rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-13669 
Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:25:12.000Z
CVE-2020-13670 
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Problem types: description: Information Disclosure
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:45:22.000Z
CVE-2020-13671 
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Problem types: description: Remote code execution
Affected products: vendor: Drupal
product: Drupal Core
Published: 2020-11-20T15:40:39.000Z
CVE-2020-13672 
Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:30:12.000Z
CVE-2020-13673 
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Entity Embed
Published: 2022-02-11T15:35:11.000Z
CVE-2020-13674 
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:45:18.000Z
CVE-2020-13675 
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:45:11.000Z
CVE-2020-13676 
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:50:11.000Z
CVE-2020-13677 
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Drupal
product: Core
Published: 2022-02-11T15:55:12.000Z
CVE-2020-13688 
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
Problem types: description: Cross-site scripting
Affected products: vendor: Drupal
product: Drupal Core
Published: 2021-06-11T15:08:56.000Z
CVE-2020-13692 
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:07:37.000Z
CVE-2020-13693 
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T23:54:26.000Z
CVE-2020-13694 
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T15:19:45.000Z
CVE-2020-13695 
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T17:45:16.000Z
CVE-2020-13696 
An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated by a v4l-conf -c /dev/../root/.bash_history command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T16:32:54.000Z
CVE-2020-13697 
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T07:31:19.000Z
CVE-2020-13699 
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-29T15:36:06.000Z
CVE-2020-13700 
An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T14:25:30.000Z
CVE-2020-13702 
The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-06-11T18:16:01.000Z
CVE-2020-13712 MGOS Command Injection
A command injection is possible through the user interface, allowing arbitrary command execution as 
the root user. oMG2000 running MGOS 3.15.1 or earlier is affected. 

MG90 running MGOS 4.2.1 or earlier is affected.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Sierra Wireless
product: MGOS
default_status: unaffected
vendor: Sierra Wireless
product: MGOS
default_status: unaffected
Published: 2024-12-20T21:37:35.021Z
CVE-2020-13753 
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:07:18.000Z
CVE-2020-13754 
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T13:37:25.000Z
CVE-2020-13756 
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T13:46:56.000Z
CVE-2020-13757 
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T18:17:07.000Z
CVE-2020-13758 
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T18:32:20.000Z
CVE-2020-13759 
rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T18:24:23.000Z
CVE-2020-13760 
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T19:25:43.000Z
CVE-2020-13761 
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T19:25:32.000Z
CVE-2020-13762 
In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T19:25:15.000Z
CVE-2020-13763 
In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T19:24:24.000Z
CVE-2020-13764 
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T20:33:11.000Z
CVE-2020-13765 
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:26:17.000Z
CVE-2020-13767 
The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and (if successful) could allow an attacker to gain access to sensitive information,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T17:58:49.000Z
CVE-2020-13768 
In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T20:25:50.000Z
CVE-2020-13769 
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:28:05.000Z
CVE-2020-13770 
Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having SeImpersonatePrivilege (eg. user ‘NT AUTHORITY\NETWORK SERVICE’).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T17:38:03.000Z
CVE-2020-13771 
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain conditions) one to gain code execution (and elevation of privileges to the level of privilege held by the vulnerable component such as NT AUTHORITY\SYSTEM) via DLL hijacking. This affects ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, and ldprofile.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T17:13:04.000Z
CVE-2020-13772 
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:24:46.000Z
CVE-2020-13773 
Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_findfrm.aspx, /LDMS/frm_taskfrm.aspx, and /LDMS/query_browsecomp.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:30:14.000Z
CVE-2020-13774 
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T19:22:15.000Z
CVE-2020-13775 
ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T22:51:38.000Z
CVE-2020-13776 
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T02:05:22.000Z
CVE-2020-13777 
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T07:01:07.000Z
CVE-2020-13778 
rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T12:54:26.000Z
CVE-2020-13782 
D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:23:19.000Z
CVE-2020-13783 
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:23:09.000Z
CVE-2020-13784 
D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:23:00.000Z
CVE-2020-13785 
D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:22:52.000Z
CVE-2020-13786 
D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:22:45.000Z
CVE-2020-13787 
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:22:36.000Z
CVE-2020-13788 
Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T20:04:57.000Z
CVE-2020-13790 
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T18:56:05.000Z
CVE-2020-13791 
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:24:53.000Z
CVE-2020-13792 
PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T19:32:45.000Z
CVE-2020-13793 
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-06T18:56:12.000Z
CVE-2020-13794 
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T20:17:10.000Z
CVE-2020-13795 
An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T21:49:16.000Z
CVE-2020-13796 
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T21:49:01.000Z
CVE-2020-13797 
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T21:48:53.000Z
CVE-2020-13798 
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T21:48:43.000Z
CVE-2020-13799 
Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemented by storage devices from multiple vendors to assist host systems in securing trusted firmware. Several scenarios have been identified in which the RPMB state may be affected by an attacker without the knowledge of the trusted component that uses the RPMB feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T21:12:40.000Z
CVE-2020-13800 
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:23:08.000Z
CVE-2020-13802 
Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:30:27.000Z
CVE-2020-13803 
An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows signature validation bypass via a modified file or a file with non-standard signatures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:33:19.000Z
CVE-2020-13804 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:38:57.000Z