected XSS in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:31.000Z
CVE-2020-10472 
Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:32.000Z
CVE-2020-10473 
Reflected XSS in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:33.000Z
CVE-2020-10474 
Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:34.000Z
CVE-2020-10475 
Reflected XSS in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:36.000Z
CVE-2020-10476 
Reflected XSS in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:37.000Z
CVE-2020-10477 
Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:38.000Z
CVE-2020-10478 
CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution or causing a denial of service, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:39.000Z
CVE-2020-10479 
CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:41.000Z
CVE-2020-10480 
CSRF in admin/add-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new category via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:42.000Z
CVE-2020-10481 
CSRF in admin/add-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new glossary term via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:43.000Z
CVE-2020-10482 
CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:44.000Z
CVE-2020-10483 
CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:46.000Z
CVE-2020-10484 
CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:47.000Z
CVE-2020-10485 
CSRF in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:48.000Z
CVE-2020-10486 
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a comment via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:50.000Z
CVE-2020-10487 
CSRF in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a glossary term via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:51.000Z
CVE-2020-10488 
CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:52.000Z
CVE-2020-10489 
CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a ticket via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:53.000Z
CVE-2020-10490 
CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:55.000Z
CVE-2020-10491 
CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:56.000Z
CVE-2020-10492 
CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:57.000Z
CVE-2020-10493 
CSRF in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a glossary term, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:05:58.000Z
CVE-2020-10494 
CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:00.000Z
CVE-2020-10495 
CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:01.000Z
CVE-2020-10496 
CSRF in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:02.000Z
CVE-2020-10497 
CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:03.000Z
CVE-2020-10498 
CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:05.000Z
CVE-2020-10499 
CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:06.000Z
CVE-2020-10500 
CSRF in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to reply to any ticket, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:08.000Z
CVE-2020-10501 
CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:09.000Z
CVE-2020-10502 
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to approve any comment, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:11.000Z
CVE-2020-10503 
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:12.000Z
CVE-2020-10504 
CSRF in admin/edit-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a comment, given the id, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:06:13.000Z
CVE-2020-10505 ALLE INFORMATION CO., LTD. School Manage System - SQL Injection
The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based injection query string to get databases schema and username/password.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: ALLE INFORMATION CO., LTD.
product: School Manage System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-15T06:15:21.457Z
CVE-2020-10506 ALLE INFORMATION CO., LTD. School Manage System - Path Traversal
The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files.
Problem types: description: Path Traversal
Affected products: vendor: ALLE INFORMATION CO., LTD.
product: School Manage System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-04-15T06:15:21.891Z
CVE-2020-10507 ALLE INFORMATION CO., LTD. School Manage System - Security Misconfiguration
The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload (RCE) , that would allow attackers to gain access in the hosting machine.
Problem types: description: Security Misconfiguration
Affected products: vendor: ALLE INFORMATION CO., LTD.
product: School Manage System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-15T06:15:22.358Z
CVE-2020-10508 Sunnet eHRD - Sensitive Data Exposure
Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.
Problem types: description: Sensitive Data Exposure
Affected products: vendor: Sunnet
product: eHRD
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-03-27T07:35:23.455Z
CVE-2020-10509 Sunnet eHRD - Cross-Site Scripting
Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Sunnet
product: eHRD
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2020-03-27T07:35:23.858Z
CVE-2020-10510 Sunnet eHRD - Broken Access Control
Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data.
Problem types: description: Broken Access Control
Affected products: vendor: Sunnet
product: eHRD
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2020-03-27T07:35:24.288Z
CVE-2020-10511 HGiga C&Cmail - Broken Access Control
HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL.
Problem types: description: Broken Access Control
Affected products: vendor: HGiga
product: C&Cmail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-15T06:20:22.802Z
CVE-2020-10512 HGiga C&Cmail - SQL Injection
HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: HGiga
product: C&Cmail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-15T06:20:23.231Z
CVE-2020-10513 iCatch DVR - Broken Access Control
The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary file.
Problem types: description: Broken Access Control
Affected products: vendor: iCatch Inc.
product: DVR firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-15T06:20:23.661Z