rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8782 ALEOS LAN-Side RPC Service Remote Code Execution
Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sierra Wireless thanks Ruben Santamarta, Principal Security Consultant at IOActive for the responsible disclosure of these vulnerabilities.
Published: 2020-10-06T13:54:53.534Z
CVE-2020-8783 
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:26:55.000Z
CVE-2020-8784 
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:35:31.000Z
CVE-2020-8785 
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:35:24.000Z
CVE-2020-8786 
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:35:16.000Z
CVE-2020-8787 
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:34:43.000Z
CVE-2020-8788 
Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T13:07:53.000Z
CVE-2020-8789 
Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-22T13:20:13.000Z
CVE-2020-8790 
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excessive authentication attempts, which could allow a remote attacker to discover user credentials and obtain access via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T13:18:57.000Z
CVE-2020-8791 
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T13:22:14.000Z
CVE-2020-8792 
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid barcode inputs can be easily guessed because barcode strings follow a predictable pattern. Correctly guessed valid barcode inputs entered through the app interface disclose arbitrary users' email addresses and lock names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T13:34:52.000Z
CVE-2020-8793 
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T16:22:02.000Z
CVE-2020-8794 
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T16:38:07.000Z
CVE-2020-8795 
In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T14:48:10.000Z
CVE-2020-8796 
Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T19:57:43.000Z
CVE-2020-8797 
Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T18:01:22.000Z
CVE-2020-8798 
httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T18:03:37.000Z
CVE-2020-8799 
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T15:03:18.000Z
CVE-2020-8800 
SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T15:11:09.000Z
CVE-2020-8801 
SuiteCRM through 7.11.11 allows PHAR Deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T15:12:21.000Z
CVE-2020-8802 
SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T15:13:31.000Z
CVE-2020-8803 
SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T15:14:48.000Z
CVE-2020-8804 
SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T15:15:56.000Z
CVE-2020-8806 
Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected because timestamp requirements on block headers were not properly enforced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T09:08:28.000Z
CVE-2020-8807 
In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T09:13:58.000Z
CVE-2020-8808 
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary physical memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, via a function call such as MmMapIoSpace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T22:23:08.000Z
CVE-2020-8809 
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T18:57:18.000Z
CVE-2020-8810 
An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T18:55:10.000Z
CVE-2020-8811 
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T22:59:42.000Z
CVE-2020-8812 
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T22:59:35.000Z
CVE-2020-8813 
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-22T00:00:00.000Z
CVE-2020-8815 
Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach by sending a large volume of small packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T14:39:23.000Z
CVE-2020-8816 
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-29T18:57:14.000Z
CVE-2020-8817 
Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-14T13:47:19.000Z
CVE-2020-8818 
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T01:20:39.000Z
CVE-2020-8819 
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T01:15:55.000Z
CVE-2020-8820 
An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-12T15:52:43.000Z
CVE-2020-8821 
An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-12T15:54:34.000Z
CVE-2020-8822 
Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T01:52:37.000Z
CVE-2020-8823 
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T02:06:25.000Z
CVE-2020-8824 
Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-19T16:10:59.000Z
CVE-2020-8825 
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T11:14:37.000Z
CVE-2020-8826 
As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T19:38:54.000Z
CVE-2020-8827 
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T19:43:40.000Z
CVE-2020-8828 
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T19:49:14.000Z
CVE-2020-8829 
CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T17:10:23.000Z
CVE-2020-8830 
CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T17:12:17.000Z
CVE-2020-8831 World writable root owned lock file created in user controllable location
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
Problem types: cwe_id: CWE-379
description: CWE-379 Creation of Temporary File in Directory with Incorrect Permissions
Affected products: vendor: Canonical
product: Apport
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Maximilien Bourgeteau
Published: 2020-04-22T21:15:18.418Z
CVE-2020-8832 Ubuntu 18.04 Linux kernel i915 incomplete fix for CVE-2019-14615
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Ubuntu
product: 18.04 LTS (bionic) Linux kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Gregory Herrero
Published: 2020-04-09T23:50:17.178Z
CVE-2020-8833 Apport race condition in crash report permissions
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Canonical
product: Apport
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Maximilien Bourgeteau
Published: 2020-04-22T21:15:18.859Z
CVE-2020-8834 Linux kernel KVM Power8 conflicting use of  HSTATE_HOST_R1
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file")
Problem types: cwe_id: CWE-368
description: CWE-368
Affected products: vendor: Linux kernel
product: Linux kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Gustavo Romero
lang: en
value: Paul Mackerras
Published: 2020-04-09T22:10:14.975Z
CVE-2020-8835 Linux kernel bpf verifier vulnerability
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Problem types: description: n/a
Affected products: vendor: Linux kernel
product: Linux kernel
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Manfred Paul
lang: en
value: Anatoly Trosinenko
Published: 2020-04-02T18:00:23.885Z
CVE-2020-8838 
An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arbitrary executable via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T16:05:43.000Z
CVE-2020-8839 
Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T14:42:03.000Z
CVE-2020-8840 
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T19:41:58.000Z
CVE-2020-8841 
An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:24:45.000Z