rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-35211 
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:08:23.000Z
CVE-2020-35213 
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:08:24.000Z
CVE-2020-35214 
An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:08:25.000Z
CVE-2020-35215 
An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:08:26.000Z
CVE-2020-35216 
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:08:26.000Z
CVE-2020-35217 
Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T12:28:44.000Z
CVE-2020-35219 
The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST request to Advanced_System_Content.asp with the uiViewTools_username=admin&uiViewTools_Password= and uiViewTools_PasswordConfirm= substrings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T17:50:42.000Z
CVE-2020-35221 
The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be insecure, allowing attackers (with access to a network capture) to quickly generate multiple collisions to generate valid passwords, or infer some parts of the original.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T17:48:11.000Z
CVE-2020-35223 
The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF token parameter in HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T17:57:26.000Z
CVE-2020-35224 
A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote unauthenticated attackers to force a device reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T17:58:14.000Z
CVE-2020-35225 
The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly validating the length of string parameters sent in write requests, potentially allowing denial of service attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T17:58:53.000Z
CVE-2020-35226 
NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding write request command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:03:30.000Z
CVE-2020-35227 
A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web panel) allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:05:54.000Z
CVE-2020-35228 
A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:10:13.000Z
CVE-2020-35229 
The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused until a new token is generated, which allows attackers (with access to network traffic) to effectively gain administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:10:56.000Z
CVE-2020-35230 
Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be abused to cause a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:11:54.000Z
CVE-2020-35231 
The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:14:44.000Z
CVE-2020-35233 
The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force device reboots by sending concurrent connections, aka a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T18:16:43.000Z
CVE-2020-35234 
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-14T02:21:44.000Z
CVE-2020-35235 
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-14T02:20:27.000Z
CVE-2020-35236 
The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-14T04:44:18.000Z
CVE-2020-35239 
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T23:37:02.000Z
CVE-2020-35240 
FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T14:23:14.000Z
CVE-2020-35241 
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T14:26:49.000Z
CVE-2020-35242 
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T19:13:44.000Z
CVE-2020-35243 
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T19:14:43.000Z
CVE-2020-35244 
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T19:15:59.000Z
CVE-2020-35245 
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T19:16:34.000Z
CVE-2020-35249 
Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add client feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-02T10:35:19.000Z
CVE-2020-35252 
Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T18:32:05.000Z
CVE-2020-35261 
Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Restaurant Name field to /dashboard/profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:25:51.000Z
CVE-2020-35262 
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T21:11:53.000Z
CVE-2020-35263 
EgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin panel, which may allow arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T17:20:30.000Z
CVE-2020-35269 
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T18:44:12.000Z
CVE-2020-35270 
Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of Admin Panel and manage every account of Result.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T14:40:33.000Z
CVE-2020-35271 
Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Employees, First Name and Last Name fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T15:37:37.000Z
CVE-2020-35272 
Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Admin Portal in the Task and Description fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T15:38:10.000Z
CVE-2020-35273 
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T14:51:09.000Z
CVE-2020-35274 
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T14:51:18.000Z
CVE-2020-35275 
Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T14:51:26.000Z
CVE-2020-35276 
EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T14:51:33.000Z
CVE-2020-35284 
Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product's source code is available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T05:31:42.000Z
CVE-2020-35296 
ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-03T15:04:59.000Z
CVE-2020-35305 
Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T13:40:53.000Z
CVE-2020-35308 
CONQUEST DICOM SERVER before 1.5.0 has a code execution vulnerability which can be exploited by attackers to execute malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T19:10:35.000Z
CVE-2020-35309 
Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML in admin dashboard - "Categories".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-21T14:41:27.000Z
CVE-2020-35313 
A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T19:05:37.000Z
CVE-2020-35314 
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T19:25:54.000Z
CVE-2020-35326 
SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-18T00:00:00.000Z
CVE-2020-35327 
SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POST) parameter to admin_class.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-04T15:40:34.000Z
CVE-2020-35328 
Courier Management System 1.0 - 'First Name' Stored XSS
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-04T15:44:11.000Z
CVE-2020-35329 
Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-04T15:51:12.000Z
CVE-2020-35337 
ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-24T15:40:14.000Z
CVE-2020-35338 
The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-14T17:02:52.000Z
CVE-2020-35339 
In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T14:32:11.000Z
CVE-2020-35340 
A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the running ExpertPDF process has access to read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T11:27:26.000Z
CVE-2020-35342 
GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-35346 
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T03:04:32.000Z
CVE-2020-35347 
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T03:05:36.000Z
CVE-2020-35349 
Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T03:42:23.000Z
CVE-2020-35357 
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-35358 
DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-15T11:55:53.000Z
CVE-2020-35359 
Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T04:30:32.000Z
CVE-2020-35362 
DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker must provide the correct fileOrgName value).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T05:19:10.000Z
CVE-2020-35364 
Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T18:20:14.000Z
CVE-2020-35370 
A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code execution(RCE) on the hosting server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T18:40:49.000Z
CVE-2020-35373 
In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-17T15:50:28.000Z
CVE-2020-35376 
Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T03:30:15.000Z
CVE-2020-35378 
SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-14T15:44:23.000Z
CVE-2020-35380 
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T20:12:11.000Z
CVE-2020-35381 
jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T20:14:09.000Z
CVE-2020-35382 
SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-14T15:52:33.000Z
CVE-2020-35388 
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T02:38:32.000Z