rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-12062 
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T15:28:36.000Z
CVE-2020-12063 
A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected: not logged in" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked. NOTE: some third parties argue that any missed blocking of spoofed outbound messages - except for exact matches to a sender address in the /etc/postfix/sender_login file - is outside the design goals of Postfix and thus cannot be considered a Postfix vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T11:59:03.000Z
CVE-2020-12066 
CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T16:20:06.000Z
CVE-2020-12067 
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2020-12068 
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-14T20:29:21.000Z
CVE-2020-12069 CODESYS V3 prone to Inadequate Password Hashing
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: CODESYS
product: CODESYS V3  containing the CmpUserMgr
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-12-26T00:00:00.000Z
CVE-2020-12070 
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T22:44:20.000Z
CVE-2020-12071 
Anchor 0.12.7 allows admins to cause XSS via crafted post content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T01:03:14.000Z
CVE-2020-12073 
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T02:01:02.000Z
CVE-2020-12074 
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T02:00:49.000Z
CVE-2020-12075 
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T02:00:33.000Z
CVE-2020-12076 
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T02:00:23.000Z
CVE-2020-12077 
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T02:20:46.000Z
CVE-2020-12078 
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T13:26:55.000Z
CVE-2020-12079 
Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T03:54:07.000Z
CVE-2020-12080 
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T17:45:12.000Z
CVE-2020-12081 
An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2. The web portal link can be used to access to system files or other important files on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-31T16:55:11.000Z
CVE-2020-12082 
A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T17:45:14.000Z
CVE-2020-12083 
An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T17:45:15.000Z
CVE-2020-12100 
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-12T15:07:52.000Z
CVE-2020-12101 
The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-30T13:40:34.000Z
CVE-2020-12102 
In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T21:01:16.000Z
CVE-2020-12103 
In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T21:07:28.000Z
CVE-2020-12104 
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T14:17:40.000Z
CVE-2020-12105 
OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T16:15:29.000Z
CVE-2020-12106 
The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administrative functions such as, changing credentials of the Administrator account or connect the product to a rogue access point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-12T18:12:56.000Z
CVE-2020-12107 
The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this module's Operating System.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-12T18:14:29.000Z
CVE-2020-12108 
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-06T14:50:33.000Z
CVE-2020-12109 
Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T15:06:51.000Z
CVE-2020-12110 
Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T13:49:45.000Z
CVE-2020-12111 
Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T14:05:46.000Z
CVE-2020-12112 
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T17:53:59.000Z
CVE-2020-12113 
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T17:53:47.000Z
CVE-2020-12114 
A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T11:42:03.000Z
CVE-2020-12116 
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T19:13:32.000Z
CVE-2020-12117 
Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-01T13:41:37.000Z
CVE-2020-12118 
The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T21:28:33.000Z
CVE-2020-12119 
Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed to basic double spending attacks, amplified double spending attacks, and DoS attacks without user consent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-02T14:42:13.000Z
CVE-2020-12120 
The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:22:48.000Z
CVE-2020-12122 
In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x2200019. (This also extends to the various other products from Max Secure that include MaxProc64.sys.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T19:02:00.000Z
CVE-2020-12123 
CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoints, because these endpoints do not contain CSRF tokens. If a user is authenticated in the router portal, then this attack will work.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:11:18.000Z
CVE-2020-12124 
A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:11:57.000Z
CVE-2020-12125 
A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary machine instructions as root without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:12:23.000Z
CVE-2020-12126 
Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, change configuration variables, and cause denial of service via an unauthenticated endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:12:53.000Z
CVE-2020-12127 
An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:13:20.000Z
CVE-2020-12128 
DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T23:05:20.000Z
CVE-2020-12129 
The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T23:05:49.000Z
CVE-2020-12130 
The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T23:05:41.000Z
CVE-2020-12131 
The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T23:05:30.000Z
CVE-2020-12132 
Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T23:50:05.000Z
CVE-2020-12133 
The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:25:43.000Z
CVE-2020-12134 
Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T00:08:04.000Z
CVE-2020-12135 
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T00:31:51.000Z
CVE-2020-12137 
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T12:37:58.000Z
CVE-2020-12138 
AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:31:47.000Z
CVE-2020-12140 
A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T18:23:51.000Z
CVE-2020-12141 
An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-19T15:23:46.000Z
CVE-2020-12142 IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: Silver Peak Systems, Inc.
product: 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator,   3. EdgeConnect in AWS, Azure, GCP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by Denis Kolegov, Mariya Nedyak, and Anton Nikolaev from the SD-WAN New Hop team.
Published: 2020-05-05T19:54:07.000Z
CVE-2020-12143 The certificate used to identify Orchestrator to EdgeConnect devices is not validated
The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Silver Peak Systems, Inc.
product: 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator,   3. EdgeConnect in AWS, Azure, GCP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by Denis Kolegov, Mariya Nedyak, and Anton Nikolaev from the SD-WAN New Hop team.
Published: 2020-05-05T19:53:56.000Z
CVE-2020-12144 The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated
The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Silver Peak Systems, Inc.
product: 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator   3. EdgeConnect in AWS, Azure, GCP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by Denis Kolegov, Mariya Nedyak, and Anton Nikolaev from the SD-WAN New Hop team.
Published: 2020-05-05T19:54:00.000Z