rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-36525 Linking New Windows Macro cross site scripting
A vulnerability classified as problematic has been found in Linking. This affects an unknown part of the component New Windows Macro. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Linking
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-06-03T14:55:23.000Z
CVE-2020-36526 Countdown Timer Macro cross site scripting
A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Countdown Timer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-06-03T14:55:25.000Z
CVE-2020-36527 Server Status HTTP Status/SMTP Status cross site scripting
A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the component HTTP Status/SMTP Status. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Server Status
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-06-03T14:55:26.000Z
CVE-2020-36528 Platinum Mobile MobileHandler.ashx access control
A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to address this issue. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-264
description: CWE-264 Improper Access Controls
Affected products: vendor: unspecified
product: Platinum Mobile
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: M. Li
Published: 2022-06-03T14:55:28.000Z
CVE-2020-36529 SevOne Network Management System Traceroute traceroute.php command injection
A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Traceroute Handler. The manipulation leads to privilege escalation with a command injection. It is possible to initiate the attack remotely.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: SevOne
product: Network Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Calvin Phang
Published: 2022-06-03T19:10:38.000Z
CVE-2020-36530 SevOne Network Management System Alert Summary sql injection
A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Summary. The manipulation leads to sql injection. The attack can be initiated remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SevOne
product: Network Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Calvin Phang
Published: 2022-06-03T19:10:39.000Z
CVE-2020-36531 SevOne Network Management System Device Manager Page injection
A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.
Problem types: cwe_id: CWE-74
description: CWE-74 Injection
Affected products: vendor: SevOne
product: Network Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Calvin Phang
Published: 2022-06-03T19:10:41.000Z
CVE-2020-36532 Klapp App Authorization Credentials information disclosure
A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipulation leads to information disclosure (Credentials). The attack can be initiated remotely. It is recommended to upgrade the affected app.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: Klapp
product: App
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Sven Fassbender
Published: 2022-06-03T19:10:42.000Z
CVE-2020-36533 Klapp App JSON Web Token improper authentication
A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Klapp
product: App
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Sven Fassbender
Published: 2022-06-03T19:10:44.000Z
CVE-2020-36534 easyii CMS out cross-site request forgery
A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: easyii
product: CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-06-03T19:10:45.000Z
CVE-2020-36535 MINMAX newsDia.php sql injection
A vulnerability classified as critical has been found in MINMAX. This affects an unknown part of the file /newsDia.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: unspecified
product: MINMAX
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Mostafa Farzaneh
Published: 2022-06-03T19:10:47.000Z
CVE-2020-36536 Brandbugle main.php sql injection
A vulnerability was found in Brandbugle. It has been rated as critical. Affected by this issue is some unknown functionality of the file /main.php. The manipulation leads to sql injection. The attack may be launched remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: unspecified
product: Brandbugle
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Mostafa Farzaneh
Published: 2022-06-03T19:10:48.000Z
CVE-2020-36537 Everywhere CMS sql injection
A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Everywhere
product: CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Mostafa Farzaneh
Published: 2022-06-03T19:10:50.000Z
CVE-2020-36538 Eatan CMS sql injection
A vulnerability was found in Eatan CMS. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The attack can be launched remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Eatan
product: CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Mostafa Farzaneh
Published: 2022-06-03T19:10:51.000Z
CVE-2020-36539 Lógico y Creativo sql injection
A vulnerability was found in Lógico y Creativo 1.0 and classified as critical. This issue affects some unknown processing. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: unspecified
product: Lógico y Creativo
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Mostafa Farzaneh
Published: 2022-06-03T19:10:53.000Z
CVE-2020-36540 Neetai Tech product.php sql injection
A vulnerability, which was classified as critical, was found in Neetai Tech. Affected is an unknown function of the file /product.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: unspecified
product: Neetai Tech
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Mostafa Farzaneh
Published: 2022-06-03T19:10:54.000Z
CVE-2020-36541 Demokratian genera_select.php sql injection
A vulnerability was found in Demokratian. It has been rated as critical. Affected by this issue is some unknown functionality of the file basicos_php/genera_select.php. The manipulation of the argument id_provincia with the input -1%20union%20all%20select%201,2,3,4,database() leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: unspecified
product: Demokratian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-06-03T19:10:55.000Z
CVE-2020-36542 Demokratian install3.php privileges management
A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: unspecified
product: Demokratian
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-06-03T19:11:00.000Z
CVE-2020-36543 SialWeb CMS about.php sql injection
A vulnerability, which was classified as critical, was found in SialWeb CMS. This affects an unknown part of the file /about.php. The manipulation of the argument Id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SialWeb
product: CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-06-04T12:35:13.000Z
CVE-2020-36544 SialWeb CMS Search cross site scriting
A vulnerability has been found in SialWeb CMS and classified as problematic. This vulnerability affects unknown code of the component Search Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-80
description: CWE-80 Basic Cross Site Scripting
Affected products: vendor: SialWeb
product: CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-06-04T12:35:15.000Z
CVE-2020-36547 GE Voluson S8 Service Browser hard-coded credentials
A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings.
Problem types: cwe_id: CWE-798
description: CWE-798 Hard-coded Credentials
Affected products: vendor: GE
product: Voluson S8
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Marc Ruef/Rocco Gagliardi
Published: 2022-06-17T13:10:17.000Z
CVE-2020-36548 GE Voluson S8 Service Browser users.cgi improper authentication
A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: GE
product: Voluson S8
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Marc Ruef/Rocco Gagliardi
Published: 2022-06-17T13:10:18.000Z
CVE-2020-36549 GE Voluson S8 Windows Operating System Patches privileges management
A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: GE
product: Voluson S8
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Marc Ruef/Rocco Gagliardi
Published: 2022-06-17T13:10:20.000Z
CVE-2020-36550 
Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Table Name field to /dashboard/table-list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:25:45.000Z
CVE-2020-36551 
Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Item Name field to /dashboard/menu-list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:25:40.000Z
CVE-2020-36552 
Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Made field to /dashboard/menu-list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:25:35.000Z
CVE-2020-36553 
Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Area(food_type) field to /dashboard/menu-list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:25:30.000Z
CVE-2020-36557 
A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-21T03:46:49.000Z
CVE-2020-36558 
A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-21T03:46:33.000Z
CVE-2020-36559 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Problem types: description: CWE 23: Relative Path Traversal
Affected products: vendor: aahframe.work
product: aahframe.work
default_status: unaffected
Credits: lang: en
value: @snyff
Published: 2022-12-27T21:13:19.169Z
CVE-2020-36560 Path traversal in github.com/artdarek/go-unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Problem types: description: CWE 29: Path Traversal: "\..\filename"
Affected products: vendor: github.com/artdarek/go-unzip
product: github.com/artdarek/go-unzip
default_status: unaffected
Published: 2022-12-27T21:13:20.828Z
CVE-2020-36561 Path traversal in github.com/yi-ge/unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Problem types: description: CWE 29: Path Traversal: "\..\filename"
Affected products: vendor: github.com/yi-ge/unzip
product: github.com/yi-ge/unzip
default_status: unaffected
Published: 2022-12-27T21:13:22.650Z
CVE-2020-36562 Uncontrolled Resource Consumption in github.com/shiyanhui/dht
Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.
Problem types: description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: github.com/shiyanhui/dht
product: github.com/shiyanhui/dht
default_status: affected
Credits: lang: en
value: @hMihaiDavid
Published: 2022-12-27T21:13:25.749Z
CVE-2020-36563 Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.
Problem types: description: CWE 328: Use of Weak Hash
Affected products: vendor: github.com/RobotsAndPencils/go-saml
product: github.com/RobotsAndPencils/go-saml
default_status: affected
Published: 2022-12-27T21:13:29.296Z
CVE-2020-36564 Improper input validation in github.com/justinas/nosurf
Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
Problem types: description: CWE 345: Insufficient Verification of Data Authenticity
Affected products: vendor: github.com/justinas/nosurf
product: github.com/justinas/nosurf
default_status: unaffected
Credits: lang: en
value: @aeneasr
Published: 2022-12-27T21:13:31.590Z
CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Problem types: description: CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: github.com/labstack/echo/v4
product: github.com/labstack/echo/v4
default_status: unaffected
Credits: lang: en
value: @little-cui (Apache ServiceComb)
Published: 2022-12-07T16:14:43.946Z