rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7856 
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Cnesty
product: Helpcom
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jeongun Baek
Published: 2021-04-20T12:02:43.000Z
CVE-2020-7857 
A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior to 9.2.2.280.
Problem types: cwe_id: CWE-470
description: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products: vendor: Tobesoft
product: XPlatform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jeongun Baek
Published: 2021-04-20T19:56:46.000Z
CVE-2020-7858 AquaNPlayer directory traversing vulnerability
There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost and an attacker can traverse directories using "dot dot" sequences(../../) to view host file on the system. This vulnerability can cause information leakage.
Problem types: cwe_id: CWE-548
description: CWE-548 Information Exposure Through Directory Listing
Affected products: vendor: cdnetworks
product: AquaNPlayer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2021-04-22T17:59:26.000Z
CVE-2020-7860 
UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by UnEGG. Attackers could exploit this and arbitrary code execution. This issue affects: Estsoft UnEGG 0.5 versions prior to 1.0 on linux.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Estsoft
product: UnEGG
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-06-11T17:36:01.314Z
CVE-2020-7861 AnySupport directory traversing vulnerability
AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a management PC to a client PC. This can be lead to arbitrary file execution.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Koino
product: AquaNPlayer
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-04-22T17:33:16.000Z
CVE-2020-7862 HelpU Overflow Vulnerability
A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability is due to insufficient input santization when communicating customer process.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Helpu,inc
product: HelpuViewer.exe
vendor: Helpu,inc
product: HelpuServer.exe
vendor: Helpu,inc
product: HelpuFTClient.dll
vendor: Helpu,inc
product: HelpuFTServer.dll
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Jeongun Back for reporting this vulnerability.
Published: 2021-06-24T10:15:14.096Z
CVE-2020-7863 Raonwiz RAON K Upload Arbitrary Command Execution Vulnerability
A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Raonwiz,inc
product: RAON K Upload
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Samuel Koo for reporting this vulnerability.
Published: 2021-08-05T20:24:26.000Z
CVE-2020-7864 Raonwiz DEXT5 Editor File upload and Execution vulnerability
Parameter manipulation can bypass authentication to cause file upload and execution. This will execute the remote code. This issue affects: Raonwiz DEXT5Editor versions prior to 3.5.1405747.1100.03.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Raonwiz
product: DEXT5Editor
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-06-15T14:47:39.606Z
CVE-2020-7865 Inoguard ExECM CoreB2B solution remote code execution vulnerability
A vulnerability(improper input validation) in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbitrary file via httpDownload function. A successful exploit could allow the attacker to hijack vulnerable system.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Inoguard
product: ExECM CoreB2B
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-07T14:46:16.000Z
CVE-2020-7866 Tobesoft XPLATFORM Arbitrary Command Execution Vulnerability
When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Tobesoft
product: XPLATFORM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Jeongun Baek for reporting this vulnerability
Published: 2021-07-20T10:12:42.000Z
CVE-2020-7867 Helpu arbitrary file creation vulnerability
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of administrator.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: HelpU
product: HelpuViewer.exe
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-27T00:43:35.000Z
CVE-2020-7868 Helpu remote code execution vulnerability
A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login.
Problem types: cwe_id: CWE-141
description: CWE-141 Improper Neutralization of Parameter/Argument Delimiters
Affected products: vendor: HelpU
product: helpu.ocx
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-06-29T13:39:21.000Z
CVE-2020-7869 
An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewer has the "Tight file CMD" function to create file. An attacker could create and execute arbitrary file in the ZOOK agent program using "Tight file CMD" without authority.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: mastersoft
product: ZOOK
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-06-29T13:48:53.000Z
CVE-2020-7870 
A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validation of the parameter.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: UNIDOCS
product: ezPDF Reader
vendor: UNIDOCS
product: ezPDF Editor
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Namjon Jo
Published: 2021-06-29T13:15:26.000Z
CVE-2020-7871 
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of the parameter. This issue affects: Cnesty Helpcom 10.0 versions prior to.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cnesty
product: Helpcom
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jeongun Baek
Published: 2021-06-29T12:51:48.000Z
CVE-2020-7872 
DaviewIndy v8.98.7.0 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed format file that is mishandled by DaviewIndy. Attackers could exploit this and arbitrary code execution.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: HumanTalk
product: DaviewIndy
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-07-12T13:40:38.000Z
CVE-2020-7873 
Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and execution.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: Younglimwon Co., Ltd
product: K-System WellComm
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-09T12:48:43.000Z
CVE-2020-7874 NEXACRO14 Runtime arbitrary file download and execution vulnerability
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: TOBESOFT
product: NEXACRO14
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-09T12:49:59.000Z
CVE-2020-7875 RAONWIZ DEXT5 Upload ActiveX remote file execution vulnerability
DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: RAONWIZ
product: DEXT5 Upload
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-28T15:28:37.000Z
CVE-2020-7877 ZOOK solution(remote administration tool) buffer overflow vulnerability
A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a crafted OUTERIP value because of missing boundary check. This vulnerability allows the attacker to execute remote arbitrary command.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: mastersoft
product: ZOOKViewer_Setup.exe
vendor: mastersoft
product: ZOOKAgentSetup.exe
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-07T11:43:54.000Z
CVE-2020-7878 
An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check.
Problem types: cwe_id: CWE-353
description: CWE-353 Missing Support for Integrity Check
Affected products: vendor: 4NB
product: VideoOffice
Published: 2021-12-28T19:09:21.634Z
CVE-2020-7879 ipTIME C200 IP Camera command injection vulnerability
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: EFM networks & multimedia
product: ipTIME C200 IP Camera
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-30T18:37:29.000Z
CVE-2020-7880 douzone NeoRS remote support program ActiveX vulnerability
The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program. This issue allows an remote attacker to download and execute remote file. It is because of improper parameter validation of StartNeoRS function in ActiveX.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: douzone
product: NeoRS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-30T18:47:59.000Z
CVE-2020-7881 AfreecaTV streamer service stack-based buffer overflow
The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. It is because of stored data without validation of length.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: AfreecaTV
product: afreecatvstreamer.exe
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-26T16:29:17.000Z
CVE-2020-7882 anySign directory traversal vulnerability
Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: Hancomwith
product: anySign4PC
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-11-22T14:43:26.000Z
CVE-2020-7883 
Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: WOWSOFT
product: Printchaser
Published: 2021-12-28T19:12:33.509Z
CVE-2020-7904 
In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:01:39.000Z
CVE-2020-7905 
Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:03:36.000Z
CVE-2020-7906 
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:09:16.000Z
CVE-2020-7907 
In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-21T20:37:24.000Z
CVE-2020-7908 
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:10:34.000Z
CVE-2020-7909 
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:12:01.000Z
CVE-2020-7910 
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:13:21.000Z
CVE-2020-7911 
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:14:58.000Z
CVE-2020-7912 
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:16:26.000Z
CVE-2020-7913 
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T17:17:39.000Z
CVE-2020-7914 
In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T12:02:40.000Z
CVE-2020-7915 
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T22:19:45.000Z
CVE-2020-7916 
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T17:04:42.000Z
CVE-2020-7918 
An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T13:43:49.000Z
CVE-2020-7919 
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T20:55:31.000Z