rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-13952 
In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Superset
Published: 2020-09-30T20:48:57.000Z
CVE-2020-13953 
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Tapestry
Published: 2020-09-30T16:51:59.000Z
CVE-2020-13954 Apache CXF Reflected XSS in the services listing page via the styleSheetPath
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Apache Software Foundation
product: Apache CXF
Credits: lang: en
value: Thanks to Ryan Lambeth for reporting this issue.
Published: 2020-11-12T12:45:14.000Z
CVE-2020-13955 
HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Calcite
Published: 2020-10-09T12:33:50.000Z
CVE-2020-13956 
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Apache HttpClient
Published: 2020-12-02T16:20:12.000Z
CVE-2020-13957 
Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: Apache Solr
Published: 2020-10-13T18:28:52.000Z
CVE-2020-13958 
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.
Problem types: description: Protection Mechanism Failure
Affected products: vendor: n/a
product: Apache OpenOffice
Published: 2020-11-17T15:17:57.000Z
CVE-2020-13959 Velocity Tools XSS Vulnerability
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Apache Software Foundation
product: Apache Velocity Tools
Credits: lang: en
value: This issue was reported and a patch was submitted by Jackson Henry, member of Sakura Samurai.
Published: 2021-03-10T08:00:19.000Z
CVE-2020-13960 
D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses (and also offer Internet services such as HTTP) for names that otherwise would have had an NXDOMAIN error, by registering a subdomain of the domain.name domain name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T19:26:41.000Z
CVE-2020-13961 
Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:29:37.000Z
CVE-2020-13962 
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T23:14:10.000Z
CVE-2020-13963 
SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-21T20:57:32.000Z
CVE-2020-13964 
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T02:45:35.000Z
CVE-2020-13965 
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T02:45:24.000Z
CVE-2020-13968 
CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:19:58.000Z
CVE-2020-13969 
CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. This is path-independent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:20:03.000Z
CVE-2020-13970 
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:24:16.000Z
CVE-2020-13971 
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:22:44.000Z
CVE-2020-13972 
Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:36:41.000Z
CVE-2020-13973 
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T03:51:10.000Z
CVE-2020-13974 
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T04:06:41.000Z
CVE-2020-13976 
An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it refers to an old software version, requires administrative privileges, and does not provide access beyond that already available to administrative users
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T13:07:18.000Z
CVE-2020-13977 
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T13:06:56.000Z
CVE-2020-13978 
Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication that the Edit Chunk feature was intended to prevent an administrator from using PHP's exec feature
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T13:06:47.000Z
CVE-2020-13980 
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you are still required to be logged into the admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T13:44:50.000Z
CVE-2020-13984 
An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when processing IPv6 extension headers in ext_hdr_options_process in net/ipv6/uip6.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T21:34:10.000Z
CVE-2020-13985 
An issue was discovered in Contiki through 3.0. A memory corruption vulnerability exists in the uIP TCP/IP stack component when handling RPL extension headers of IPv6 network packets in rpl_remove_header in net/rpl/rpl-ext-header.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T21:35:13.000Z
CVE-2020-13986 
An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when handling RPL extension headers of IPv6 network packets in rpl_remove_header in net/rpl/rpl-ext-header.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T21:36:06.000Z
CVE-2020-13987 
An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T21:37:06.000Z
CVE-2020-13988 
An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packets in uip_process in net/ipv4/uip.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T21:37:56.000Z
CVE-2020-13991 
vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T22:13:16.000Z
CVE-2020-13992 
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-09T14:48:52.000Z
CVE-2020-13993 
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote unauthenticated attackers to retrieve information from the database via a ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-09T14:51:14.000Z
CVE-2020-13994 
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-09T14:53:43.000Z
CVE-2020-13995 
U.S. Air Force Sensor Data Management System extract75 has a buffer overflow that leads to code execution. An overflow in a global variable (sBuffer) leads to a Write-What-Where outcome. Writing beyond sBuffer will clobber most global variables until reaching a pointer such as DES_info or image_info. By controlling that pointer, one achieves an arbitrary write when its fields are assigned. The data written is from a potentially untrusted NITF file in the form of an integer. The attacker can gain control of the instruction pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T12:58:27.000Z
CVE-2020-13996 
The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T20:47:49.000Z
CVE-2020-13997 
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:18:24.000Z
CVE-2020-13998 
Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T01:59:35.000Z
CVE-2020-13999 
ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a crafted EMF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:01:44.000Z
CVE-2020-14000 
MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-16T14:41:40.000Z
CVE-2020-14001 
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-17T15:27:54.000Z
CVE-2020-14002 
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T00:00:00.000Z
CVE-2020-14004 
An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-12T15:04:10.000Z
CVE-2020-14005 
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T13:28:21.000Z
CVE-2020-14006 
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T13:27:26.000Z
CVE-2020-14007 
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T13:24:58.000Z
CVE-2020-14008 
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-04T14:14:15.000Z
CVE-2020-14009 
Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipart structures are not properly handled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T11:33:10.000Z
CVE-2020-14010 
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-10T17:17:36.000Z
CVE-2020-14011 
Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T14:36:56.000Z
CVE-2020-14012 
scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-10T17:56:20.000Z
CVE-2020-14014 
An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding, making it vulnerable to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T14:22:55.000Z
CVE-2020-14015 
An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system will allow an unauthorized user to continue setting a password, even though no activation code was supplied, setting the password for the most recently created user in the system (the user with the highest user id).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T14:23:32.000Z
CVE-2020-14016 
An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a not_found message when the provided username or email address does not match a user in the system. This can be used to enumerate users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T14:24:01.000Z
CVE-2020-14017 
An issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information such as CSRF tokens, are stored in cleartext files in the directory /private/sessions. An unauthenticated user could use a brute-force approach to attempt to identify existing sessions, or view the contents of this file to discover details about a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T14:24:59.000Z
CVE-2020-14018 
An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the E-Mail field; however, on the View user page the XSS is triggered via either the User field or the E-Mail field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T14:25:27.000Z
CVE-2020-14019 
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T10:49:59.000Z