rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-24492 
Insufficient access control in the firmware for the Intel(R) 722 Ethernet Controllers before version 1.5 may allow a privileged user to potentially enable a denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) 722 Ethernet Controllers
Published: 2021-02-17T13:39:57.000Z
CVE-2020-24493 
Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 8.0 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) 700-series of Ethernet Controllers
Published: 2021-02-17T13:40:51.000Z
CVE-2020-24494 
Insufficient access control in the firmware for the Intel(R) 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) 722 Ethernet Controllers
Published: 2021-02-17T13:41:53.000Z
CVE-2020-24495 
Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) 700-series of Ethernet Controllers
Published: 2021-02-17T13:41:01.000Z
CVE-2020-24496 
Insufficient input validation in the firmware for Intel(R) 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) 722 Ethernet Controllers
Published: 2021-02-17T13:42:40.000Z
CVE-2020-24497 
Insufficient Access Control in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) E810 Ethernet Controllers
Published: 2021-02-17T13:42:01.000Z
CVE-2020-24498 
Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) E810 Ethernet Controllers
Published: 2021-02-17T13:41:45.000Z
CVE-2020-24500 
Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable a denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) E810 Ethernet Controllers
Published: 2021-02-17T13:43:22.000Z
CVE-2020-24501 
Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) E810 Ethernet Controllers
Published: 2021-02-17T13:42:32.000Z
CVE-2020-24502 
Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and
Published: 2021-02-17T13:38:03.000Z
CVE-2020-24503 
Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Ethernet E810 Adapter drivers for Linux
Published: 2021-02-17T13:38:22.000Z
CVE-2020-24504 
Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Ethernet E810 Adapter drivers for Linux
Published: 2021-02-17T13:37:27.000Z
CVE-2020-24505 
Insufficient input validation in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) 700-series of Ethernet Controllers
Published: 2021-02-17T13:42:47.000Z
CVE-2020-24506 
Out of bound read in a subsystem in the Intel(R) CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) CSME versions
Published: 2021-06-09T18:48:44.000Z
CVE-2020-24507 
Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) CSME versions
Published: 2021-06-09T18:47:46.000Z
CVE-2020-24509 
Insufficient control flow management in subsystem in Intel(R) SPS versions before SPS_E3_05.01.04.300.0, SPS_SoC-A_05.00.03.091.0, SPS_E5_04.04.04.023.0, or SPS_E5_04.04.03.263.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) SPS versions
Published: 2021-06-09T18:47:35.000Z
CVE-2020-24511 
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2021-06-09T18:53:53.000Z
CVE-2020-24512 
Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2021-06-09T18:53:59.000Z
CVE-2020-24513 
Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel Atom(R) Processors
Published: 2021-06-09T18:54:08.000Z
CVE-2020-24514 
Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) RealSense(TM) IDs
Published: 2021-06-09T18:48:55.000Z
CVE-2020-24515 
Protection mechanism failure in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) RealSense(TM) IDs
Published: 2021-06-09T18:48:48.000Z
CVE-2020-24516 
Modification of assumed-immutable data in subsystem in Intel(R) CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) CSME versions
Published: 2021-06-09T18:47:56.000Z
CVE-2020-24525 
Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) NUCs
Published: 2020-11-12T18:16:05.000Z
CVE-2020-24548 
Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, and provides "Cannot connect to" error messages to inform the attacker about closed ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T18:28:41.000Z
CVE-2020-24549 
openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T23:05:12.000Z
CVE-2020-24550 
An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T21:32:40.000Z
CVE-2020-24551 IProom MMC+ Server - URL Redirection to Untrusted Site (Open Redirect')
IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim's login credentials.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: IProom
product: MMC+ Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2020-10-14T12:45:16.360Z
CVE-2020-24552 Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway - Command Injection
Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface allows attackers to inject specific code and execute system commands without privilege.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901
vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901B
vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5904D
vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908
vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908A
vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916
vendor: Atop Technology
product: 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916A
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2020-09-10T08:40:20.444Z
CVE-2020-24553 
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:25:52.000Z
CVE-2020-24554 
The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T13:49:14.000Z
CVE-2020-24556 
A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.
Problem types: description: Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2020-09-01T18:55:26.000Z
CVE-2020-24557 
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.
Problem types: description: Improper Access Control Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2020-09-01T18:55:27.000Z
CVE-2020-24558 
A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an attacker to manipulate it to cause an out-of-bounds read that crashes multiple processes in the product. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Improper Access Control Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2020-09-01T18:55:27.000Z
CVE-2020-24559 
A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain binary to load and run a script from a user-writable folder, which then would allow them to execute arbitrary code as root. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Hard Link Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2020-09-01T18:55:27.000Z
CVE-2020-24560 
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-295: Improper server certificate verification in the communication with the update server.
Problem types: description: Improper Certification Validation
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-09-24T01:50:22.000Z
CVE-2020-24561 
A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attacker must first obtain admin/root privileges on the SPLX console to exploit this vulnerability.
Problem types: description: Command Injection
Affected products: vendor: Trend Micro
product: Trend Micro ServerProtect for Linux
Published: 2020-09-15T20:00:16.000Z
CVE-2020-24562 
A vulnerability in Trend Micro OfficeScan XG SP1 on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This CVE is similar, but not identical to CVE-2020-24556.
Problem types: description: Hard Link Priv Escalation
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2020-09-28T23:30:41.000Z
CVE-2020-24563 
A vulnerability in Trend Micro Apex One may allow a local attacker to manipulate the process of the security agent unload option (if configured), which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit this vulnerability.
Problem types: description: Authentication Bypass
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:42.000Z
CVE-2020-24564 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24565 and CVE-2020-25770.
Problem types: description: OOB Read Info Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:42.000Z
CVE-2020-24565 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770.
Problem types: description: OOB Read Info Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:42.000Z
CVE-2020-24566 
In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then (under certain circumstances) the account password is exposed in cleartext in the verbose task logs output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T15:31:25.000Z
CVE-2020-24567 
voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: this is only relevant if low-privileged users can write to the installation directory, which may be considered a site-specific configuration error
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T02:26:29.000Z
CVE-2020-24568 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T18:19:43.000Z
CVE-2020-24569 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:39:40.000Z
CVE-2020-24570 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module, allowing attackers to steal session information from logged-in users with a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:44:26.000Z
CVE-2020-24571 
NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T03:05:08.000Z
CVE-2020-24572 
An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-24T19:14:58.000Z
CVE-2020-24573 
BAB TECHNOLOGIE GmbH eibPort V3 prior to 3.8.3 devices allow denial of service (Uncontrolled Resource Consumption) via requests to the lighttpd component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T17:38:47.000Z
CVE-2020-24574 
The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based "trusted client" protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T03:41:50.000Z
CVE-2020-24576 
Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T10:45:07.000Z
CVE-2020-24577 
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-08T06:45:09.000Z
CVE-2020-24578 
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files (such as the password hash file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-22T18:04:24.000Z
CVE-2020-24579 
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-22T18:04:52.000Z
CVE-2020-24580 
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. Lack of authentication functionality allows an attacker to assign a static IP address that was once used by a valid user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-22T18:04:56.000Z