rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-27282 
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files.
Problem types: cwe_id: CWE-112
description: MISSING XML VALIDATION CWE-112
Affected products: vendor: n/a
product: Hamilton Medical AG, T1-Ventillator
Published: 2021-03-15T21:21:54.000Z
CVE-2020-27283 
An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locations.
Problem types: cwe_id: CWE-404
description: IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404
Affected products: vendor: n/a
product: Crimson 3.1
Published: 2021-01-06T15:05:07.000Z
CVE-2020-27284 
TPEditor (v1.98 and prior) is vulnerable to two out-of-bounds write instances in the way it processes project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: TPEditor
Published: 2021-01-26T12:53:01.000Z
CVE-2020-27285 
The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: Crimson 3.1
Published: 2021-01-06T15:01:44.000Z
CVE-2020-27287 
Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Delta Electronics
Published: 2021-01-11T15:27:51.000Z
CVE-2020-27288 
An untrusted pointer dereference has been identified in the way TPEditor(v1.98 and prior) processes project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: n/a
product: TPEditor
Published: 2021-01-26T12:48:45.000Z
CVE-2020-27289 
Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: n/a
product: Delta Electronics
Published: 2021-01-11T15:27:57.000Z
CVE-2020-27290 
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers with physical access to the configuration interface's logs to get valid checksums for tampered configuration files.
Problem types: cwe_id: CWE-200
description: EXPOSURE OF SENSITIVE INFORMATION TO AN UNAUTHORIZED ACTOR CWE-200
Affected products: vendor: n/a
product: Hamilton Medical AG, T1-Ventillator
Published: 2021-03-15T21:22:02.000Z
CVE-2020-27291 
Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Electronics
Published: 2021-01-11T15:27:54.000Z
CVE-2020-27293 
Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-843
description: ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
Affected products: vendor: n/a
product: Delta Electronics
Published: 2021-01-11T15:28:00.000Z
CVE-2020-27295 
The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (versions prior to 6.3.0.8233).
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION CWE-400
Affected products: vendor: n/a
product: OPC UA Tunneller
Published: 2021-01-26T19:07:48.000Z
CVE-2020-27297 
The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execute code on the OPC UA Tunneller (versions prior to 6.3.0.8233).
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: OPC UA Tunneller
Published: 2021-01-26T19:06:19.000Z
CVE-2020-27298 Philips Interventional Workstations OS Command Injection
Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Philips
product: Interventional Workspot
default_status: unaffected
vendor: Philips
product: Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live
default_status: unaffected
vendor: Philips
product: ViewForum
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-01-20T19:27:22.000Z
CVE-2020-27299 
The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC UA Tunneller (versions prior to 6.3.0.8233).
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: OPC UA Tunneller
Published: 2021-01-26T19:04:56.000Z
CVE-2020-27301 
A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES_UnWRAP" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-04T12:24:37.000Z
CVE-2020-27302 
A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-04T12:24:41.000Z
CVE-2020-27304 
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: civetweb_project
product: civetweb
Published: 2021-10-21T15:42:23.000Z
CVE-2020-27336 
An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote attacker could result in an out-of-bounds read of up to three bytes via network access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-12-22T21:04:08.000Z
CVE-2020-27337 
An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthenticated remote attacker to cause an Out of Bounds Write, and possibly a Denial of Service via network access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:N/S:U/UI:N
version: 3.1
Published: 2020-12-22T21:04:11.000Z
CVE-2020-27338 
An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the DHCPv6 client component allows an unauthenticated remote attacker to cause an Out of Bounds Read, and possibly a Denial of Service via adjacent network access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:A/A:H/C:L/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-12-22T21:04:13.000Z
CVE-2020-27339 
In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-16T15:49:34.000Z
CVE-2020-27340 
The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T07:14:05.000Z
CVE-2020-27344 
The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T19:09:23.000Z
CVE-2020-27347 tmux stack buffer overflow in function input_csi_dispatch_sgr_colon
In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: tmux
product: tmux
vendor: Ubuntu
product: tmux
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sergey Nizovtsev
Published: 2020-11-06T02:20:13.352Z
CVE-2020-27348 snapcraft may build snaps with incorrect LD_LIBRARY_PATH
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Canonical
product: snapcraft
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: itszn
Published: 2020-12-04T02:30:36.159Z
CVE-2020-27349 aptdaemon performed policykit permissions checks too late
Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu19.5, 1.1.1+bzr982-0ubuntu14.5.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Canonical
product: aptdaemon
Credits: lang: en
value: Kevin Backhouse and Julian Andres Klode
Published: 2020-12-09T03:35:17.337Z
CVE-2020-27350 apt integer wraparound
APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Canonical
product: apt
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Kevin Backhouse
Published: 2020-12-10T04:05:18.456Z
CVE-2020-27351 Various memory and file descriptor leaks in apt-python
Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1;
Problem types: cwe_id: CWE-772
description: CWE-772 Missing Release of Resource after Effective Lifetime
Affected products: vendor: Canonical
product: python-apt
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Kevin Backhouse
Published: 2020-12-10T04:05:18.897Z
CVE-2020-27352 
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.
Affected products: vendor: Canonical Ltd.
product: snapd
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
baseScore: 9.3
baseSeverity: CRITICAL
Credits: lang: en
value: Gilad Reti
lang: en
value: Nimrod Stoler
Published: 2024-06-21T20:06:37.992Z
CVE-2020-27356 
The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:25:51.000Z
CVE-2020-27358 
An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-31T16:18:43.000Z
CVE-2020-27359 
A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-31T16:22:03.000Z
CVE-2020-27361 
An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T15:57:22.000Z
CVE-2020-27362 
An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file editor and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T15:57:24.000Z
CVE-2020-27366 
Cross Site Scripting (XSS) vulnerability in wlscanresults.html in Humax HGB10R-02 BRGCAB version 1.0.03, allows local attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2020-27368 
Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-14T15:57:26.000Z
CVE-2020-27372 
A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run_interpreter function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-11T18:09:28.000Z
CVE-2020-27373 
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T01:24:02.000Z
CVE-2020-27374 
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T01:23:56.000Z
CVE-2020-27375 
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T01:23:50.000Z
CVE-2020-27376 
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T01:23:45.000Z
CVE-2020-27377 
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-01T14:57:20.000Z
CVE-2020-27379 
Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-14T14:38:17.000Z
CVE-2020-27383 
Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticated Users Group" which grants the (F) Flag aka "Full Control"
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T18:20:52.000Z
CVE-2020-27384 
The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full Control) for 'Everyone' group, making the entire directory 'Guild Wars 2' and its files and sub-dirs world-writable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T14:54:09.000Z
CVE-2020-27385 
Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. (dot dot) path such as ..\..\..\..\..\<file> in the input field of the FileEditor. In FlexDotnetCMS before v1.5.8, it is also possible to access files by specifying the full path (e.g., C:\<file>). The files can then be edited via the FileEditor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T18:24:06.000Z
CVE-2020-27386 
An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T18:15:14.000Z
CVE-2020-27387 
An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T01:18:12.000Z
CVE-2020-27388 
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T19:59:37.000Z
CVE-2020-27397 
Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution (RCE) on the Hosting web server via uploading a maliciously crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:54:10.000Z
CVE-2020-27402 
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T14:25:42.000Z