rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-5625 
Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science
product: XooNIps
Published: 2020-08-28T04:05:30.000Z
CVE-2020-5626 
Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands via a specially crafted log file.
Problem types: description: OS Command Injection
Affected products: vendor: Infoscience Corporation
product: Logstorage and ELC Analytics
Published: 2021-01-28T10:00:28.000Z
CVE-2020-5627 
Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Problem types: description: Fails to restrict access
Affected products: vendor: YODOBASHI CAMERA CO.,LTD.
product: Yodobashi App for Android
Published: 2020-09-09T08:50:12.000Z
CVE-2020-5628 
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
Problem types: description: Fails to restrict access
Affected products: vendor: UNIQLO CO., LTD.
product: UNIQLO App for Android
Published: 2020-09-18T05:05:25.000Z
CVE-2020-5629 
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
Problem types: description: Fails to restrict access
Affected products: vendor: UNIQLO CO., LTD.
product: UNIQLO App for Android
Published: 2020-09-18T05:05:25.000Z
CVE-2020-5631 
Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: CMONOS Co. Ltd.
product: CMONOS.JP
Published: 2020-10-06T05:00:26.000Z
CVE-2020-5632 
InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.
Problem types: description: Fails to restrict access
Affected products: vendor: NEC Corporation
product: InfoCage SiteShell series
Published: 2020-10-06T05:00:27.000Z
CVE-2020-5633 
Multiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti, and Express5800/GT110j) where Baseboard Management Controller (BMC) firmware Rev1.09 and earlier is applied allows remote attackers to bypass authentication and then obtain/modify BMC setting information, obtain monitoring information, or reboot/shut down the vulnerable product via unspecified vectors.
Problem types: description: Authentication bypass
Affected products: vendor: NEC Corporation
product: Multiple NEC products where Baseboard Management Controller (BMC) firmware Rev1.09 and earlier is applied
Published: 2021-01-13T09:40:35.000Z
CVE-2020-5634 
ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2020-10-06T05:00:27.000Z
CVE-2020-5635 
Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: Aterm SA3500G
Published: 2020-12-14T02:25:51.000Z
CVE-2020-5636 
Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: Aterm SA3500G
Published: 2020-12-14T02:25:51.000Z
CVE-2020-5637 
Improper validation of integrity check value vulnerability in Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to execute a malicious program.
Problem types: description: Improper Validation of Integrity Check Value
Affected products: vendor: NEC Corporation
product: Aterm SA3500G
Published: 2020-12-14T02:25:52.000Z
CVE-2020-5638 
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: NEOJAPAN Inc.
product: desknet's NEO
Published: 2020-12-03T11:15:31.000Z
CVE-2020-5639 
Directory traversal vulnerability in FileZen versions from V3.0.0 to V4.2.2 allows remote attackers to upload an arbitrary file in a specific directory via unspecified vectors. As a result, an arbitrary OS command may be executed.
Problem types: description: Directory traversal
Affected products: vendor: Soliton Systems K.K.
product: FileZen
Published: 2020-12-14T02:25:53.000Z
CVE-2020-5640 
Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.
Problem types: description: Local file inclusion vulnerability
Affected products: vendor: SpiQe Software
product: OneThird CMS
Published: 2020-10-20T07:55:20.000Z
CVE-2020-5641 
Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: Netgear Japan G.K.
product: GS108Ev3
Published: 2020-11-24T06:55:22.000Z
CVE-2020-5642 
Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: onWebChat
product: Live Chat - Live support
Published: 2020-10-15T02:20:15.000Z
CVE-2020-5643 
Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bulletin board via unspecified vector.
Problem types: description: Improper Input Validation
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2020-11-06T02:06:26.000Z
CVE-2020-5644 
Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Problem types: description: Buffer Overflow
Affected products: vendor: Mitsubishi Electric Corporation
product: GT14 Model of GOT 1000 series
Published: 2020-11-06T02:06:27.000Z
CVE-2020-5645 
Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Problem types: description: Session fixation
Affected products: vendor: Mitsubishi Electric Corporation
product: GT14 Model of GOT 1000 series
Published: 2020-11-06T02:06:27.000Z
CVE-2020-5646 
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: Mitsubishi Electric Corporation
product: GT14 Model of GOT 1000 series
Published: 2020-11-06T02:06:28.000Z
CVE-2020-5647 
Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Problem types: description: Fails to restrict access
Affected products: vendor: Mitsubishi Electric Corporation
product: GT14 Model of GOT 1000 series
Published: 2020-11-06T02:06:29.000Z
CVE-2020-5648 
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
Problem types: description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Mitsubishi Electric Corporation
product: GT14 Model of GOT 1000 series
Published: 2020-11-06T02:06:30.000Z
CVE-2020-5649 
Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Problem types: description: Resource Management Errors
Affected products: vendor: Mitsubishi Electric Corporation
product: GT14 Model of GOT 1000 series
Published: 2020-11-06T02:06:31.000Z
CVE-2020-5650 
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Tips and Tricks HQ
product: Simple Download Monitor
Published: 2020-10-21T15:15:17.000Z
CVE-2020-5651 
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL.
Problem types: description: SQL Injection
Affected products: vendor: Tips and Tricks HQ
product: Simple Download Monitor
Published: 2020-10-21T15:15:18.000Z
CVE-2020-5652 
Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware versions '20' and earlier, R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier, R 08/16/32/120 SFCPU firmware versions '22' and earlier, R 08/16/32/120 PCPU all versions, R 08/16/32/120 PSFCPU all versions, R 16/32/64 MTCPU all versions, Q03 UDECPU, Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier , Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier, Q 04/06/13/26 UDPVCPU serial number '22031' and earlier, Q 172/173 DCPU all versions, Q 172/173 DSCPU all versions, Q 170 MCPU all versions, Q 170 MSCPU all versions, L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions) allows a remote unauthenticated attacker to stop the Ethernet communication functions of the products via a specially crafted packet, which may lead to a denial of service (DoS) condition .
Problem types: description: Uncontrolled Resource Consumption
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R, Q and L series
Published: 2020-10-30T03:35:51.000Z
CVE-2020-5653 
Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Problem types: description: Buffer Overflow
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R series
Published: 2020-10-30T03:35:52.000Z
CVE-2020-5654 
Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Problem types: description: Session fixation
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R series
Published: 2020-10-30T03:35:52.000Z
CVE-2020-5655 
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R series
Published: 2020-10-30T03:35:53.000Z
CVE-2020-5656 
Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Problem types: description: Fails to restrict access
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R series
Published: 2020-10-30T03:35:53.000Z
CVE-2020-5657 
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
Problem types: description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R series
Published: 2020-10-30T03:35:54.000Z
CVE-2020-5658 
Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Problem types: description: Resource Management Errors
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R series
Published: 2020-10-30T03:35:54.000Z
CVE-2020-5659 
SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: SQL Injection
Affected products: vendor: Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science
product: XooNIps
Published: 2020-11-16T04:15:29.000Z
CVE-2020-5662 
Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
Problem types: description: Reflected cross-site scripting
Affected products: vendor: Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science
product: XooNIps
Published: 2020-11-16T04:15:29.000Z
CVE-2020-5663 
Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
Problem types: description: Stored cross-site scripting
Affected products: vendor: Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science
product: XooNIps
Published: 2020-11-16T04:15:30.000Z
CVE-2020-5664 
Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: Deserialization of Untrusted Data
Affected products: vendor: Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science
product: XooNIps
Published: 2020-11-16T04:15:30.000Z
CVE-2020-5665 
Improper check or handling of exceptional conditions in MELSEC iQ-F series FX5U(C) CPU unit firmware version 1.060 and earlier allows an attacker to cause a denial-of-service (DoS) condition on program execution and communication by sending a specially crafted ARP packet.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-F series FX5U(C) CPU unit
Published: 2020-12-14T02:25:53.000Z
CVE-2020-5666 
Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.
Problem types: description: Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R Series CPU Modules
Published: 2020-11-16T00:49:55.000Z
CVE-2020-5667 
Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: Studyplus Inc.
product: Studyplus App
Published: 2020-11-06T02:06:32.000Z
CVE-2020-5668 
Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/120SFCPU firmware version '22' and earlier, R08/16/32/120PCPU firmware version '25' and earlier, R08/16/32/120PSFCPU firmware version '06' and earlier, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware version '07' and earlier, RJ71GP21-SX firmware version '47' and earlier, RJ71GP21S-SX firmware version '47' and earlier, and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication, or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet
Problem types: description: Uncontrolled Resource Consumption
Affected products: vendor: Mitsubishi Electric Corporation
product: MELSEC iQ-R
Published: 2020-11-20T03:30:23.000Z