rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15638 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the NodeProperties::InferReceiverMapsUnsafe method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10950.
Problem types: cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: PhantomPDF
Credits: lang: en
value: Rene Freingruber (@ReneFreingruber) and Patrick Wollgast
Published: 2020-08-19T20:55:29.000Z
CVE-2020-15639 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decryptFile method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10496.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:25.000Z
CVE-2020-15640 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getFileUploadBytes method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10497.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:25.000Z
CVE-2020-15641 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getFileUploadBytes method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10499.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:26.000Z
CVE-2020-15642 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the isHPSmartComponent method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10501.
Problem types: cwe_id: CWE-77
description: CWE-77: Command Injection
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:26.000Z
CVE-2020-15643 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the saveAsText method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10549.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:26.000Z
CVE-2020-15644 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the setAppFileBytes method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10550.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:27.000Z
CVE-2020-15645 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the getFileFromURL method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10553.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Marvell
product: QConvergeConsole
Credits: lang: en
value: rgod
Published: 2020-08-25T20:21:27.000Z
CVE-2020-15646 
If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This vulnerability affects Thunderbird < 68.10.0.
Problem types: description: Automatic account setup leaks Microsoft Exchange login credentials
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2020-10-08T13:37:18.000Z
CVE-2020-15647 
A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. This vulnerability affects Firefox for < Android.
Problem types: description: Arbitrary local file access in Firefox for Android
Affected products: vendor: Mozilla
product: Firefox for
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15648 
Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.
Problem types: description: X-Frame-Options bypass using object or embed tags
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15649 
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
Problem types: description: Exfiltrating local files through malicious file picker application
Affected products: vendor: Mozilla
product: Firefox ESR
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15650 
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
Problem types: description: Overwriting local files through malicious file picker application
Affected products: vendor: Mozilla
product: Firefox ESR
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15651 
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.
Problem types: description: Download Feature: unicode RTLO char can fake the file extension
Affected products: vendor: Mozilla
product: Firefox for iOS
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15652 
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
Problem types: description: Potential leak of redirect targets when loading scripts in a worker
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15653 
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Problem types: description: Bypassing iframe sandbox when allowing popups
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15654 
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Problem types: description: Custom cursor can overlay user interface
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15655 
A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Problem types: description: Extension APIs could be used to bypass Same-Origin Policy
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:24.000Z
CVE-2020-15656 
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Problem types: description: Type confusion for special arguments in IonMonkey
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:23.000Z
CVE-2020-15657 
Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Problem types: description: DLL hijacking due to incorrect loading path
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:23.000Z
CVE-2020-15658 
The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Problem types: description: Overriding file type when saving to disk
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:23.000Z
CVE-2020-15659 
Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
Problem types: description: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2020-08-10T17:43:23.000Z
CVE-2020-15660 
Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared request, lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T11:24:16.000Z
CVE-2020-15661 
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.
Problem types: description: Login JS user script can be overidden
Affected products: vendor: Mozilla
product: Firefox for iOS
Published: 2020-08-10T17:43:23.000Z
CVE-2020-15662 
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
Problem types: description: Download JS user script can be overidden
Affected products: vendor: Mozilla
product: Firefox for iOS
Published: 2020-08-10T17:43:23.000Z
CVE-2020-15663 
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.
Problem types: description: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2020-10-01T18:43:38.000Z
CVE-2020-15664 
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80.
Problem types: description: Attacker-induced prompt for extension installation
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
Published: 2020-10-01T18:43:26.000Z
CVE-2020-15665 
Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox < 80.
Problem types: description: Address bar not reset when choosing to stay on a page after the beforeunload dialog is shown
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-01T18:43:08.000Z
CVE-2020-15666 
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
Problem types: description: MediaError message property leaks cross-origin response status
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox for Android
Published: 2020-10-01T18:42:58.000Z
CVE-2020-15667 
When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox < 80.
Problem types: description: Heap overflow when processing an update file
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-01T18:42:42.000Z
CVE-2020-15668 
A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
Problem types: description: Data Race when reading certificate information
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox for Android
Published: 2020-10-01T18:42:28.000Z
CVE-2020-15669 
When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12.
Problem types: description: Use-After-Free when aborting an operation
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2020-10-01T18:42:09.000Z
CVE-2020-15670 
Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.
Problem types: description: Memory safety bugs fixed in Firefox for Android 80
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox for Android
Published: 2020-10-01T18:41:52.000Z
CVE-2020-15671 
When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80.
Problem types: description: Passwords could be saved to phone keyboard dictionary
Affected products: vendor: Mozilla
product: Firefox for Android
Published: 2020-10-01T18:41:30.000Z
CVE-2020-15673 
Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
Problem types: description: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2020-10-01T18:39:19.000Z
CVE-2020-15674 
Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81.
Problem types: description: Memory safety bugs fixed in Firefox 81
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-01T18:37:06.000Z
CVE-2020-15675 
When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 81.
Problem types: description: Use-After-Free in WebGL
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-01T18:32:08.000Z
CVE-2020-15676 
Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
Problem types: description: XSS when pasting attacker-controlled data into a contenteditable element
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2020-10-01T18:31:41.000Z
CVE-2020-15677 
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
Problem types: description: Download origin spoofing via redirect
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2020-10-01T18:31:16.000Z
CVE-2020-15678 
When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
Problem types: description: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2020-10-01T18:29:27.000Z