rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8625 A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
Problem types: description: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch:GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between parties on a network.  SPNEGO is a negotiation mechanism used by GSSAPI, the application protocol interface for GSS-TSIG.  The SPNEGO implementation used by BIND has been found to be vulnerable to a buffer overflow attack.
Affected products: vendor: ISC
product: BIND9
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ISC would like to thank an anonymous party, working in conjunction with Trend Micro Zero Day Initiative, for reporting this issue to us.
Published: 2021-02-17T22:40:16.090Z
CVE-2020-8631 
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T13:39:50.000Z
CVE-2020-8632 
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T13:40:05.000Z
CVE-2020-8633 
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T21:17:08.000Z
CVE-2020-8634 
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T23:33:20.000Z
CVE-2020-8635 
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T23:33:06.000Z
CVE-2020-8636 
An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T16:49:48.000Z
CVE-2020-8637 
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-03T18:36:38.000Z
CVE-2020-8638 
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-03T18:36:41.000Z
CVE-2020-8639 
An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This allows an authenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to a publicly accessible directory of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-03T18:36:44.000Z
CVE-2020-8641 
Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T20:12:33.000Z
CVE-2020-8644 
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T21:03:11.000Z
CVE-2020-8645 
An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parameter is job_id. The function is getJobApplicationsByJobId(). The file is _lib/class.JobApplication.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T23:50:22.000Z
CVE-2020-8647 
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T00:06:51.000Z
CVE-2020-8648 
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T00:06:36.000Z
CVE-2020-8649 
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T00:06:25.000Z
CVE-2020-8654 
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T23:55:10.000Z
CVE-2020-8655 
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T23:58:09.000Z
CVE-2020-8656 
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T23:47:30.000Z
CVE-2020-8657 
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T17:48:08.000Z
CVE-2020-8658 
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T02:19:25.000Z
CVE-2020-8659 
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T20:43:55.000Z
CVE-2020-8660 
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T21:10:15.000Z
CVE-2020-8661 
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T20:48:16.000Z
CVE-2020-8663 
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-01T14:19:26.000Z
CVE-2020-8664 
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T20:53:13.000Z
CVE-2020-8669 
Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information disclosure via network access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Data Center Manager Console
Published: 2020-11-12T18:55:14.000Z
CVE-2020-8670 
Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2021-06-09T18:50:23.000Z
CVE-2020-8671 
Insufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 4000 Series may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Intel BIOS
Published: 2020-10-05T13:48:22.000Z
CVE-2020-8672 
Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allow an unauthenticated user to potentially enable elevation of privilege or denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel BIOS Advisory
Published: 2021-02-02T21:16:39.000Z
CVE-2020-8674 
Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may allow an unauthenticated user to potentially enable information disclosure via network access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Intel(R) AMT and Intel(R) ISM
Published: 2020-06-15T14:00:54.000Z
CVE-2020-8675 
Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R)Innovation Engine Advisory
Published: 2020-06-15T13:52:47.000Z
CVE-2020-8676 
Improper access control in the Intel(R) Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: versions
Published: 2020-11-12T18:00:07.000Z
CVE-2020-8677 
Improper access control in the Intel(R) Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: versions
Published: 2020-11-12T18:00:16.000Z
CVE-2020-8678 
Improper access control for Intel(R) Graphics Drivers before version 15.45.33.5164 and 27.20.100.8280 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers
Published: 2021-02-17T13:49:30.000Z
CVE-2020-8679 
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers Advisory
Published: 2020-08-13T03:21:46.000Z
CVE-2020-8680 
Race condition in some Intel(R) Graphics Drivers before version 15.40.45.5126 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers Advisory
Published: 2020-08-13T03:19:15.000Z
CVE-2020-8681 
Out of bounds write in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers Advisory
Published: 2020-08-13T03:18:44.000Z
CVE-2020-8682 
Out of bounds read in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers Advisory
Published: 2020-08-13T03:24:54.000Z
CVE-2020-8683 
Improper buffer restrictions in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers Advisory
Published: 2020-08-13T03:25:16.000Z
CVE-2020-8684 
Improper access control in firmware for Intel(R) PAC with Arria(R) 10 GX FPGA before Intel Acceleration Stack version 1.2.1 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) PAC with Arria(R) 10 GX FPGA Advisory
Published: 2020-08-13T03:16:58.000Z
CVE-2020-8685 
Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel (R) LED Manager for NUC Advisory
Published: 2020-08-13T03:16:27.000Z
CVE-2020-8687 
Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB Advisory
Published: 2020-08-13T03:16:04.000Z
CVE-2020-8688 
Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) RAID Web Console 3 for Windows* Advisory
Published: 2020-08-13T03:14:50.000Z
CVE-2020-8689 
Improper buffer restrictions in the Intel(R) Wireless for Open Source before version 1.5 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) Wireless for Open Source Advisory
Published: 2020-08-13T03:13:36.000Z
CVE-2020-8690 
Protection mechanism failure in Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Problem types: description: escalation of privilege and/or denial of service
Affected products: vendor: n/a
product: Intel(R) Ethernet 700 Series Controllers
Published: 2020-11-12T18:01:12.000Z
CVE-2020-8691 
A logic issue in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Problem types: description: escalation of privilege and/or denial of service
Affected products: vendor: n/a
product: Intel(R) Ethernet 700 Series Controllers
Published: 2020-11-12T18:01:25.000Z
CVE-2020-8692 
Insufficient access control in the firmware of the Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Problem types: description: escalation of privilege and/or denial of service
Affected products: vendor: n/a
product: Intel(R) Ethernet 700 Series Controllers
Published: 2020-11-12T18:01:05.000Z
CVE-2020-8693 
Improper buffer restrictions in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Problem types: description: escalation of privilege and/or denial of service
Affected products: vendor: n/a
product: Intel(R) Ethernet 700 Series Controllers
Published: 2020-11-12T18:00:51.000Z
CVE-2020-8694 
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2020-11-12T18:03:34.000Z
CVE-2020-8695 
Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2020-11-12T18:03:43.000Z
CVE-2020-8696 
Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2020-11-12T18:02:06.000Z
CVE-2020-8698 
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2020-11-12T18:01:55.000Z
CVE-2020-8700 
Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2021-06-09T18:50:30.000Z
CVE-2020-8701 
Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) SSD Toolbox versions
Published: 2021-02-17T13:39:24.000Z
CVE-2020-8702 
Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processor Diagnostic Tool
Published: 2021-06-09T18:47:29.000Z
CVE-2020-8703 
Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) CSME versions
Published: 2021-06-09T18:48:39.000Z
CVE-2020-8704 
Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) LMS versions
Published: 2021-06-09T18:47:41.000Z
CVE-2020-8705 
Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 3.1.80 and 4.0.30, Intel(R) SPS versions before E5_04.01.04.400, E3_04.01.04.200, SoC-X_04.00.04.200 and SoC-A_04.00.04.300 may allow an unauthenticated user to potentially enable escalation of privileges via physical access.
Problem types: description: escalation of privileges
Affected products: vendor: n/a
product: Intel(R) Boot Guard, Intel(R) CSME, Intel(R) TXE, Intel(R) SPS
Published: 2020-11-12T18:06:24.000Z
CVE-2020-8706 
Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Server Boards, Server Systems and Compute Modules Advisory
Published: 2020-08-13T02:55:38.000Z
CVE-2020-8707 
Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Server Boards, Server Systems and Compute Modules Advisory
Published: 2020-08-13T02:27:58.000Z