rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15609 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_stop parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9726.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:14.000Z
CVE-2020-15610 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the modulo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9728.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:15.000Z
CVE-2020-15611 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_restart parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9734.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:15.000Z
CVE-2020-15612 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. When parsing the userLogin parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9737.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:16.000Z
CVE-2020-15613 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9739.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:16.000Z
CVE-2020-15614 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the cha parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9718.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:17.000Z
CVE-2020-15615 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9746.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:17.000Z
CVE-2020-15616 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the package parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9706.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:18.000Z
CVE-2020-15617 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the status parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9708.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:18.000Z
CVE-2020-15618 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9717.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:18.000Z
CVE-2020-15619 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the type parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9723.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:19.000Z
CVE-2020-15620 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the id parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9741.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:19.000Z
CVE-2020-15621 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the email parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9711.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:20.000Z
CVE-2020-15622 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the search parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9712.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:20.000Z
CVE-2020-15623 
This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9722.
Problem types: cwe_id: CWE-749
description: CWE-749: Exposed Dangerous Method or Function
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:21.000Z
CVE-2020-15624 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_new_account.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9727.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:21.000Z
CVE-2020-15625 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9729.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:22.000Z
CVE-2020-15626 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the term parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9730.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:22.000Z
CVE-2020-15627 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9738.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:23.000Z
CVE-2020-15628 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9710.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:23.000Z
CVE-2020-15629 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10764.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: Studio Photo
Credits: lang: en
value: Francis Provencher {PRL}
Published: 2020-08-19T20:55:27.000Z
CVE-2020-15630 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-10977.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Foxit
product: Studio Photo
Credits: lang: en
value: Mat Powell of Trend Micro Zero Day Initiative
Published: 2020-08-19T20:55:27.000Z
CVE-2020-15631 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction header, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10084.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: D-Link
product: DAP-1860
Credits: lang: en
value: chung96vn - Security Researcher of VinCSS (Member of Vingroup)
Published: 2020-07-23T20:45:17.000Z
CVE-2020-15632 
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.
Problem types: cwe_id: CWE-303
description: CWE-303: Incorrect Implementation of Authentication Algorithm
Affected products: vendor: D-Link
product: DIR-842
Credits: lang: en
value: chung96vn - Security Researcher of VinCSS (Member of Vingroup)
Published: 2020-07-23T20:45:18.000Z
CVE-2020-15633 
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: D-Link
product: Multiple Routers
Credits: lang: en
value: chung96vn of Vietnam Cyber Security Center
Published: 2020-07-23T20:45:18.000Z
CVE-2020-15634 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9755.
Problem types: cwe_id: CWE-134
description: CWE-134: Use of Externally-Controlled Format String
Affected products: vendor: NETGEAR
product: R6700
Credits: lang: en
value: d4rkn3ss from VNPT ISC
Published: 2020-08-19T20:55:27.000Z
CVE-2020-15635 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the acsd service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9853.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: NETGEAR
product: R6700
Credits: lang: en
value: Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) and Radek Domanski (@RabbitPro | radek.domanski@gmail.com)
Published: 2020-08-19T20:55:28.000Z
CVE-2020-15636 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the check_ra service. A crafted raePolicyVersion in a RAE_Policy.json file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9852.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: NETGEAR
product: Multiple Routers
Credits: lang: en
value: Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) and Radek Domanski (@RabbitPro | radek.domanski@gmail.com)
Published: 2020-08-19T20:55:28.000Z
CVE-2020-15637 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the SetLocalDescription method. By performing actions in JavaScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-10972.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PhantomPDF
Credits: lang: en
value: Mat Powell of Trend Micro Zero Day Initiative
Published: 2020-08-19T20:55:29.000Z