rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-9437 
SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-25T19:35:18.000Z
CVE-2020-9438 
Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred when the attacker was previously authorized. In other words, door-access revocation is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-23T14:31:58.000Z
CVE-2020-9439 
Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the search_key GET Parameter in TinCan_Content_List_Table.php, message GET Parameter in licensing.php, tc_filter_group parameter in reporting-admin-menu.php, tc_filter_user parameter in reporting-admin-menu.php, tc_filter_course parameter in reporting-admin-menu.php, tc_filter_lesson parameter in reporting-admin-menu.php, tc_filter_module parameter in reporting-admin-menu.php, tc_filter_action parameter in reporting-admin-menu.php, tc_filter_data_range parameter in reporting-admin-menu.php, or tc_filter_data_range_last parameter in reporting-admin-menu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T15:47:14.000Z
CVE-2020-9440 
A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T16:57:12.000Z
CVE-2020-9442 
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T13:40:41.000Z
CVE-2020-9443 
Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T12:20:59.000Z
CVE-2020-9444 
Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T19:49:16.000Z
CVE-2020-9445 
Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T19:51:25.000Z
CVE-2020-9447 
There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cross-site scripting enables attackers to steal data, change the appearance of a website, and perform other malicious activities like phishing or drive-by hacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T15:07:46.000Z
CVE-2020-9449 
An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 allows an attacker (with a guest or user session cookie) to escalate privileges by retrieving the cookie salt value and creating a valid session cookie for an arbitrary user or admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T20:19:43.000Z
CVE-2020-9450 
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to anti_ransomware_service.exe. This can be exploited to add an arbitrary malicious executable to the whitelist, or even exclude an entire drive from being monitored by anti_ransomware_service.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T11:08:01.000Z
CVE-2020-9451 
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a (not yet created) log file to anti_ransomware_service.exe. On reboot, this forces the anti_ransomware_service to try to write its log into its own process, crashing in a SHARING VIOLATION. This crash occurs on every reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T11:01:41.000Z
CVE-2020-9452 
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine folder, it is possible to control this privileged write with a hardlink. This means that an unprivileged user can write/overwrite arbitrary files in arbitrary folders. Escalating privileges to SYSTEM is trivial with arbitrary writes. While the quarantine feature is not enabled by default, it can be forced to copy the file to the quarantine by communicating with anti_ransomware_service.exe through its REST API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T11:21:58.000Z
CVE-2020-9453 
In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \Device\EMPMPAUIO and \DosDevices\EMPMPAU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T19:07:26.000Z
CVE-2020-9454 
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T18:43:13.000Z
CVE-2020-9455 
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T18:49:50.000Z
CVE-2020-9456 
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T18:54:07.000Z
CVE-2020-9457 
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T18:56:35.000Z
CVE-2020-9458 
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T18:58:53.000Z
CVE-2020-9459 
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T20:51:53.000Z
CVE-2020-9460 
Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-14T14:32:53.000Z
CVE-2020-9461 
Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-14T14:35:52.000Z
CVE-2020-9462 
An issue was discovered in all Athom Homey and Homey Pro devices up to the current version 4.2.0. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup. Upon success, the attacker is able to further infiltrate the target's Wi-Fi networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:49:28.000Z
CVE-2020-9463 
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T17:55:22.000Z
CVE-2020-9464 
A Denial-of-Service vulnerability exists in BECKHOFF Ethernet TCP/IP Bus Coupler BK9000. After an attack has occurred, the device's functionality can be restored by rebooting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:28:53.000Z
CVE-2020-9465 
An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the user_id field in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T19:32:53.000Z
CVE-2020-9466 
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-28T19:42:03.000Z
CVE-2020-9467 
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T19:09:27.000Z
CVE-2020-9468 
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T19:12:15.000Z
CVE-2020-9470 
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T00:20:48.000Z
CVE-2020-9471 
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T19:44:06.000Z
CVE-2020-9472 
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T19:47:06.000Z
CVE-2020-9473 
The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T14:56:28.000Z
CVE-2020-9474 
The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T20:22:59.000Z
CVE-2020-9475 
The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T20:29:15.000Z
CVE-2020-9476 
ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T18:13:05.000Z
CVE-2020-9477 
An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interface could allow an unauthenticated remote attacker to capture packets at the time of authentication and gain access to the cleartext password. An attacker could use this access to create a new user account or control the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T18:16:28.000Z
CVE-2020-9478 
An issue was discovered in Rubrik 5.0.3-2296. An OS command injection vulnerability allows an authenticated attacker to remotely execute arbitrary code on Rubrik-managed systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-13T14:14:01.000Z
CVE-2020-9479 unzip directory traversal
When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB
Problem types: description: directory traversal
Affected products: vendor: Apache Software Foundation
product: Apache AsterixDB
Credits: lang: en
value: This issue was discovered by Yiming Xiang of NSFOCUS
Published: 2021-03-01T15:55:12.000Z
CVE-2020-9480 
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Spark
Published: 2020-06-23T21:50:51.000Z
CVE-2020-9481 
Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.
Problem types: description: Other
Affected products: vendor: Apache
product: ATS
Published: 2020-04-27T21:11:54.000Z
CVE-2020-9482 
If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.
Problem types: description: Authentication
Affected products: vendor: Apache
product: Apache NiFi Registry
Published: 2020-04-28T18:12:58.000Z
CVE-2020-9483 
**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: Apache SkyWalking
Published: 2020-06-30T14:28:35.000Z
CVE-2020-9484 
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: Apache Tomcat
Published: 2020-05-20T18:26:41.000Z
CVE-2020-9485 
An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.
Problem types: description: Stored XSS
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
Published: 2020-07-16T23:21:35.000Z
CVE-2020-9486 
In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache NiFi
Published: 2020-10-01T19:50:53.000Z
CVE-2020-9487 
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Apache NiFi
Published: 2020-10-01T19:53:11.000Z
CVE-2020-9488 
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
Problem types: description: Improper Validation of Certificate with Host Mismatch
Affected products: vendor: Apache
product: Apache Log4j
Published: 2020-04-27T15:36:10.000Z
CVE-2020-9489 
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Problem types: description: n/a
Affected products: vendor: The Apache Software Foundation
product: Apache Tika
Published: 2020-04-27T13:25:27.000Z
CVE-2020-9490 
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
Problem types: description: Push Diary Crash on Specifically Crafted HTTP/2 Header
Affected products: vendor: n/a
product: Apache HTTP Server
Published: 2020-08-07T15:24:49.000Z
CVE-2020-9491 
In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Problem types: description: Use of weak TLS protocols
Affected products: vendor: n/a
product: Apache NiFi
Published: 2020-10-01T19:57:34.000Z
CVE-2020-9492 
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Apache Hadoop
Published: 2021-01-26T12:55:29.000Z
CVE-2020-9493 Java deserialization in Chainsaw
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Chainsaw
Credits: lang: en
value: This issue was reported by @kingkk
Published: 2021-06-16T07:30:11.000Z
CVE-2020-9494 
Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Published: 2020-06-24T15:25:57.000Z
CVE-2020-9495 
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Archiva
Published: 2020-06-19T18:59:20.000Z
CVE-2020-9496 
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
Problem types: description: XSS Vulnerability
Affected products: vendor: n/a
product: Apache OFBiz
Published: 2020-07-15T15:39:31.000Z
CVE-2020-9497 
Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compromised RDP server, specially-craftedPDUs could result in disclosure of information within the memory ofthe guacd process handling the connection.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Guacamole
Published: 2020-07-02T12:30:33.000Z