rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-26414 
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.
Problem types: description: Incorrect regular expression in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2021-01-15T15:15:18.000Z
CVE-2020-26415 
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2020-12-11T03:29:26.000Z
CVE-2020-26416 
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Problem types: description: Information exposure in GitLab EE
Affected products: vendor: GitLab
product: GitLab EE
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2020-12-11T03:34:03.000Z
CVE-2020-26417 
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab CE/EE
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2020-12-11T03:37:36.000Z
CVE-2020-26418 
Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
Problem types: description: Missing release of memory after effective lifetime in Wireshark
Affected products: vendor: The Wireshark Foundation
product: Wireshark
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2020-12-11T17:27:05.000Z
CVE-2020-26419 
Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file.
Problem types: description: Missing release of memory after effective lifetime in Wireshark
Affected products: vendor: The Wireshark Foundation
product: Wireshark
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2020-12-11T17:17:07.000Z
CVE-2020-26420 
Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
Problem types: description: Missing release of memory after effective lifetime in Wireshark
Affected products: vendor: The Wireshark Foundation
product: Wireshark
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2020-12-11T17:20:55.000Z
CVE-2020-26421 
Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
Problem types: description: Buffer over-read in Wireshark
Affected products: vendor: The Wireshark Foundation
product: Wireshark
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
version: 3.1
Published: 2020-12-11T17:25:09.000Z
CVE-2020-26422 
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
Problem types: description: Buffer copy without checking size of input ('classic buffer overflow') in Wireshark
Affected products: vendor: The Wireshark Foundation
product: Wireshark
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2020-12-21T17:15:13.000Z
CVE-2020-26505 
A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T16:57:01.000Z
CVE-2020-26506 
An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T15:04:01.000Z
CVE-2020-26507 
A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into the “Description” field under the “Insert To-Do” option. Other users might download this data, for example a CSV file, and execute the malicious commands on their computer by opening the file using a software such as Microsoft Excel. The attacker could gain remote access to the user’s PC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T17:09:03.000Z
CVE-2020-26508 
The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T18:49:16.000Z
CVE-2020-26509 
Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T18:54:20.000Z
CVE-2020-26510 
Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resultant remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T18:56:01.000Z
CVE-2020-26511 
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T04:04:01.000Z
CVE-2020-26513 
An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-07T15:26:25.000Z
CVE-2020-26515 
An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T12:47:42.000Z
CVE-2020-26516 
A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application through crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T12:28:19.000Z
CVE-2020-26517 
A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project (Authn users), using the users import functionality (Admin only), and changing the login text in the application configuration (Admin only).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T12:42:17.000Z
CVE-2020-26518 
Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T04:31:27.000Z
CVE-2020-26519 
Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T05:34:12.000Z
CVE-2020-26521 
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-06T07:35:12.000Z
CVE-2020-26522 
A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-09T06:44:27.000Z
CVE-2020-26523 
Froala Editor before 3.2.2 allows XSS via pasted content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T06:29:45.000Z
CVE-2020-26524 
CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T06:58:58.000Z
CVE-2020-26525 
Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T19:47:52.000Z
CVE-2020-26526 
An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid ("Unable to find an APIDomain" versus "Wrong email or password").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T19:55:29.000Z
CVE-2020-26527 
An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: *' header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T20:05:31.000Z
CVE-2020-26534 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is an Opt object use-after-free related to Field::ClearItems and Field::DeleteOptions, during AcroForm JavaScript execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:02:15.000Z
CVE-2020-26535 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. If TslAlloc attempts to allocate thread local storage but obtains an unacceptable index value, V8 throws an exception that leads to a write access violation (and read access violation).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:01:55.000Z
CVE-2020-26536 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is a NULL pointer dereference via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:01:41.000Z
CVE-2020-26537 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation, the number of outputs is unequal to the number of color components in a color space. This causes an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:01:28.000Z
CVE-2020-26538 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:01:17.000Z
CVE-2020-26539 
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field dictionaries), a use-after-free can occur with resultant remote code execution (or an information leak).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:01:05.000Z
CVE-2020-26540 
An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing, code injection (or an information leak) can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:00:37.000Z
CVE-2020-26541 
The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:R
version: 3.1
Published: 2020-10-02T18:14:22.000Z
CVE-2020-26542 
An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Microsoft’s Active Directory, Percona has discovered a flaw that would allow authentication to complete when passing a blank value for the account password, leading to access against the service integrated with which Active Directory is deployed at the level granted to the authenticating account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T19:07:19.000Z
CVE-2020-26546 
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-10-12T18:59:36.000Z
CVE-2020-26547 
Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanzas to a victim) to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:02:54.000Z
CVE-2020-26548 
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:22:46.000Z
CVE-2020-26549 
An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file downloading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:24:20.000Z
CVE-2020-26550 
An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-character key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:26:14.000Z
CVE-2020-26551 
An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:33:54.000Z
CVE-2020-26552 
An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:58:07.000Z
CVE-2020-26553 
An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:59:00.000Z
CVE-2020-26554 
REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T16:54:32.000Z
CVE-2020-26555 
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:41:15.000Z
CVE-2020-26556 
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:34:58.000Z
CVE-2020-26557 
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute-force attack (unless the AuthValue is sufficiently random and changed each time).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:28:56.000Z
CVE-2020-26558 
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:22:16.000Z
CVE-2020-26559 
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:13:12.000Z
CVE-2020-26560 
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:06:57.000Z
CVE-2020-26561 
Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create_dir in mini_httpd. Successful exploitation leads to arbitrary code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T05:14:25.000Z
CVE-2020-26563 
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-30T02:52:25.000Z
CVE-2020-26564 
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFile'] URI. The XXE can then be triggered at a admin/preview.do?action=previewSurvey&surveyId= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-31T16:28:05.000Z