rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-16197 
An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T18:51:45.000Z
CVE-2020-16198 Philips Clinical Collaboration Platform Protection Mechanism Failure
When an attacker claims to have a given identity, 

Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, 
does not prove or insufficiently proves the claim is correct.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: Philips
product: Clinical Collaboration Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Northridge Hospital Medical Center reported these vulnerabilities to Philips.
Published: 2020-09-18T17:50:08.000Z
CVE-2020-16199 
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Delta Industrial Automation CNCSoft ScreenEditor
Published: 2020-08-04T18:59:48.000Z
CVE-2020-16200 Philips Clinical Collaboration Platform Algorithm Downgrade
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, 

does not properly control the allocation and maintenance of a limited 
resource, thereby enabling an attacker to influence the amount of 
resources consumed, eventually leading to the exhaustion of available 
resources.
Problem types: cwe_id: CWE-757
description: CWE-757
Affected products: vendor: Philips
product: Clinical Collaboration Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Northridge Hospital Medical Center reported these vulnerabilities to Philips.
Published: 2020-09-18T17:53:23.000Z
CVE-2020-16201 
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Industrial Automation CNCSoft ScreenEditor
Published: 2020-08-04T18:56:09.000Z
CVE-2020-16202 
WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges.
Problem types: cwe_id: CWE-732
description: INCORRECT PERMISSION ASSIGNMENT FOR CRITICAL RESOURCE CWE-732
Affected products: vendor: n/a
product: WebAccess Node
Published: 2020-09-22T14:28:36.000Z
CVE-2020-16203 
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-824
description: ACCESS OF UNINITIALIZED POINTER CWE-824
Affected products: vendor: n/a
product: Delta Industrial Automation CNCSoft ScreenEditor
Published: 2020-08-04T18:55:01.000Z
CVE-2020-16204 
The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions).
Problem types: cwe_id: CWE-912
description: HIDDEN FUNCTIONALITY (BACKDOOR) CWE-912
Affected products: vendor: n/a
product: N-Tron 702-W / 702M12-W
Published: 2020-09-01T20:46:26.000Z
CVE-2020-16205 
Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).
Problem types: cwe_id: CWE-78
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78
Affected products: vendor: n/a
product: G-Cam and G-Code
Published: 2020-08-14T13:56:23.000Z
CVE-2020-16206 
The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive data on the N-Tron 702-W / 702M12-W (all versions).
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79
Affected products: vendor: n/a
product: N-Tron 702-W / 702M12-W
Published: 2020-09-01T20:40:15.000Z
CVE-2020-16207 
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: Advantech WebAccess HMI Designer
Published: 2020-08-06T18:22:34.000Z
CVE-2020-16208 
The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authenticated user to click on a crafted link on the N-Tron 702-W / 702M12-W (all versions).
Problem types: cwe_id: CWE-352
description: CROSS-SITE REQUEST FORGERY (CSRF) CWE-352
Affected products: vendor: n/a
product: N-Tron 702-W / 702M12-W
Published: 2020-09-01T20:42:18.000Z
CVE-2020-16209 Fieldcomm Group HART-IP and hipserver - Stack-based Buffer Overflow
A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Fieldcomm Group
product: HART-IP Developer Kit
vendor: Fieldcomm Group
product: hipserver
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-19T17:17:56.000Z
CVE-2020-16210 
The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the context of an attacked user on the N-Tron 702-W / 702M12-W (all versions).
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79
Affected products: vendor: n/a
product: N-Tron 702-W / 702M12-W
Published: 2020-09-01T20:44:46.000Z
CVE-2020-16211 
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project files, which may allow an attacker to read information.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Advantech WebAccess HMI Designer
Published: 2020-08-06T18:21:40.000Z
CVE-2020-16212 Philips Patient Monitoring Devices Exposure of Resource to Wrong Sphere
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T13:13:35.000Z
CVE-2020-16213 
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Advantech WebAccess HMI Designer
Published: 2020-08-06T18:20:45.000Z
CVE-2020-16214 Philips Patient Monitoring Devices Improper Neutralization of Formula Elements in a CSV File
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the 
software saves user-provided information into a comma-separated value 
(CSV) file, but it does not neutralize or incorrectly neutralizes 
special elements that could be interpreted as a command when the file is
 opened by spreadsheet software.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T12:53:15.000Z
CVE-2020-16215 
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a stack-based buffer overflow, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Advantech WebAccess HMI Designer
Published: 2020-08-06T18:19:43.000Z
CVE-2020-16216 Philips Patient Monitoring Devices Improper Input Validation
In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, 
MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and prior, 
the product receives input or data but does not validate or incorrectly 
validates that the input has the properties required to process the data
 safely and correctly, which can induce a denial-of-service condition 
through a system restart.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Philips
product: IntelliVue patient monitors
default_status: unaffected
vendor: Philips
product: IntelliVue
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T13:06:55.000Z
CVE-2020-16217 
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution, disclosure/modification of information, or cause the application to crash.
Problem types: cwe_id: CWE-415
description: DOUBLE FREE CWE-415
Affected products: vendor: n/a
product: Advantech WebAccess HMI Designer
Published: 2020-08-06T18:15:51.000Z
CVE-2020-16218 Philips Patient Monitoring Devices Cross-site Scripting
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the 
software does not neutralize or incorrectly neutralizes 
user-controllable input before it is placed in output that is then used 
as a webpage and served to other users. Successful exploitation could 
lead to unauthorized access to patient data via a read-only web 
application.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T12:50:08.000Z
CVE-2020-16219 
Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Electronics TPEditor
Published: 2020-08-06T23:10:15.000Z
CVE-2020-16220 Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of Input
In Patient Information Center iX (PICiX) Versions C.02, C.03, 
PerformanceBridge Focal Point Version A.01, the product receives input 
that is expected to be well-formed (i.e., to comply with a certain 
syntax) but it does not validate or incorrectly validates that the input
 complies with the syntax, causing the certificate enrollment service to
 crash. It does not impact monitoring but prevents new devices from 
enrolling.
Problem types: cwe_id: CWE-1286
description: CWE-1286 Improper Validation of Syntactic Correctness of Input
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
vendor: Philips
product: PerformanceBridge Focal Point
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T13:11:22.000Z
CVE-2020-16221 
Delta Electronics TPEditor Versions 1.97 and prior. A stack-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Delta Electronics TPEditor
Published: 2020-08-06T23:12:20.000Z
CVE-2020-16222 Philips Patient Monitoring Devices Improper Authentication
In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and 
PerformanceBridge Focal Point Version A.01, when an actor claims to have
 a given identity, the software does not prove or insufficiently proves 
the claim is correct.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
vendor: Philips
product: PerformanceBridge Focal Point
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T12:55:23.000Z
CVE-2020-16223 
Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: Delta Electronics TPEditor
Published: 2020-08-06T23:11:16.000Z
CVE-2020-16224 Philips Patient Monitoring Devices Improper Handling of Length Parameter Inconsistency
In Patient Information Center iX (PICiX) Versions C.02, C.03, the 
software parses a formatted message or structure but does not handle or 
incorrectly handles a length field that is inconsistent with the actual 
length of the associated data, causing the application on the 
surveillance station to restart.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T13:05:19.000Z
CVE-2020-16225 
Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-123
description: WRITE-WHAT-WHERE CONDITION CWE-123
Affected products: vendor: n/a
product: Delta Electronics TPEditor
Published: 2020-08-06T23:14:17.000Z
CVE-2020-16227 
Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Delta Electronics TPEditor
Published: 2020-08-06T23:13:22.000Z
CVE-2020-16228 Philips Patient Monitoring Devices Improper Check for Certificate Revocation
In Patient Information Center iX (PICiX) Versions C.02 and C.03, 
PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors 
MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and 
prior, the software does not check or incorrectly checks the revocation 
status of a certificate, which may cause it to use a compromised 
certificate.
Problem types: cwe_id: CWE-299
description: CWE-299 Improper Check for Certificate Revocation
Affected products: vendor: Philips
product: Patient Information Center iX (PICiX)
default_status: unaffected
vendor: Philips
product: PerformanceBridge Focal Point
default_status: unaffected
vendor: Philips
product: IntelliVue patient monitors
default_status: unaffected
vendor: Philips
product: IntelliVue X3
default_status: unaffected
Credits: lang: en
value: Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.
Published: 2020-09-11T12:58:13.000Z
CVE-2020-16229 
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
Problem types: cwe_id: CWE-843
description: ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
Affected products: vendor: n/a
product: Advantech WebAccess HMI Designer
Published: 2020-08-06T18:24:10.000Z
CVE-2020-16230 
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.
Problem types: description: PERMISSIVE CROSS-DOMAIN POLICY WITH UNTRUSTED DOMAINS
Affected products: vendor: n/a
product: HMS Networks Ewon Flexy and Cosy
Published: 2020-09-18T18:04:16.000Z