rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-36860 Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the object edit pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: Matthew Aberegg
Published: 2025-10-30T21:34:57.698Z
CVE-2020-36861 Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the overlay UI elements and the Notification/Check Period pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Published: 2025-10-30T21:35:47.361Z
CVE-2020-36862 Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts
Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitive information reachable from the export server via SSRF.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Published: 2025-10-30T21:46:37.314Z
CVE-2020-36863 Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory
Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An authenticated attacker with access to the audio import feature could upload a crafted PHP file and then request it to achieve remote code execution with the privileges of the application service.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: TactiFail
Published: 2025-10-30T21:46:58.792Z
CVE-2020-36864 Nagios XI < 5.7.2 XSS via Dashboard Background Color Setting
Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: TactiFail
Published: 2025-10-30T21:51:46.256Z
CVE-2020-36865 Nagios XI < 5.7.2 XSS via BPI Config Management
Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Edit Config page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: TactiFail
Published: 2025-10-30T21:50:14.113Z
CVE-2020-36866 Nagios XI < 5.7.3 XSS via Manage Users in Admin Interface
Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: Christian Weiler
Published: 2025-10-30T21:53:41.720Z
CVE-2020-36867 Nagios XI < 5.7.3 Command Injection in Report PDF Download
Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped, allowing an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: Christian Weiler
Published: 2025-10-30T21:37:09.717Z
CVE-2020-36868 Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script
Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elevated privileges. A local attacker with low-level access could exploit these weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege escalation.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: Christian Weiler
Published: 2025-10-30T21:40:03.387Z
CVE-2020-36869 Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page
Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: Matthew Aberegg
Published: 2025-10-30T21:45:10.468Z
CVE-2020-36871 ESCAM QD-900 Unauthenticated Configuration Disclosure
ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that may facilitate further compromise of the camera or connected network.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: ESCAM
product: QD-900 WIFI HD Camera
default_status: unknown
Credits: lang: en
value: Todor Donev
Published: 2025-11-26T22:15:07.782Z
CVE-2020-36872 BACnet Test Server 1.01 Malformed BVLC Length DoS
BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails to properly validate the BVLC Length field in incoming UDP BVLC frames on the default BACnet port (47808/udp). A remote unauthenticated attacker can send a malformed BVLC Length value to trigger an access violation and crash the application, resulting in a denial of service.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: BACnet Interoperability Test Services, Inc.
product: BACnet Test Server
default_status: unaffected
Credits: lang: en
value: Gjoko Krstic of Zero Science Lab
Published: 2025-11-26T22:13:47.565Z
CVE-2020-36873 Astak CM-818T3 Unauthenticated Configuration Disclosure
Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that could facilitate further compromise of the camera or connected network.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Astak
product: CM-818T3 2.4GHz Wireless Security Surveillance Camera
default_status: unknown
Credits: lang: en
value: Todor Donev
Published: 2025-11-26T22:13:08.889Z
CVE-2020-36874 ACE SECURITY WIP-90113 Unauthenticated Configuration Disclosure
ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that could facilitate further compromise of the camera or connected network.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: ACE SECURITY
product: WIP-90113 HD Camera
default_status: unknown
Credits: lang: en
value: Todor Donev
Published: 2025-11-26T22:12:32.582Z
CVE-2020-36875 AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: ACCESSALLY, INC.
product: AccessAlly
default_status: unaffected
Credits: lang: en
value: Brad Patton
Published: 2026-01-09T16:41:06.883Z
CVE-2020-36876 ReQuest Serious Play F3 Media Server <= 7.0.3 Debug Log Disclosure2020
ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers to disclose the webserver's Python debug log file containing system information, credentials, paths, processes and command arguments running on the device. Attackers can access sensitive information by visiting the message_log page.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: ReQuest Serious Play LLC
product: ReQuest Serious Play Pro
default_status: unknown
vendor: ReQuest Serious Play LLC
product: ReQuest Serious Play
default_status: unknown
Credits: lang: en
value: Gjoko 'LiquidWorm' Krstic
Published: 2025-12-05T17:13:38.501Z
CVE-2020-36877 ReQuest Serious Play F3 Media Server <= 7.0.3 code execution
ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: ReQuest Serious Play LLC
product: ReQuest Serious Play Pro
default_status: unknown
vendor: ReQuest Serious Play LLC
product: ReQuest Serious Play
default_status: unknown
Credits: lang: en
value: LiquidWorm, Gjoko 'LiquidWorm' Krstic, Macedonian Information Security Research and Development Laboratory, Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Published: 2025-12-05T17:16:50.376Z
CVE-2020-36878 ReQuest Serious Play F3 Media Player <= 3.0.0 Directory Traversal File Disclosure
ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is not properly verified before being used to read web log files. Attackers can exploit this to disclose contents of files from local resources.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: ReQuest Serious Play LLC
product: ReQuest Serious Play Media Player
default_status: unaffected
Credits: lang: en
value: LiquidWorm, Gjoko 'LiquidWorm' Krstic @zeroscience
Published: 2025-12-05T17:17:37.980Z
CVE-2020-36879 Flexsense DiskBoss Service Unquoted Service Path Vulnerability
Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Flexsense
product: DiskBoss
default_status: unaffected
vendor: Flexsense
product: DiskBoss Pro
default_status: unaffected
vendor: Flexsense
product: DiskBoss Ultimate
default_status: unaffected
vendor: Flexsense
product: DiskBoss Pro
default_status: unaffected
vendor: Flexsense
product: DiskBoss Ultimate
default_status: unaffected
vendor: Flexsense
product: DiskBoss Server
default_status: unaffected
vendor: Flexsense
product: DiskBoss Enterprise
default_status: unaffected
Credits: lang: en
value: Mohammed Alshehri, m507
Published: 2025-12-05T17:18:09.743Z
CVE-2020-36880 Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow
Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Reports and Data Directory' field that allows an attacker to execute arbitrary code on the system.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Flexsense
product: DiskBoss
default_status: unaffected
Credits: lang: en
value: MasterVlad
Published: 2025-12-05T17:18:38.902Z
CVE-2020-36881 Flexsense DiskBoss 'Add Input Directory' Buffer Overflow
Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Input Directory' component that allows unauthenticated attackers to execute arbitrary code on the system. Attackers can exploit this by pasting a specially crafted directory path into the 'Add Input Directory' field.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Flexsense
product: DiskBoss
default_status: unaffected
Credits: lang: en
value: Paras Bhatia
Published: 2025-12-05T17:20:41.496Z
CVE-2020-36882 Flexsense DiskBoss Application Crash Denial of Service
Flexsense DiskBoss 7.7.14 allows unauthenticated attackers to upload arbitrary files via /Command/Search Files/Directory field, leading to a denial of service by crashing the application.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Flexsense
product: DiskBoss
default_status: unaffected
Credits: lang: en
value: Paras Bhatia
Published: 2025-12-05T17:33:40.576Z
CVE-2020-36883 SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations
SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techniques in index.php to write backup files to arbitrary locations and delete files by manipulating backup and file delete requests.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SpenetiX AG
product: Fusion Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:47:08.593Z
CVE-2020-36884 BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF
BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery vulnerability in the 'url' GET parameter of the Download Speed Test service. Attackers can specify external domains to bypass firewalls and perform network enumeration by forcing the application to make arbitrary HTTP requests to internal network hosts.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: BrightSign, LLC
product: BrightSign Digital Signage Diagnostic Web Server
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:47:43.331Z
CVE-2020-36885 Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized data to the FTP client functionality, potentially causing remote code execution or denial of service.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Sony Electronics Inc.
product: IPELA Network Camera
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:48:16.642Z
CVE-2020-36886 SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation
SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that automatically submits a form to create a new admin user with full system privileges when a logged-in user visits the page.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: SpenetiX AG
product: Fusion Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:48:38.588Z
CVE-2020-36887 SpinetiX Fusion Digital Signage 3.4.8 Unauthenticated Database Backup Disclosure
SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access the /content/files/backups/ endpoint to download sensitive backup files containing user credentials and system information.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: SpinetiX AG
product: Fusion Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:49:38.636Z
CVE-2020-36888 SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script
SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.
Problem types: cwe_id: CWE-203
description: CWE-203 Observable Discrepancy
Affected products: vendor: SpenetiX AG
product: Fusion Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:51:15.666Z
CVE-2020-36889 Kentico Xperience <= 12.0.90 Administration Interface Stored XSS
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in users' browsers when administrators view error messages in the administration interface.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Kentico
product: Xperience
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Kentico Security Team
Published: 2025-12-18T19:53:25.212Z
CVE-2020-36890 Kentico Xperience <= 10 Administrator Access Control Bypass
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Kentico
product: Xperience
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Denis Styopochkin - Security Engineer, SoftServe
Published: 2025-12-18T19:53:25.672Z