rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-14110 
AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.
Problem types: description: AX3600 router sensitive information leaked
Affected products: vendor: n/a
product: miwifi6 AX3600
Published: 2022-01-18T16:51:43.000Z
CVE-2020-14111 
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: Xiaomi Router Router AX3600
Published: 2022-03-07T15:24:50.000Z
CVE-2020-14112 
Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000.
Problem types: description: Information Leak
Affected products: vendor: n/a
product: Router AX6000
Published: 2022-03-07T14:06:49.000Z
CVE-2020-14114 
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.
Problem types: description: Information leakage
Affected products: vendor: n/a
product: Xiaomi SmartHome APP
Published: 2022-07-22T15:32:00.000Z
CVE-2020-14115 
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
Problem types: description: Command injection
Affected products: vendor: n/a
product: Xiaomi Router AX3600
Published: 2022-03-07T15:33:20.000Z
CVE-2020-14116 
An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity of the incoming data. Attackers can perform sensitive operations by exploiting this.
Problem types: description: Intent redirection
Affected products: vendor: n/a
product: Mi Browser
Published: 2022-04-21T17:22:21.000Z
CVE-2020-14117 
A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lack of correct permission verification in the Xiaomi content center APP, and attackers can use this vulnerability to invoke the sensitive component functions of the Xiaomi content center APP.
Problem types: description: Improper permission configuration
Affected products: vendor: n/a
product: Xiaomi Content Center APP
Published: 2022-04-21T17:40:02.000Z
CVE-2020-14118 
An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validity of the incoming data, can cause the app store to automatically download and install apps.
Problem types: description: Intent redirection vulnerability
Affected products: vendor: n/a
product: Mi App Store
Published: 2022-04-21T17:33:02.000Z
CVE-2020-14119 
There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom< 1.1.12
Problem types: description: leads to command execution under administrator authority
Affected products: vendor: n/a
product: Xiaomi Router AX3600
Published: 2021-09-16T12:03:05.000Z
CVE-2020-14120 
Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected.
Problem types: description: Permission bypass
Affected products: vendor: n/a
product: MIUI
Published: 2022-04-21T17:30:37.000Z
CVE-2020-14121 
A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attacker can exploit the vulnerability to perform a local silent installation.
Problem types: description: Business logic vulnerability
Affected products: vendor: n/a
product: Mi App Store
Published: 2022-04-21T17:25:10.000Z
CVE-2020-14122 
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user information leakage.
Problem types: description: Information leakage
Affected products: vendor: n/a
product: MIUI
Published: 2022-04-21T17:27:52.000Z
CVE-2020-14123 
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.
Problem types: description: Pointer Double Free Vulnerability
Affected products: vendor: n/a
product: MIUI
Published: 2022-04-22T15:17:36.000Z
CVE-2020-14124 
There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12.
Problem types: description: resulting in code execution
Affected products: vendor: n/a
product: Xiaomi Router AX3600
Published: 2021-09-16T12:08:45.000Z
CVE-2020-14125 
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: Redmi Note 11 ,Redmi Note 9T
Published: 2022-06-08T14:14:57.000Z
CVE-2020-14126 
Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.
Problem types: description: Information leakage
Affected products: vendor: n/a
product: Mi Sound APP
Published: 2022-07-22T15:30:39.000Z
CVE-2020-14127 
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Redmi K40 ,Redmi Note10 Pro
Published: 2022-07-14T14:46:49.000Z
CVE-2020-14129 
A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.
Problem types: description: Vulnerability logic vulnerability
Affected products: vendor: n/a
product: Xiaomi a certain APP
Published: 2022-10-11T00:00:00.000Z
CVE-2020-14130 
Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210809
Problem types: description: Sensitive functions are maliciously invoked
Affected products: vendor: n/a
product: Xiaomi community app
Published: 2021-09-16T11:41:50.000Z
CVE-2020-14131 
The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
Problem types: description: a lack of identity verification
Affected products: vendor: n/a
product: Xiaomi specific devices
Published: 2022-10-11T00:00:00.000Z
CVE-2020-14140 
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.
Problem types: description: Unauthenticated API that can reveal WIFI password vulnerability
Affected products: vendor: n/a
product: Xiaomi Multiple Devices
Published: 2023-03-29T00:00:00.000Z
CVE-2020-14144 
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T13:02:25.000Z
CVE-2020-14145 
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T17:33:36.000Z
CVE-2020-14146 
KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T13:47:29.000Z
CVE-2020-14147 
An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:52:45.000Z
CVE-2020-14148 
The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:52:31.000Z
CVE-2020-14149 
In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:52:20.000Z
CVE-2020-14150 
GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug reports were intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:52:10.000Z
CVE-2020-14152 
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:51:50.000Z
CVE-2020-14153 
In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:51:29.000Z
CVE-2020-14154 
Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:51:17.000Z
CVE-2020-14155 
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T00:00:00.000Z
CVE-2020-14156 
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T17:35:57.000Z
CVE-2020-14157 
The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFID tokens). This makes it easier for an attacker to disarm the wireless alarm system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T19:27:57.000Z
CVE-2020-14158 
The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with an alarm panel. This makes it easier to conduct wAppLoxx authentication-bypass attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-30T13:13:01.000Z
CVE-2020-14159 
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T18:21:59.000Z
CVE-2020-14160 
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-26T10:57:53.000Z
CVE-2020-14161 
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-26T10:57:42.000Z
CVE-2020-14162 
An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-30T13:05:32.000Z
CVE-2020-14163 
An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider the case where garbage collection is triggered after the key operation but before the value operation, as demonstrated by improper read access to memory in ecma_gc_set_object_visited in ecma/base/ecma-gc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T20:14:05.000Z
CVE-2020-14164 
The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-07-01T01:35:25.329Z
CVE-2020-14165 
The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability.
Problem types: description: Improper authorization
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-07-01T01:35:25.806Z
CVE-2020-14166 
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Service Desk Server and Data Center
Published: 2020-07-01T01:35:26.241Z
CVE-2020-14167 
The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-07-01T01:35:26.668Z
CVE-2020-14168 
The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.
Problem types: description: Man-in-the-Middle (MitM)
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-07-01T01:35:27.144Z
CVE-2020-14169 
The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2020-07-01T01:35:27.569Z
CVE-2020-14170 
Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability.
Problem types: description: Server Side Request Forgery (SSRF)
Affected products: vendor: Atlassian
product: Bitbucket Server
Published: 2020-07-09T17:20:48.079Z
CVE-2020-14171 
Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack.
Problem types: description: Man-in-the-Middle (MITM)
Affected products: vendor: Atlassian
product: Bitbucket Server
Published: 2020-07-09T17:17:29.210Z
CVE-2020-14172 
This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote code execution via insecure deserialization, if they were able to exploit a server side template injection vulnerability. The affected versions are before version 7.13.0, from version 8.0.0 before 8.5.0, and from version 8.6.0 before version 8.8.1.
Problem types: description: Template Injection
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-07-03T01:40:11.484Z
CVE-2020-14173 
The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
Problem types: description: Stored Cross-Site Scripting
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-07-03T01:50:11.284Z
CVE-2020-14174 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.
Problem types: description: Insecure Direct Object References (IDOR)
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-07-13T04:45:13.167Z
CVE-2020-14175 
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2.
Problem types: description: Stored Cross-Site Scripting (SXSS)
Affected products: vendor: Atlassian
product: Confluence Server
Published: 2020-07-24T07:05:16.144Z
CVE-2020-14177 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1.
Problem types: description: Denial of Service
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-09-21T01:10:14.986Z
CVE-2020-14178 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-09-01T04:25:13.421Z
CVE-2020-14179 
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-09-21T00:50:12.069Z
CVE-2020-14180 
Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions are before version 4.12.0.
Problem types: description: Broken Access Control
Affected products: vendor: Atlassian
product: Jira Service Desk Server
Published: 2020-09-21T00:55:12.877Z
CVE-2020-14181 
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
Problem types: description: Broken Access Control
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-09-17T00:35:13.239Z
CVE-2020-14183 
Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-10-06T22:20:13.382Z