rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-24135 
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T15:01:34.000Z
CVE-2020-24136 
Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T15:00:10.000Z
CVE-2020-24137 
Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the path parameter to wex/cssjs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T15:05:46.000Z
CVE-2020-24138 
Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T14:57:36.000Z
CVE-2020-24139 
Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T15:03:05.000Z
CVE-2020-24140 
Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T15:04:33.000Z
CVE-2020-24141 
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:34:10.000Z
CVE-2020-24142 
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:35:05.000Z
CVE-2020-24143 
Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:35:50.000Z
CVE-2020-24144 
Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:37:20.000Z
CVE-2020-24145 
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:37:59.000Z
CVE-2020-24146 
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:38:45.000Z
CVE-2020-24147 
Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:39:17.000Z
CVE-2020-24148 
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:39:54.000Z
CVE-2020-24149 
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:40:46.000Z
CVE-2020-24158 
360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. It is a dual-core browser owned by Beijing Qihoo Technology.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T16:09:02.000Z
CVE-2020-24159 
NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions. This affects Guangzhou NetEase Youdao Dictionary 8.9.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T16:09:37.000Z
CVE-2020-24160 
Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T16:10:07.000Z
CVE-2020-24161 
Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T16:10:37.000Z
CVE-2020-24162 
The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T16:11:19.000Z
CVE-2020-24164 
A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-11T05:49:06.000Z
CVE-2020-24165 
An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2020-24175 
Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows attackers to execute arbitrary code via a crafted archive file, related to filename handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T15:59:20.000Z
CVE-2020-24186 
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2020-08-24T13:02:04.000Z
CVE-2020-24187 
An issue was discovered in ecma-helpers.c in jerryscript version 2.3.0, allows local attackers to cause a denial of service (DoS) (Null Pointer Dereference).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-24188 
Cross-site scripting (XSS) vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web script or HTML via the request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-14T00:00:00.000Z
CVE-2020-24193 
A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T17:59:59.000Z
CVE-2020-24194 
A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T13:59:12.000Z
CVE-2020-24195 
An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T14:21:26.000Z
CVE-2020-24196 
An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T16:54:45.000Z
CVE-2020-24197 
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T14:02:01.000Z
CVE-2020-24198 
A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T14:05:43.000Z
CVE-2020-24199 
Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T14:16:57.000Z
CVE-2020-24202 
File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allows remote attackers to conduct code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T17:15:59.000Z
CVE-2020-24203 
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T17:20:15.000Z
CVE-2020-24208 
A SQL injection vulnerability in SourceCodester Online Shopping Alphaware 1.0 allows remote unauthenticated attackers to bypass the authentication process via email and password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-17T16:05:27.000Z
CVE-2020-24213 
An integer overflow was discovered in YGOPro ygocore v13.51. Attackers can use it to leak the game server thread's memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-23T14:23:05.000Z
CVE-2020-24214 
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T12:58:05.000Z
CVE-2020-24215 
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T13:00:33.000Z
CVE-2020-24216 
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secret URL for RTSP streaming, the stream is still available via its default name such as /0. Unauthenticated attackers can view video streams that are meant to be private.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T13:02:48.000Z
CVE-2020-24217 
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to achieve arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T13:05:36.000Z
CVE-2020-24218 
An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard-coded in the executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T13:10:17.000Z
CVE-2020-24219 
An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with the cleartext administrative password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T13:16:05.000Z
CVE-2020-24220 
ShopXO v1.8.1 has a command execution vulnerability. Attackers can use this vulnerability to execute arbitrary commands and gain control of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-17T16:03:00.000Z
CVE-2020-24221 
An issue was discovered in GetByte function in miniupnp ngiflib version 0.4, allows local attackers to cause a denial of service (DoS) via crafted .gif file (infinite loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-24222 
Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitrary code due to an issue with ALIGN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-24223 
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-30T17:34:22.000Z
CVE-2020-24227 
Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfiles.sol to extract the email and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-23T20:56:59.000Z
CVE-2020-24231 
Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on all interfaces. An attacker can interact with JMX: get system info, and invoke MBean methods. It is possible to install additional MBeans from a remote host using MLet that leads to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-05T15:38:21.000Z
CVE-2020-24240 
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T13:45:01.000Z
CVE-2020-24241 
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T13:51:45.000Z
CVE-2020-24242 
In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T13:54:42.000Z
CVE-2020-24246 
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-07T15:10:19.000Z
CVE-2020-24263 
Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-16T14:42:39.000Z
CVE-2020-24264 
Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-16T14:42:45.000Z
CVE-2020-24265 
An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in MemcmpInterceptorCommon() that can make tcpprep crash and cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T14:58:10.000Z
CVE-2020-24266 
An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in get_l2len() that can make tcpprep crash and cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T14:58:19.000Z
CVE-2020-24271 
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=***&password=***.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T14:17:11.000Z
CVE-2020-24275 
A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2020-24285 
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T10:49:16.000Z
CVE-2020-24292 
Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted ico file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-24293 
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-24294 
Buffer Overflow vulnerability in psdParser::UnpackRLE function in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to cuase a denial of service via opening of crafted psd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-24295 
Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary code via use of crafted psd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-24297 
httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220(EU)_V4_201023
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T15:28:48.000Z
CVE-2020-24301 
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testing and not believed to be widely used for any production purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-08T13:20:58.000Z
CVE-2020-24303 
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T13:25:22.000Z
CVE-2020-24307 
An issue in mRemoteNG v1.76.20 allows attackers to escalate privileges via a crafted executable file. NOTE: third parties were unable to reproduce any scenario in which the claimed access of BUILTIN\Users:(M) is present.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2020-24312 
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T12:47:53.000Z
CVE-2020-24313 
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T12:54:33.000Z