rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-6575 
Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Race
Affected products: vendor: Google
product: Chrome
Published: 2020-09-21T19:06:55.000Z
CVE-2020-6576 
Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2020-09-21T19:06:56.000Z
CVE-2020-6577 
The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext_language SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T03:25:37.000Z
CVE-2020-6578 
Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T03:29:09.000Z
CVE-2020-6579 
Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.php in the MailBeez plugin for ZenCart before 3.9.22 allows remote attackers to inject arbitrary web script or HTML via the cloudloader_mode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-30T13:22:22.000Z
CVE-2020-6581 
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T17:13:00.000Z
CVE-2020-6582 
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T17:13:56.000Z
CVE-2020-6583 
BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T19:06:46.000Z
CVE-2020-6584 
Nagios Log Server 2.1.3 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:33:06.000Z
CVE-2020-6585 
Nagios Log Server 2.1.3 has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:31:53.000Z
CVE-2020-6586 
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:30:57.000Z
CVE-2020-6590 
Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: n/a
product: Forcepoint Web Security Content Gateway
Published: 2021-04-08T21:32:59.000Z
CVE-2020-6609 
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:44:00.000Z
CVE-2020-6610 
GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:43:51.000Z
CVE-2020-6611 
GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:43:41.000Z
CVE-2020-6612 
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:43:32.000Z
CVE-2020-6613 
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:43:24.000Z
CVE-2020-6614 
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:43:13.000Z
CVE-2020-6615 
GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T20:43:04.000Z
CVE-2020-6616 
Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situations where a Hardware Random Number Generator (HRNG) should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset. The Samsung ID is SVE-2020-16882 (May 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-08T19:50:28.000Z
CVE-2020-6617 
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:52:39.000Z
CVE-2020-6618 
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:52:28.000Z
CVE-2020-6619 
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:52:20.000Z
CVE-2020-6620 
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:51:46.000Z
CVE-2020-6621 
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:51:37.000Z
CVE-2020-6622 
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:51:30.000Z
CVE-2020-6623 
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:51:00.000Z
CVE-2020-6624 
jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T00:00:00.000Z
CVE-2020-6625 
jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T00:00:00.000Z
CVE-2020-6627 
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-06T00:00:00.000Z
CVE-2020-6628 
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T01:04:36.000Z
CVE-2020-6629 
Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T01:04:25.000Z
CVE-2020-6630 
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_data_size() in isomedia/isom_read.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T01:04:13.000Z
CVE-2020-6631 
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_process_pmt() in media_tools/m2ts_mux.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T01:04:02.000Z
CVE-2020-6632 
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T01:23:34.000Z
CVE-2020-6637 
openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-24T19:01:32.000Z
CVE-2020-6638 
Grin through 2.1.1 has Insufficient Validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T19:40:36.000Z
CVE-2020-6640 
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: n/a
product: Fortinet FortiAnalyzer
Published: 2020-06-04T12:47:57.000Z
CVE-2020-6641 
Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters.
Problem types: description: Improper Access Control
Affected products: vendor: Fortinet
product: Fortinet FortiPresence
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-06-02T10:26:11.000Z
CVE-2020-6643 
An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perform a cross site scripting attack (XSS).
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiIsolator
Published: 2020-03-12T21:20:50.000Z
CVE-2020-6644 
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks.
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet
product: Fortinet FortiDeceptor
Published: 2020-06-22T15:23:43.000Z
CVE-2020-6646 
An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: n/a
product: Fortinet FortiWeb
Published: 2020-03-17T12:49:51.000Z
CVE-2020-6647 
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: n/a
product: Fortinet FortiADC
Published: 2020-04-07T18:41:40.000Z
CVE-2020-6648 
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: FortiGate and FortiProxy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2020-10-21T14:05:55.000Z
CVE-2020-6649 
An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet
product: Fortinet FortiIsolator
Published: 2021-02-08T15:53:06.000Z
CVE-2020-6650 Arbitrary code execution through “Update Manager” Class
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: Eaton
product: UPS Companion Software
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ravjot Singh Samra
Published: 2020-03-23T13:25:43.903Z
CVE-2020-6651 Command injection via specially crafted file name during config file upload
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Eaton
product: Intelligent Power manager (IPM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Eaton would like to thank Sivathmican Sivakumaran for working with Eaton and helping Eaton in releasing  more robust and secure products.
Published: 2020-05-07T15:58:21.660Z
CVE-2020-6652 Incorrect privilege assignment allowing non-admin users to upload config files
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: Eaton
product: Intelligent Power manager (IPM)
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Eaton would like to thank Sivathmican Sivakumaran for working with Eaton and helping Eaton in releasing  more robust and secure products.
Published: 2020-05-07T15:58:19.816Z
CVE-2020-6653 Sensitive date stored in logcat file
Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can harvest the information and later on can use the information to monitor and control the user's account and associated devices.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Eaton
product: Secure Connect Mobile App
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Eaton would like to thank Vishal Bharad for working with Eaton and helping Eaton in releasing  more robust and secure products.
Published: 2020-08-12T16:03:34.076Z
CVE-2020-6654 DLL Hijacking
A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replacing the required DLLs with malicious DLLs when the software try to load vci11un6.DLL and cinpl.DLL.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Eaton
product: 9000x Programming and Configuration Software
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Eaton would like to thank Yongjun liu from Nsfocus security team
Published: 2020-09-30T20:36:20.513Z
CVE-2020-6655 File parsing Out-Of-Bounds read remote code execution
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Eaton
product: easySoft Software
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Eaton would like to thank Francis Provencher from ZDI
Published: 2021-01-07T17:21:26.000Z
CVE-2020-6656 File parsing Type Confusion Remote code execution vulerability
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Eaton
product: easySoft Software
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Eaton would like to thank Francis Provencher from ZDI
Published: 2021-01-07T17:22:15.000Z
CVE-2020-6750 
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T19:23:03.000Z
CVE-2020-6752 
In OMERO before 5.6.1, group owners can access members' data in other groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T16:26:44.000Z
CVE-2020-6753 
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-01T12:49:25.000Z
CVE-2020-6754 
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T16:08:28.000Z
CVE-2020-6756 
languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T22:10:46.000Z
CVE-2020-6757 
contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute code via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T22:10:23.000Z
CVE-2020-6758 
A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T22:10:32.000Z
CVE-2020-6760 
Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonstrated by ping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T20:02:59.000Z