rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-5397 CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Spring
product: Spring Framework
Published: 2020-01-17T18:50:12.742Z
CVE-2020-5398 RFD Attack via "Content-Disposition"  Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-site Scripting (XSS) - Reflected
Affected products: vendor: Spring
product: Spring Framework
Published: 2020-01-16T23:55:15.596Z
CVE-2020-5399 CredHub does not properly enable TLS for MySQL database connections
Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Cloud Foundry
product: CredHub
Published: 2020-02-12T20:30:17.255Z
CVE-2020-5400 Cloud Controller logs environment variables from app manifests
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Cloud Foundry
product: CAPI
Published: 2020-02-27T19:30:23.330Z
CVE-2020-5401 Cloud Foundry GoRouter is vulnerable to cache poisoning
Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.
Problem types: cwe_id: CWE-393
description: CWE-393: Return of Wrong Status Code
Affected products: vendor: Cloud Foundry
product: Routing
Published: 2020-02-27T19:30:23.717Z
CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Cloud Foundry
product: UAA
Published: 2020-02-27T19:30:24.167Z
CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Pivotal
product: Reactor Netty
Published: 2020-03-03T18:25:14.205Z
CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Pivotal
product: Reactor Netty
Published: 2020-03-03T17:55:13.953Z
CVE-2020-5405 Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Spring by VMware
product: Spring Cloud Config
Published: 2020-03-05T19:00:19.429Z
CVE-2020-5406 PCF Autoscaling logs its database credentials
VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Pivotal
product: VMware Tanzu Application Service for VMs
Published: 2020-04-10T18:50:12.090Z
CVE-2020-5407 Signature Wrapping Vulnerability with spring-security-saml2-service-provider
Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: Spring by VMware
product: Spring Security
Published: 2020-05-13T17:00:15.881Z
CVE-2020-5408 Dictionary attack with Spring Security queryable text encryptor
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Problem types: cwe_id: CWE-329
description: CWE-329: Not Using a Random IV with CBC Mode
Affected products: vendor: Spring by VMware
product: Spring Security
Published: 2020-05-14T17:15:13.256Z
CVE-2020-5409 Concourse Open Redirect in the /sky/login endpoint
Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)
Problem types: cwe_id: CWE-601
description: CWE-601: Open Redirect
Affected products: vendor: Pivotal
product: Concourse
Published: 2020-05-13T23:15:17.452Z
CVE-2020-5410 Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Spring by VMware
product: Spring Cloud Config
Published: 2020-06-02T16:50:12.055Z
CVE-2020-5411 Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Spring by VMware
product: Spring Batch
Published: 2020-06-11T17:00:16.564Z
CVE-2020-5412 Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Problem types: cwe_id: CWE-441
description: CWE-441: Unintended Proxy or Intermediary
Affected products: vendor: Spring by VMware
product: Spring Cloud Netflix
Published: 2020-08-07T20:45:13.154Z
CVE-2020-5413 Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Spring by VMware
product: Spring Integration
Published: 2020-07-31T19:40:19.970Z
CVE-2020-5414 App Autoscaler logs credentials
VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: VMware Tanzu
product: PCF Autoscaling
vendor: VMware Tanzu
product: Operations Manager
vendor: VMware Tanzu
product: VMware Tanzu Application Service for VMs
Published: 2020-07-31T19:40:20.430Z
CVE-2020-5415 Concourse's GitLab auth allows impersonation
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
Problem types: cwe_id: CWE-290
description: CWE-290: Authentication Bypass by Spoofing
Affected products: vendor: VMware Tanzu
product: Concourse
Published: 2020-08-12T16:40:14.465Z
CVE-2020-5416 CF clusters with NGINX in front of them may be vulnerable to DoS
Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause the Gorouters to be dropped from the NGINX backend pool.
Problem types: cwe_id: CWE-404
description: CWE-404: Improper Resource Shutdown or Release
Affected products: vendor: Cloud Foundry
product: Routing
vendor: Cloud Foundry
product: CF Deployment
Published: 2020-08-21T21:50:14.375Z
CVE-2020-5417 Cloud Controller may allow developers to claim sensitive routes
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Cloud Foundry
product: CAPI
vendor: Cloud Foundry
product: CF Deployment
Published: 2020-08-21T21:50:14.782Z
CVE-2020-5418 Cloud Controller allows users with no roles to list droplets
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Cloud Foundry
product: CAPI
vendor: Cloud Foundry
product: CF Deployment
Published: 2020-09-03T01:10:15.621Z
CVE-2020-5419 RabbitMQ arbitrary code execution using local binary planting
RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could carry out a local binary hijacking (planting) attack and execute arbitrary code.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: VMware Tanzu
product: RabbitMQ
Published: 2020-08-31T15:05:20.057Z
CVE-2020-5420 Gorouter is vulnerable to DoS attack via invalid HTTP responses
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Cloud Foundry
product: Routing
vendor: Cloud Foundry
product: CF Deployment
Published: 2020-09-03T01:10:16.091Z
CVE-2020-5421 RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Problem types: description: CWE-020: Improper Input Validation
Affected products: vendor: Spring by VMware
product: Spring Framework
Published: 2020-09-19T03:45:13.127Z
CVE-2020-5422 UAA password may appear in BOSH System Metrics Server process arguments
BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).
Problem types: cwe_id: CWE-214
description: CWE-214: Invocation of Process Using Visible Sensitive Information
Affected products: vendor: Cloud Foundry
product: BOSH System Metrics Server
Published: 2020-10-02T17:10:12.615Z
CVE-2020-5423 Cloud Controller is vulnerable to denial of service via YAML parsing
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Cloud Foundry
product: CAPI
vendor: Cloud Foundry
product: CF Deployment
Published: 2020-12-02T01:55:11.878Z
CVE-2020-5425 User Impersonation possible in Tanzu SSO
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity providers, one can acquire the token of the other and thus operate with their permissions. Note: Foundation may be vulnerable only if: 1) The system zone is set up to use a SAML identity provider 2) There are internal users that have the same username as users in the external SAML provider 3) Those duplicate-named users have the scope to access the SSO operator dashboard 4) The vulnerability doesn't appear with LDAP because of chained authentication.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: VMware Tanzu
product: Single Sign-On for VMware Tanzu
Published: 2020-10-31T21:45:14.942Z
CVE-2020-5426 Scheduler for TAS can transmit privileged UAA token in plaintext
Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: VMware Tanzu
product: Pivotal Scheduler
Published: 2020-11-11T17:05:15.456Z
CVE-2020-5427 Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query
In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Spring by VMware
product: Spring Cloud Data Flow
Published: 2021-01-27T17:30:16.666Z
CVE-2020-5428 Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query
In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Spring by VMware
product: Spring Cloud Task
Published: 2021-01-27T17:30:17.264Z
CVE-2020-5496 
FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-03T00:00:00.000Z
CVE-2020-5497 
The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-04T02:07:34.000Z
CVE-2020-5499 
Baidu Rust SGX SDK through 1.0.8 has an enclave ID race. There are non-deterministic results in which, sometimes, two global IDs are the same.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-04T06:05:05.000Z
CVE-2020-5501 
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T23:57:43.000Z
CVE-2020-5502 
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T23:59:00.000Z
CVE-2020-5504 
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:56:22.000Z
CVE-2020-5505 
Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to the /api/files/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T18:08:02.000Z
CVE-2020-5509 
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T18:10:02.000Z
CVE-2020-5510 
PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T17:32:49.000Z
CVE-2020-5511 
PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T17:41:17.000Z
CVE-2020-5512 
Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T19:16:31.000Z
CVE-2020-5513 
Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T19:06:20.000Z
CVE-2020-5514 
Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T18:43:47.000Z
CVE-2020-5515 
Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T18:40:10.000Z
CVE-2020-5517 
CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T17:05:06.000Z
CVE-2020-5519 
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T12:54:20.000Z