rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-14184 
Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-10-12T03:15:14.763Z
CVE-2020-14185 
Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource. The affected versions are before 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before version 8.12.2.
Problem types: description: Broken Authentication
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-10-15T21:25:13.824Z
CVE-2020-14188 
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue.
Problem types: description: Template Injection
Affected products: vendor: Atlassian
product: gajira-create
Published: 2020-11-09T21:45:18.910Z
CVE-2020-14189 
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment.
Problem types: description: Template Injection
Affected products: vendor: Atlassian
product: gajira-comment
Published: 2020-11-09T21:45:19.325Z
CVE-2020-14190 
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
Problem types: description: Regex Denial of Service (ReDoS)
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2020-11-25T22:40:12.690Z
CVE-2020-14191 
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2020-11-25T21:55:12.551Z
CVE-2020-14192 
Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2021-02-01T23:45:15.351Z
CVE-2020-14193 
Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are those before version 7.1.15.
Problem types: description: Template Injection
Affected products: vendor: Atlassian
product: Automation for Jira
Published: 2020-11-30T23:05:16.049Z
CVE-2020-14194 
Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T04:37:27.000Z
CVE-2020-14195 
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T15:07:11.000Z
CVE-2020-14196 
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-01T17:03:04.000Z
CVE-2020-14198 
Bitcoin Core 0.20.0 allows remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-10T16:36:45.000Z
CVE-2020-14199 
BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the Trezor One and 2.3.1 for the Trezor Model T.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T17:07:22.000Z
CVE-2020-14201 
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T18:30:46.000Z
CVE-2020-14202 
WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T12:47:09.000Z
CVE-2020-14203 
WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) endpoint. The impact may be creation of an administrative user. It can also be exploited in conjunction with CVE-2016-9044.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T12:47:06.000Z
CVE-2020-14204 
In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibi_apps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes to the application repository configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T12:47:07.000Z
CVE-2020-14205 
The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T19:46:28.000Z
CVE-2020-14206 
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T19:48:27.000Z
CVE-2020-14207 
The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T19:50:21.000Z
CVE-2020-14208 
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T21:08:23.000Z
CVE-2020-14209 
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:32:50.000Z
CVE-2020-14210 
Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a function to response to Request URL information when blocking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T21:10:49.000Z
CVE-2020-14212 
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T21:57:50.000Z
CVE-2020-14213 
In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T22:22:14.000Z
CVE-2020-14214 
Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T22:22:34.000Z
CVE-2020-14215 
Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T04:34:38.000Z
CVE-2020-14221 
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.
Problem types: description: "Security misconfiguration"
Affected products: vendor: n/a
product: HCL Digital Experience
Published: 2021-02-02T19:31:57.000Z
CVE-2020-14222 
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
Problem types: description: Cross-site scripting
Affected products: vendor: n/a
product: HCL Digital Experience
Published: 2020-11-05T16:52:20.000Z
CVE-2020-14223 
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
Problem types: description: cross-site scripting
Affected products: vendor: n/a
product: HCL Digital Experience
Published: 2020-10-01T19:31:53.000Z
CVE-2020-14224 
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the Notes application or inject code into the system which would execute with the privileges of the currently logged-in user.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: HCL Notes
Published: 2020-12-18T22:11:54.000Z
CVE-2020-14225 
HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack.
Problem types: description: "Tabnabbing vulnerability"
Affected products: vendor: n/a
product: HCL iNotes
Published: 2020-12-21T17:09:24.000Z
CVE-2020-14230 
HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6, 10.0.1 FP5 and 11.0.1 are affected.
Problem types: description: "Denial of Service"
Affected products: vendor: HCL
product: HCL Domino
Published: 2020-11-21T17:27:03.000Z
CVE-2020-14231 
A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacker resulting in a stack buffer overflow. This could allow the attacker to crash the program or inject code into the system which would execute with the privileges of the currently logged in user.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: HCL Client Application Access
Published: 2020-12-22T20:01:39.000Z
CVE-2020-14232 
A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attacker resulting in a stack buffer overflow. This could allow the attacker to crash the program or inject code into the system which would execute with the privileges of the currently logged in user.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: HCL Notes
Published: 2020-12-17T23:59:59.000Z
CVE-2020-14234 
HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to crash the server. Versions previous to release 9.0.1 FP10 IF6 and release 10.0.1 are affected.
Problem types: description: "Denial of Service "
Affected products: vendor: HCL
product: HCL Domino
Published: 2020-11-21T17:05:15.000Z
CVE-2020-14240 
HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. An attacker could use this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
Problem types: description: Cross-site scripting
Affected products: vendor: n/a
product: HCL Notes
Published: 2020-11-05T16:20:20.000Z
CVE-2020-14244 
A vulnerability in the MIME message handling of the Domino server (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the server or inject code into the system which would execute with the privileges of the server.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-12-14T15:39:08.000Z
CVE-2020-14245 
HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant amount of resources.
Problem types: description: "Missing authentication"
Affected products: vendor: n/a
product: HCL OneTest UI
Published: 2021-02-04T06:38:25.000Z
CVE-2020-14246 
HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials.
Problem types: description: "Weak authentication"
Affected products: vendor: n/a
product: HCL OneTest Performance
Published: 2021-02-04T06:45:56.000Z
CVE-2020-14247 
HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID.
Problem types: description: "Inadequate session timeout"
Affected products: vendor: n/a
product: HCL OneTest Performance
Published: 2021-02-04T06:43:38.000Z
CVE-2020-14248 
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Problem types: description: Security misconfiguration
Affected products: vendor: n/a
product: HCL BigFix Inventory
Published: 2020-12-16T14:11:34.000Z
CVE-2020-14254 
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.
Problem types: description: Security Misconfiguration
Affected products: vendor: n/a
product: HCL BigFix Inventory
Published: 2020-12-16T14:07:42.000Z
CVE-2020-14255 
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. These affect containers only. These do not affect traditional on-premise installations.
Problem types: description: "Sensitive data exposure"
Affected products: vendor: n/a
product: HCL Digital Experience
Published: 2021-02-02T19:40:31.000Z
CVE-2020-14258 
HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.
Problem types: description: "Denial of Service"
Affected products: vendor: HCL
product: HCL Notes
Published: 2020-11-21T17:24:31.000Z
CVE-2020-14260 
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
Problem types: description: "Buffer Overflow"
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-12-02T00:58:57.000Z
CVE-2020-14263 
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
Problem types: description: "Sensitive Data Exposure"
Affected products: vendor: n/a
product: "HCL Traveler Companion"
Published: 2021-10-21T16:34:50.000Z
CVE-2020-14264 
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
Problem types: description: "Sensitive Data Exposure"
Affected products: vendor: n/a
product: "HCL Traveler Companion"
Published: 2021-10-25T13:02:30.000Z
CVE-2020-14268 
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the client or inject code into the system which would execute with the privileges of the client.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: HCL Notes
Published: 2020-12-14T15:49:29.000Z
CVE-2020-14270 
HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-12-22T20:06:31.000Z
CVE-2020-14271 
HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
Problem types: description: Cross-site scripting
Affected products: vendor: n/a
product: HCL iNotes
Published: 2020-12-18T22:08:33.000Z
CVE-2020-14273 
HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HCL Domino
Published: 2020-12-28T19:06:36.000Z
CVE-2020-14274 
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors.
Problem types: description: "Information Disclosure vulnerability"
Affected products: vendor: n/a
product: HCL Commerce
Published: 2021-01-12T14:29:53.000Z
CVE-2020-14275 
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
Problem types: description: "Denial of Service and Information Disclosure"
Affected products: vendor: n/a
product: HCL Commerce
Published: 2021-01-12T14:26:58.000Z
CVE-2020-14292 
In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which reveals the public Bluetooth address of the victim's phone without authorisation, bypassing the Bluetooth address randomisation protection in the user's phone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T16:11:54.000Z
CVE-2020-14293 
conf_datetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field (obtained from the web interface).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:14:49.000Z
CVE-2020-14294 
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:15:34.000Z
CVE-2020-14295 
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T13:47:36.000Z
CVE-2020-14296 
Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: n/a
product: CloudForms
Published: 2020-08-11T13:14:57.000Z
CVE-2020-14297 
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Red Hat
product: wildfly
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-07-24T15:37:25.000Z
CVE-2020-14298 
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.
Problem types: description: Regression
Affected products: vendor: n/a
product: Docker
Published: 2020-07-13T20:53:26.000Z
CVE-2020-14299 
A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: picketbox
Published: 2020-10-16T13:10:43.000Z