rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-28367 Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
Problem types: description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Go toolchain
product: cmd/go
default_status: unaffected
Credits: lang: en
value: Imre Rad
Published: 2020-11-18T00:00:00.000Z
CVE-2020-28368 
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T18:17:29.000Z
CVE-2020-28369 
In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z
CVE-2020-28371 
An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T21:13:18.000Z
CVE-2020-28373 
upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T21:32:28.000Z
CVE-2020-28374 
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T03:07:45.000Z
CVE-2020-28381 
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-01-12T20:18:35.000Z
CVE-2020-28382 
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in a out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-01-12T20:18:35.000Z
CVE-2020-28383 
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out of bounds write past the memory location that is a read only image address. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11885)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-01-12T20:18:35.000Z
CVE-2020-28384 
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could lead to a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-01-12T20:18:35.000Z
CVE-2020-28385 
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12049)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-03-15T17:03:30.000Z
CVE-2020-28386 
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-01-12T20:18:36.000Z
CVE-2020-28387 
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-03-15T17:03:30.000Z
CVE-2020-28388 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.
Problem types: cwe_id: CWE-342
description: CWE-342: Predictable Exact Value from Previous Values
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: Nucleus NET
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V3
default_status: unknown
vendor: Siemens
product: Nucleus Source Code
default_status: unknown
vendor: Siemens
product: PLUSCONTROL 1st Gen
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2021-02-09T00:00:00.000Z
CVE-2020-28390 
A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Siemens
product: Opcenter Execution Core
vendor: Siemens
product: Opcenter Execution Core
Published: 2021-01-12T20:18:36.000Z
CVE-2020-28391 
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
Affected products: vendor: Siemens
product: SCALANCE X-200 switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-200RNA switch family
Published: 2021-01-12T00:00:00.000Z
CVE-2020-28392 
A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are configured for the application folder and subfolders which could allow an attacker to gain persistence or potentially escalate privileges should a user with elevated credentials log onto the machine.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Siemens
product: SIMARIS configuration
Published: 2021-02-09T15:38:20.000Z
CVE-2020-28393 
An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).
Problem types: cwe_id: CWE-682
description: INCORRECT CALCULATION CWE-682
Affected products: vendor: n/a
product: SCALANCE XM-400, XR-500
Published: 2021-05-12T13:18:22.000Z
CVE-2020-28394 
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of RAS files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12283)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-02-09T15:38:20.000Z
CVE-2020-28395 
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
Affected products: vendor: Siemens
product: SCALANCE X-200RNA switch family
vendor: Siemens
product: SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Published: 2021-01-12T00:00:00.000Z
CVE-2020-28396 
A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions < V16). A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position could decrypt the communication and compromise confidentiality and integrity of the transmitted information.
Problem types: cwe_id: CWE-693
description: CWE-693: Protection Mechanism Failure
Affected products: vendor: Siemens
product: SICAM A8000 CP-8000
vendor: Siemens
product: SICAM A8000 CP-8021
vendor: Siemens
product: SICAM A8000 CP-8022
Published: 2020-12-14T21:05:19.000Z
CVE-2020-28397 
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Siemens
product: SIMATIC Drive Controller family
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC S7 PLCSIM Advanced
vendor: Siemens
product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
vendor: Siemens
product: SIMATIC S7-1500 Software Controller
vendor: Siemens
product: TIM 1531 IRC (incl. SIPLUS NET variants)
Published: 2021-08-10T10:35:23.000Z
CVE-2020-28398 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The CLI feature in the web interface of affected devices is vulnerable to 
cross-site request forgery (CSRF).

This could allow an attacker to read or modify the device configuration
by tricking an authenticated legitimate user into accessing a malicious link.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX MX5000RE
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1400
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1500
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1501
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1510
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1511
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1512
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1524
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1536
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX5000
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 8.8
baseSeverity: HIGH
Published: 2024-12-10T13:53:19.090Z
CVE-2020-28401 
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access WIP details about jobs he should not have access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-01-29T06:07:04.000Z
CVE-2020-28402 
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access Launcher Configuration Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:L/PR:L/S:U/UI:N
version: 3.1
Published: 2021-01-29T06:07:40.000Z
CVE-2020-28403 
A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:R
version: 3.1
Published: 2021-01-29T06:08:44.000Z
CVE-2020-28404 
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access the Billing page without the appropriate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-01-29T06:09:38.000Z
CVE-2020-28405 
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change the privileges of any user of the application. This can be used to grant himself the administrative role or remove all administrative accounts of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2021-01-29T06:10:27.000Z
CVE-2020-28406 
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access details about jobs he should not have access to via the Audit Trail Feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-01-29T06:11:11.000Z
CVE-2020-28407 
In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-03T00:00:00.000Z
CVE-2020-28408 
The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T20:20:06.000Z
CVE-2020-28409 
The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T20:19:55.000Z
CVE-2020-28413 
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2020-12-30T21:28:21.000Z
CVE-2020-28414 
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28415).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T19:39:14.000Z
CVE-2020-28415 
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T19:32:08.000Z
CVE-2020-28416 
HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution.
Problem types: description: unauthorized local code execution
Affected products: vendor: n/a
product: HP OfficeJet Printer; HP PageWide Printer
Published: 2021-11-03T19:02:37.000Z
CVE-2020-28419 
During installation with certain driver software or application packages an arbitrary code execution could occur.
Problem types: description: Arbitrary code execution
Affected products: vendor: n/a
product: HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide Printer; HP PageWide Pro Printer; HP inkjet Printer; HP OfficeJet Printer
Published: 2021-11-09T18:01:41.000Z