rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-35505 
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: QEMU
Published: 2021-05-28T10:20:48.000Z
CVE-2020-35506 
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: QEMU
Published: 2021-05-28T10:20:55.000Z
CVE-2020-35507 
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: binutils
Published: 2021-01-04T14:24:56.000Z
CVE-2020-35508 
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.
Problem types: cwe_id: CWE-665
description: CWE-665
Affected products: vendor: n/a
product: kernel
Published: 2021-03-26T16:45:18.000Z
CVE-2020-35509 
A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: keycloak
Published: 2022-08-23T15:53:02.000Z
CVE-2020-35510 
A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: jboss-remoting
Published: 2021-06-02T13:22:16.000Z
CVE-2020-35511 
A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.
Problem types: cwe_id: CWE-126
description: CWE-126
Affected products: vendor: n/a
product: pngcheck
Published: 2022-08-23T00:00:00.000Z
CVE-2020-35512 
A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
Problem types: description: Use-After-Free
Affected products: vendor: n/a
product: D-Bus Development branch
vendor: n/a
product: dbus-1.12.x stable branch
vendor: n/a
product: dbus-1.10.x and older branches (EOL)
Published: 2021-02-15T16:08:39.000Z
CVE-2020-35513 
A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service.
Problem types: cwe_id: CWE-271
description: CWE-271
Affected products: vendor: n/a
product: kernel
Published: 2021-01-25T15:58:21.000Z
CVE-2020-35514 
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0-202105111858.p0.
Problem types: cwe_id: CWE-266
description: CWE-266
Affected products: vendor: n/a
product: openshift/machine-config-operator
Published: 2021-06-02T13:22:12.000Z
CVE-2020-35517 
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: n/a
product: qemu
Published: 2021-01-28T19:13:54.000Z
CVE-2020-35518 
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: 389-ds-base
Published: 2021-03-26T16:43:08.000Z
CVE-2020-35519 
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: kernel
Published: 2021-05-06T14:18:35.000Z
CVE-2020-35521 
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: libtiff
Published: 2021-03-09T19:16:30.000Z
CVE-2020-35522 
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: libtiff
Published: 2021-03-09T19:16:54.000Z
CVE-2020-35523 
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: libtiff
Published: 2021-03-09T19:17:24.000Z
CVE-2020-35524 
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: libtiff
Published: 2021-03-09T19:17:54.000Z
CVE-2020-35525 
In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: sqlite
Published: 2022-09-01T00:00:00.000Z
CVE-2020-35527 
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: sqlite
Published: 2022-09-01T00:00:00.000Z
CVE-2020-35530 
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: LibRaw
Published: 2022-09-01T17:52:13.000Z
CVE-2020-35531 
In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: LibRaw
Published: 2022-09-01T17:52:06.000Z
CVE-2020-35532 
In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: LibRaw
Published: 2022-09-01T17:51:59.000Z
CVE-2020-35533 
In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: LibRaw
Published: 2022-09-01T17:54:32.000Z
CVE-2020-35534 
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: LibRaw
Published: 2022-09-01T17:54:28.000Z
CVE-2020-35535 
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: LibRaw
Published: 2022-09-01T17:54:23.000Z
CVE-2020-35538 
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: libjpeg-turbo
Published: 2022-08-31T15:33:04.000Z
CVE-2020-35542 
Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field. This could be used for an XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T10:51:16.000Z
CVE-2020-35545 
Time-based SQL injection exists in Spotweb 1.4.9 via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-17T19:46:25.000Z
CVE-2020-35546 
Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2020-35547 
A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T06:27:08.000Z
CVE-2020-35548 
An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider allows attackers to cause a denial of service. The Samsung ID is SVE-2020-18629 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:46:00.000Z
CVE-2020-35549 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establish itself as the default dialer, without user interaction. The Samsung ID is SVE-2020-19172 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:45:43.000Z
CVE-2020-35550 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via StatusBar. The Samsung ID is SVE-2020-17888 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:45:32.000Z
CVE-2020-35551 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-change attacks because an unauthorized RPMB write operation can be replayed, a related issue to CVE-2020-13799. The Samsung ID is SVE-2020-18100 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:45:01.000Z
CVE-2020-35552 
An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chipsets) software. Attackers can obtain sensitive location information because the configuration file is incorrect. The Samsung ID is SVE-2020-18678 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:44:49.000Z
CVE-2020-35553 
An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software. They allows attackers to cause a denial of service (unlock failure) by triggering a power-shortage incident that causes a false-positive attack detection. The Samsung ID is SVE-2020-19678 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:44:36.000Z
CVE-2020-35554 
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. There is a WebView SSL error-handler vulnerability. The LG ID is LVE-SMP-200026 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:44:17.000Z
CVE-2020-35555 
An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 (December 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:44:06.000Z
CVE-2020-35556 
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T02:17:53.000Z
CVE-2020-35557 Improper Access Validation in products of MB connect line and Helmholz
An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the account he should not have access to due to improper use of access validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-02-16T15:16:06.296Z
CVE-2020-35558 SSRF in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-02-16T15:26:11.394Z
CVE-2020-35559 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:42:20.000Z
CVE-2020-35560 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:28:01.000Z
CVE-2020-35561 SSRF in variuos products of MB connect line and Helmholz
An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: OTORIO reported the vulnerabilities to MB connect line. CERT@VDE coordinated.
Published: 2021-02-16T15:49:45.850Z
CVE-2020-35563 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into the page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:30:20.000Z
CVE-2020-35564 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:35:21.000Z
CVE-2020-35565 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:47:27.000Z
CVE-2020-35566 Local file inclusion vulnerability in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-02-16T15:40:07.656Z
CVE-2020-35567 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across instances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:45:56.000Z
CVE-2020-35568 Sensitive Information Exposure in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-02-16T15:44:10.164Z
CVE-2020-35569 
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-16T15:37:53.000Z
CVE-2020-35570 Foreced Browsing vulnerability in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-02-16T15:23:53.959Z
CVE-2020-35571 
An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T02:23:53.000Z
CVE-2020-35572 
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T17:55:56.000Z
CVE-2020-35573 
srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-20T04:53:41.000Z
CVE-2020-35575 
A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T02:02:45.000Z
CVE-2020-35576 
A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T00:00:00.000Z
CVE-2020-35577 
In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-18T13:43:31.000Z
CVE-2020-35578 
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T20:19:50.000Z