rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-13551 
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via PostgreSQL executable, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: n/a
product: Advantech
Published: 2021-02-17T18:17:14.000Z
CVE-2020-13552 
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: n/a
product: Advantech
Published: 2021-02-17T18:16:44.000Z
CVE-2020-13553 
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: n/a
product: Advantech
Published: 2021-02-17T18:20:47.000Z
CVE-2020-13554 
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: n/a
product: Advantech
Published: 2021-03-03T16:14:07.000Z
CVE-2020-13555 
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server Application Privilege Escalation, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: n/a
product: Advantech
Published: 2021-02-17T18:23:29.000Z
CVE-2020-13556 
An out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: n/a
product: EIP Stack Group
Published: 2020-12-11T03:13:22.000Z
CVE-2020-13557 
A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Foxit
Published: 2020-12-22T17:57:20.000Z
CVE-2020-13558 
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Webkit
Published: 2021-03-03T17:53:13.000Z
CVE-2020-13559 
A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. A specially crafted packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-1024
description: CWE-1024: Comparison of Incompatible Types
Affected products: vendor: n/a
product: FreyrSCADA
Published: 2021-01-11T18:52:54.000Z
CVE-2020-13560 
A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Foxit
Published: 2020-12-22T17:58:11.000Z
CVE-2020-13561 
An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: n/a
product: Accusoft
Published: 2021-02-10T21:45:21.000Z
CVE-2020-13562 
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: n/a
product: phpGACL
Published: 2021-02-01T15:05:16.000Z
CVE-2020-13563 
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: n/a
product: phpGACL
Published: 2021-02-01T15:06:17.000Z
CVE-2020-13564 
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: n/a
product: phpGACL
Published: 2021-02-01T15:07:44.000Z
CVE-2020-13565 
An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: n/a
product: phpGACL
Published: 2021-02-10T19:55:22.000Z
CVE-2020-13566 
SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/edit_group.php, when the POST parameter action is “Delete”, the POST parameter delete_group leads to a SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: phpGACL
Published: 2021-04-13T14:59:57.000Z
CVE-2020-13567 
Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: OpenEMR
product: OpenEMR
vendor: phpGACL
product: phpGACL
Published: 2022-04-18T16:15:22.432Z
CVE-2020-13568 
SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/edit_group.php, when the POST parameter action is “Submit”, the POST parameter parent_id leads to a SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: phpGACL
Published: 2021-04-13T15:00:28.000Z
CVE-2020-13569 
A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: OpenEMR
Published: 2021-01-28T12:28:14.000Z
CVE-2020-13570 
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger the reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: n/a
product: Foxit
Published: 2020-12-22T17:58:37.000Z
CVE-2020-13571 
An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: n/a
product: Accusoft
Published: 2021-02-10T21:45:13.000Z
CVE-2020-13572 
A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file can trigger a heap overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122 - Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Accusoft
Published: 2021-02-10T21:45:35.000Z
CVE-2020-13573 
A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Problem types: cwe_id: CWE-823
description: CWE-823: Use of Out-of-range Pointer Offset
Affected products: vendor: n/a
product: Rockwell Automation
Published: 2021-01-07T17:26:40.000Z
CVE-2020-13574 
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: n/a
product: Genivia
Published: 2021-02-10T00:00:00.000Z
CVE-2020-13575 
A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Genivia
product: gSOAP
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2021-02-10T20:01:25.000Z
CVE-2020-13576 
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: n/a
product: Genivia
Published: 2021-02-10T00:00:00.000Z
CVE-2020-13577 
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: n/a
product: Genivia
Published: 2021-02-10T00:00:00.000Z
CVE-2020-13578 
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: n/a
product: Genivia
Published: 2021-02-10T00:00:00.000Z
CVE-2020-13579 
An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser perform arithmetic that may overflow which can result in an undersized heap allocation. Later when copying data from the file into this allocation, a heap-based buffer overflow will occur which can corrupt memory. These types of memory corruptions can allow for code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: n/a
product: Softmaker Software
Published: 2021-02-04T06:09:02.000Z
CVE-2020-13580 
An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to write a 16-bit null relative to a buffer allocated on the stack. Due to a lack of bounds-checking on this value, this can allow an attacker to write to memory outside of the buffer and controllably corrupt memory. This can allow an attacker to earn code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: n/a
product: Softmaker Software
Published: 2021-02-04T06:08:53.000Z
CVE-2020-13581 
In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a particular record type into a buffer that is smaller than the size used for the copy which will cause a heap-based buffer overflow. An attacker can entice the victim to open a document to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: SoftMaker
Published: 2021-02-10T21:39:11.000Z
CVE-2020-13582 
A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-690
description: CWE-690: Unchecked Return Value to NULL Pointer Dereference
Affected products: vendor: n/a
product: Micrium
Published: 2021-01-26T18:15:54.000Z
CVE-2020-13583 
A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: n/a
product: Micrium
Published: 2021-02-10T21:39:22.000Z
CVE-2020-13584 
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.
Problem types: description: use-after free
Affected products: vendor: n/a
product: Webkit
Published: 2020-12-03T17:02:07.000Z
CVE-2020-13585 
An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: n/a
product: Accusoft
Published: 2021-02-10T21:45:01.000Z
CVE-2020-13586 
A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Softmaker
Published: 2021-02-04T06:40:52.000Z
CVE-2020-13587 
An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: Rukovoditel
Published: 2021-04-09T17:47:40.000Z
CVE-2020-13588 
An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The heading_field_id parameter in ‘‘entities/fields’ page is vulnerable to authenticated SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: Rukovoditel
Published: 2021-08-17T19:14:19.000Z
CVE-2020-13589 
An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in the 'entities/fields page (mulitple_edit or copy_selected or export function) is vulnerable to authenticated SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: Rukovoditel
Published: 2021-08-17T19:14:20.000Z
CVE-2020-13590 
Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can be done either with administrator credentials or through cross-site request forgery.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Rukovoditel
product: Project Management App
Published: 2022-04-18T16:15:23.949Z
CVE-2020-13591 
An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: Rukovoditel
Published: 2021-04-09T17:45:16.000Z
CVE-2020-13592 
An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: Rukovoditel
Published: 2021-04-09T17:48:02.000Z
CVE-2020-13593 
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-Hellman check during the Secure Connection pairing to be skipped if the Link Layer encryption setup is performed earlier. An attacker in radio range can achieve arbitrary read/write access to protected GATT service data, cause a denial of service, or possibly control a device's function by establishing an encrypted session with an unauthenticated Long Term Key (LTK).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:54:16.000Z
CVE-2020-13594 
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map field of the connection request packet on reception, allowing attackers in radio range to cause a denial of service (crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:58:25.000Z
CVE-2020-13595 
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion on the host stack when receiving a packet with an MIC failure. An attacker within radio range can silently trigger the assertion (which disables the target's BLE stack) by sending a crafted sequence of BLE packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:59:57.000Z
CVE-2020-13596 
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T13:13:55.000Z