rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8951 
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Translation) page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-26T15:28:58.000Z
CVE-2020-8952 
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-26T15:27:51.000Z
CVE-2020-8953 
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T03:13:02.000Z
CVE-2020-8954 
OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in the browser can be manipulated]
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T16:30:32.000Z
CVE-2020-8955 
irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T21:58:51.000Z
CVE-2020-8956 
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-27T04:13:22.000Z
CVE-2020-8958 
Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T20:13:32.000Z
CVE-2020-8959 
Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-19T16:12:36.000Z
CVE-2020-8960 
Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T22:03:05.000Z
CVE-2020-8961 
An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-09T19:54:59.000Z
CVE-2020-8962 
A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T04:17:16.000Z
CVE-2020-8963 
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T02:56:47.000Z
CVE-2020-8964 
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T02:56:32.000Z
CVE-2020-8966 Cross Site Scripting (XSS) flaws found in Tiki-Wiki CMS software
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Tiki-Wiki Groupware
product: Tiki-Wiki CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Pablo Sebastián Arias Rodríguez, Rubén Barberà Pérez, Jorge Alberto Palma Reyes from S2Grupo at CSIRT-CV (Valencia CSIRT) with special thanks to the CSIRT-CV team
Published: 2020-04-01T20:18:19.303Z
CVE-2020-8967 GESIO SQL injection vulnerability
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Affected products: vendor: Gesio (GESTIÓN INTEGRAL ONLINE, SL)
product: GESIO ERP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Francisco Palma, Luis Vázquez and Diego León.
Published: 2020-06-01T13:05:29.043Z
CVE-2020-8968 Parallels Remote Application Server credentials management errors
Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password.
Problem types: cwe_id: CWE-255
description: CWE-255 Credentials Management
Affected products: vendor: Parallels
product: Parallels Remote Application Server (Client)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Francisco Palma, Diego León and David Jiménez
Published: 2021-12-17T16:10:37.247Z
CVE-2020-8973 ZGR TPS200 NG Improper access control
ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with access to the network where the affected asset is located, to operate and change several parameters without having to be registered as a user on the web that owns the device.
Problem types: cwe_id: CWE-284
description: CWE-284: improper access control
Affected products: vendor: ZGR
product: ZGR TPS200 NG
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Discovered by the Industrial Cybersecurity team of S21sec, special mention to Aar�n Flecha Men�ndez.
Published: 2022-10-17T21:17:28.108Z
CVE-2020-8974 ZGR TPS200 NG Missing Reference to Active Allocated Resource
In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: ZGR
product: ZGR TPS200 NG
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by the Industrial Cybersecurity team of S21sec, special mention to Aar�n Flecha Men�ndez.
Published: 2022-10-17T21:16:42.734Z
CVE-2020-8975 ZGR TPS200 NG Information Exposure
ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (URIs) used by the application, to access sensitive information about the system.
Problem types: cwe_id: CWE-201
description: CWE-201: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: ZGR
product: ZGR TPS200 NG
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by the Industrial Cybersecurity team of S21sec, special mention to Aaron Flecha Menendez.
Published: 2022-10-17T21:15:25.826Z
CVE-2020-8976 ZGR TPS200 Cross-Site Request Forgery (CSRF)
The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permissions of a victim user. For this to happen, the victim user has to have an active session and triggers the malicious request.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: ZGR
product: ZGR TPS200 NG
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by the Industrial Cybersecurity team of S21sec, special mention to Aar�n Flecha Men�ndez.
Published: 2022-10-17T21:18:06.952Z
CVE-2020-8981 
A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T16:46:51.000Z
CVE-2020-8982 
An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8983.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:55:59.000Z
CVE-2020-8983 
An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, which allows remote code execution. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8982.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:57:03.000Z
CVE-2020-8984 
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T20:12:07.000Z
CVE-2020-8985 
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T20:12:22.000Z
CVE-2020-8986 
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T20:12:27.000Z
CVE-2020-8987 
Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T16:38:32.000Z
CVE-2020-8988 
The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers (after using root access to make a copy of the local database) to discover login credentials and voting history via an offline brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T20:46:48.000Z
CVE-2020-8989 
In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T20:46:12.000Z
CVE-2020-8990 
Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T21:59:42.000Z
CVE-2020-8991 
vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-14T04:27:16.000Z
CVE-2020-8992 
ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-14T04:27:04.000Z
CVE-2020-8994 
An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T15:43:59.000Z
CVE-2020-8995 
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T21:07:03.000Z
CVE-2020-8996 
AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-16T17:06:20.000Z
CVE-2020-8997 
Older generation Abbott FreeStyle Libre sensors allow remote attackers within close proximity to enable write access to memory via a specific NFC unlock command. NOTE: The vulnerability is not present in the FreeStyle Libre 14-day in the U.S (announced in August 2018) and FreeStyle Libre 2 outside the U.S (announced in October 2018).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-16T17:26:55.000Z
CVE-2020-9000 
An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the size of the log file on the remote server until memory is exhausted, therefore consuming the maximum amount of resources (triggering a denial of service condition).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-01T10:45:48.000Z
CVE-2020-9002 
An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRoleKey=DOMAIN_ADMIN (to achieve Domain Administrator access).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-01T10:45:57.000Z
CVE-2020-9003 
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T21:52:32.000Z
CVE-2020-9004 
A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-14T14:50:52.000Z
CVE-2020-9005 
meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafted map, and inviting a victim to this server. A GetValue call is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T12:52:44.000Z
CVE-2020-9006 
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T14:33:25.000Z
CVE-2020-9007 
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-16T19:08:01.000Z
CVE-2020-9008 
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T17:29:26.000Z
CVE-2020-9009 
The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action=shipnotify) because access to this endpoint is completely unchecked. The attacker must guess an order number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2020-9012 
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-16T20:00:41.000Z
CVE-2020-9013 
Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-16T20:17:55.000Z
CVE-2020-9014 
In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. \Device\EMPNSAUIO and \DosDevices\EMPNSAU are similarly affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T18:50:05.000Z
CVE-2020-9015 
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T21:39:13.000Z
CVE-2020-9016 
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-16T21:10:58.000Z
CVE-2020-9017 
LiteCart through 2.2.1 allows CSV injection via a customer's profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T16:58:02.000Z
CVE-2020-9018 
LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T17:13:51.000Z