rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-25725 
In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: Glyph & Cog
product: xpdf
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-11-21T05:29:54.000Z
CVE-2020-25727 
The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T16:35:04.000Z
CVE-2020-25728 
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T16:34:45.000Z
CVE-2020-25729 
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T17:14:54.000Z
CVE-2020-25730 
Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHP_SELF component in classic/views/download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-04T00:00:00.000Z
CVE-2020-25733 
webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T01:45:53.000Z
CVE-2020-25734 
webTareas through 2.1 allows files/Default/ Directory Listing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T01:46:28.000Z
CVE-2020-25735 
webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T01:47:00.000Z
CVE-2020-25736 
Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-15T00:00:00.000Z
CVE-2020-25737 
An elevation of privilege vulnerability exists in Hackolade versions prior 4.2.0 on Windows has an issue in specific deployment scenarios that could allow local users to gain elevated privileges during an uninstall of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T18:15:43.000Z
CVE-2020-25738 
CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that normally has credential access, such as a Chrome process that reads credentials from a SQLite database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-27T05:50:03.000Z
CVE-2020-25739 
An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-23T13:53:14.000Z
CVE-2020-25741 
fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:26:36.000Z
CVE-2020-25742 
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T14:18:07.000Z
CVE-2020-25743 
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T14:15:23.000Z
CVE-2020-25744 
SaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite arbitrary files, which could cause a denial of service (DoS) condition, because a symlink from %LOCALAPPDATA%\SaferVPN\Log is followed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T01:57:05.000Z
CVE-2020-25746 
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T13:20:11.000Z
CVE-2020-25747 
The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain access to RTSP and ONFIV services without authentication. Thus, the attacker can watch live streams from the camera, rotate the camera, change some settings (brightness, clarity, time), restart the camera, or reset it to factory settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:15:59.000Z
CVE-2020-25748 
A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can intercept and modify the video data from the camera, which is transmitted in an unencrypted form. One can also modify responses from NTP and RTSP servers and force the camera to use the changed values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:17:31.000Z
CVE-2020-25749 
The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telnet service cannot be disabled and this password cannot be changed via standard functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:18:28.000Z
CVE-2020-25750 
An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T03:25:50.000Z
CVE-2020-25751 
The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=com_pago&view=comments filter_published parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T04:01:44.000Z
CVE-2020-25752 
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-16T18:23:18.000Z
CVE-2020-25753 
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-16T18:26:58.000Z
CVE-2020-25754 
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-16T18:27:22.000Z
CVE-2020-25755 
An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-16T18:27:47.000Z
CVE-2020-25756 
A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T04:44:50.000Z
CVE-2020-25757 
A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T19:27:32.000Z
CVE-2020-25758 
An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into saved configurations before uploading. These entries are executed as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T19:27:55.000Z
CVE-2020-25759 
An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to a lack of validation of inputs provided in multipart HTTP POST requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T19:28:06.000Z
CVE-2020-25760 
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:00:10.000Z
CVE-2020-25761 
Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:06:00.000Z
CVE-2020-25762 
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:11:53.000Z
CVE-2020-25763 
Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:17:30.000Z
CVE-2020-25765 
Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1140.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-27T20:00:54.000Z
CVE-2020-25766 
An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-18T17:36:26.000Z
CVE-2020-25767 
An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet (e.g., forward compression pointer jumps are allowed), which leads to an Out-of-bounds Read, and a Denial-of-Service as a consequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-18T18:39:26.000Z
CVE-2020-25768 
Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-07T20:37:52.000Z
CVE-2020-25770 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771.
Problem types: description: OOB Read Info Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:43.000Z
CVE-2020-25771 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770.
Problem types: description: OOB Read Info Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:43.000Z
CVE-2020-25772 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771.
Problem types: description: OOB Read Info Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:44.000Z
CVE-2020-25773 
A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to execute arbitrary code on affected products. User interaction is required to exploit this vulnerability in that the target must import a corrupted configuration file.
Problem types: description: Double Free RCE
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:44.000Z
CVE-2020-25774 
A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to trigger an out-of-bounds red information disclosure which would disclose sensitive information to an unprivileged account. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Problem types: description: OOB Read Info Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2020-09-28T23:30:45.000Z
CVE-2020-25775 
The Trend Micro Security 2020 (v16) consumer family of products is vulnerable to a security race condition arbitrary file deletion vulnerability that could allow an unprivileged user to manipulate the product's secure erase feature to delete files with a higher set of privileges.
Problem types: description: Security Race Condition Arbitrary File Deletion
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-09-28T23:30:45.000Z
CVE-2020-25776 
Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit a critical file on the system to escalate their privileges. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Symbolic Link Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-02T22:00:17.000Z
CVE-2020-25777 
Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass the Web Threat Protection feature of the product. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Problem types: description: Protection Bypass
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-14T15:10:22.000Z
CVE-2020-25778 
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-14T15:10:23.000Z
CVE-2020-25779 
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in which a Internationalized Domain Name homograph attack (Puny-code) could be used to add a malicious website to the approved websites list of Trend Micro Antivirus for Mac to bypass the web threat protection feature.
Problem types: description: Protection Bypass
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-13T15:45:15.000Z
CVE-2020-25780 
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-29T16:08:29.000Z
CVE-2020-25781 
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T20:31:13.000Z
CVE-2020-25782 
An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientManage::ServerIP_Proto_Set during incoming message handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T02:05:09.000Z
CVE-2020-25783 
An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated heap-based buffer overflow in the function CNetClientTalk::OprMsg during incoming message handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T02:05:15.000Z
CVE-2020-25784 
An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientGuard::SubOprMsg during incoming message handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T02:05:20.000Z
CVE-2020-25785 
An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CFtpProtocol::FtpLogin during the update procedure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T02:05:26.000Z
CVE-2020-25786 
webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding (except in Internet Explorer) and because a web page cannot specify that a client should make an additional HTTP request with an arbitrary Referer header
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-19T19:24:09.000Z
CVE-2020-25787 
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-19T20:18:20.000Z
CVE-2020-25788 
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-19T20:18:08.000Z
CVE-2020-25789 
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-19T20:17:49.000Z
CVE-2020-25790 
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-19T20:31:08.000Z
CVE-2020-25791 
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-19T20:59:02.000Z