rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-20105 
The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Application Links
vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-03-17T02:40:13.819Z
CVE-2019-20106 
Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-02-06T03:10:25.647Z
CVE-2019-20107 
Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T12:50:19.000Z
CVE-2019-20138 
The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T13:56:26.000Z
CVE-2019-20139 
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T14:57:34.000Z
CVE-2019-20140 
An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T16:35:23.000Z
CVE-2019-20141 
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T16:47:39.000Z
CVE-2019-20142 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T20:04:21.000Z
CVE-2019-20143 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T20:03:27.000Z
CVE-2019-20144 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T20:01:45.000Z
CVE-2019-20145 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T20:00:39.000Z
CVE-2019-20146 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T19:59:11.000Z
CVE-2019-20147 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T19:56:40.000Z
CVE-2019-20148 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T19:52:52.000Z
CVE-2019-20149 
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T18:25:10.000Z
CVE-2019-20150 
In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's editor to change the expected SFTP Host IP to a malicious host, and then using the Check Connectivity option. The application then sends these saved credentials to the malicious host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T12:35:01.000Z
CVE-2019-20151 
An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and inserted via the Note field. As a result, the payload is executed by the application's administrator(s).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T12:36:21.000Z
CVE-2019-20152 
An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the Create New Workflow field. As a result, the payload is executed via the navigation bar throughout the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T12:37:38.000Z
CVE-2019-20153 
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote attackers to read arbitrary files (including configuration files containing administrative credentials).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T22:12:32.000Z
CVE-2019-20154 
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T22:15:53.000Z
CVE-2019-20155 
An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T22:23:03.000Z
CVE-2019-20159 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a memory leak in dinf_New() in isomedia/box_code_base.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:57:08.000Z
CVE-2019-20160 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a stack-based buffer overflow in the function av1_parse_tile_group() in media_tools/av_parsers.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:56:59.000Z
CVE-2019-20161 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:56:46.000Z
CVE-2019-20162 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:56:35.000Z
CVE-2019-20163 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_odf_avc_cfg_write_bs() in odf/descriptors.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:56:23.000Z
CVE-2019-20164 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_box_del() in isomedia/box_funcs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:56:14.000Z
CVE-2019-20165 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function ilst_item_Read() in isomedia/box_code_apple.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:55:43.000Z
CVE-2019-20166 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_dump() in isomedia/box_dump.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:55:23.000Z
CVE-2019-20167 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function senc_Parse() in isomedia/box_code_drm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:55:14.000Z
CVE-2019-20168 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function gf_isom_box_dump_ex() in isomedia/box_funcs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:54:47.000Z
CVE-2019-20169 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function trak_Read() in isomedia/box_code_base.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:54:38.000Z
CVE-2019-20170 
An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:54:01.000Z
CVE-2019-20171 
An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T23:53:51.000Z
CVE-2019-20172 
Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T02:50:35.000Z
CVE-2019-20173 
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T19:50:33.000Z
CVE-2019-20174 
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T17:13:42.000Z
CVE-2019-20175 
An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T03:27:40.000Z
CVE-2019-20176 
In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T14:04:06.000Z
CVE-2019-20178 
Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:33:37.000Z
CVE-2019-20179 
SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:28:37.000Z
CVE-2019-20180 
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T00:00:00.000Z
CVE-2019-20181 
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:15:27.000Z
CVE-2019-20182 
The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:01:39.000Z
CVE-2019-20183 
uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:21:24.000Z
CVE-2019-20184 
KeePass 2.4.1 allows CSV injection in the title field of a CSV export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:09:41.000Z
CVE-2019-20191 
Oxygen XML Editor 21.1.1 allows XXE to read any file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:38:29.000Z
CVE-2019-20197 
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T18:50:15.000Z
CVE-2019-20198 
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T20:31:05.000Z
CVE-2019-20199 
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen() on a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T20:30:54.000Z
CVE-2019-20200 
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T20:30:45.000Z
CVE-2019-20201 
An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T20:30:33.000Z
CVE-2019-20202 
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T20:30:23.000Z
CVE-2019-20203 
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-01T21:59:46.000Z
CVE-2019-20204 
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-01T21:59:58.000Z
CVE-2019-20205 
libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-01T22:30:20.000Z
CVE-2019-20208 
dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-01T23:26:32.000Z
CVE-2019-20209 
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T17:05:22.000Z
CVE-2019-20210 
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T17:16:15.000Z
CVE-2019-20211 
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T17:39:09.000Z
CVE-2019-20212 
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T17:44:57.000Z
CVE-2019-20213 
D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T01:03:16.000Z
CVE-2019-20215 
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T02:23:26.000Z
CVE-2019-20216 
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because REMOTE_PORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T02:28:32.000Z
CVE-2019-20217 
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because SERVER_ID is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T02:32:38.000Z
CVE-2019-20218 
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T02:51:58.000Z
CVE-2019-20219 
ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T14:10:09.000Z
CVE-2019-20220 
In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T04:30:24.000Z
CVE-2019-20221 
In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T04:30:12.000Z
CVE-2019-20222 
In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T04:30:02.000Z
CVE-2019-20223 
In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T04:29:51.000Z
CVE-2019-20224 
netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T15:37:58.000Z
CVE-2019-20225 
MyBB before 1.8.22 allows an open redirect on login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T14:02:26.000Z