rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-22983 
A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-13T12:31:11.000Z
CVE-2020-22984 
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T19:57:58.000Z
CVE-2020-22985 
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T19:58:23.000Z
CVE-2020-22986 
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T19:58:15.000Z
CVE-2020-22987 
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T19:58:03.000Z
CVE-2020-23014 
APfell 1.4 is vulnerable to authenticated reflected cross-site scripting (XSS) in /apiui/command_ through the payloadtypes_callback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T20:44:42.000Z
CVE-2020-23015 
An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T21:32:46.000Z
CVE-2020-23026 
A NULL pointer dereference in the main() function dhry_1.c of dhrystone 2.1 causes a denial of service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-03T19:09:26.000Z
CVE-2020-23036 
MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to read the authentication credentials and follow-up requests containing the user password via a man in the middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:37.000Z
CVE-2020-23037 
Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:38.000Z
CVE-2020-23038 
Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:39.000Z
CVE-2020-23039 
Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:40.000Z
CVE-2020-23040 
Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitive data and files via 'null' path commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:40.000Z
CVE-2020-23041 
Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:35.000Z
CVE-2020-23042 
Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:35.000Z
CVE-2020-23043 
Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:34.000Z
CVE-2020-23044 
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:33.000Z
CVE-2020-23045 
Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the 'roleId' parameter of the `editRole` and `deletUser` modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:33.000Z
CVE-2020-23046 
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet' parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:32.000Z
CVE-2020-23047 
Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnerability in the search input field of the search module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:31.000Z
CVE-2020-23048 
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:31.000Z
CVE-2020-23049 
Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:29.000Z
CVE-2020-23050 
TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:28.000Z
CVE-2020-23051 
Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:28.000Z
CVE-2020-23052 
Catalyst IT Ltd Mahara CMS v19.10.2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component groupfiles.php via the Number (Nombre) and Description (Descripción) parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:26.000Z
CVE-2020-23054 
A cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:24.000Z
CVE-2020-23055 
ANCOM WLAN Controller (Wireless Series & Hotspot) WLC-1000 & WLC-4006 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the /authen/start/ module via the userid and password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:23.000Z
CVE-2020-23058 
An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:22.000Z
CVE-2020-23060 
Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Export/Import function. This vulnerability allows attackers to escalate local process privileges via a crafted ef2 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:20.000Z
CVE-2020-23061 
Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the `list` and `download` module which allows attackers to perform a directory traversal via a change to the path variable to request the local list command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T19:20:21.000Z
CVE-2020-23065 
Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2020-23069 
Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-18T16:16:49.000Z
CVE-2020-23079 
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T16:29:30.000Z
CVE-2020-23083 
Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges by uploading a crafted file to the component "jeecgFormDemoController.do?commonUpload".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T21:12:42.000Z
CVE-2020-23109 
Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T16:07:03.000Z
CVE-2020-23126 
Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T16:06:42.000Z
CVE-2020-23127 
Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T21:50:43.000Z
CVE-2020-23128 
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T21:55:40.000Z
CVE-2020-23136 
Microweber v1.1.18 is affected by no session expiry after log-out.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T17:02:41.000Z
CVE-2020-23138 
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T17:03:02.000Z
CVE-2020-23139 
Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T17:03:24.000Z
CVE-2020-23140 
Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T17:03:59.000Z
CVE-2020-23148 
The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T22:54:11.000Z
CVE-2020-23149 
The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T22:54:13.000Z
CVE-2020-23150 
A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T22:54:15.000Z
CVE-2020-23151 
rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T22:54:16.000Z
CVE-2020-23160 
Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T13:11:13.000Z
CVE-2020-23161 
Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance > Logs menu and manipulating the file-path in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T13:11:37.000Z
CVE-2020-23162 
Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T13:11:57.000Z
CVE-2020-23171 
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T15:06:18.000Z
CVE-2020-23172 
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T15:06:20.000Z
CVE-2020-23178 
An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:05.000Z
CVE-2020-23179 
A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:07.000Z
CVE-2020-23181 
A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:09.000Z
CVE-2020-23182 
The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:11.000Z
CVE-2020-23184 
A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:14.000Z
CVE-2020-23185 
A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:16.000Z
CVE-2020-23190 
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:18.000Z
CVE-2020-23192 
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:20.000Z
CVE-2020-23194 
A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T17:51:23.000Z
CVE-2020-23205 
A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:09:10.000Z
CVE-2020-23207 
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values" field under the "Configure Attributes" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:09:53.000Z
CVE-2020-23208 
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:10:45.000Z
CVE-2020-23209 
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:12:03.000Z
CVE-2020-23214 
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:12:51.000Z
CVE-2020-23217 
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:13:55.000Z
CVE-2020-23219 
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T20:40:56.000Z
CVE-2020-23226 
Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-27T00:00:00.000Z
CVE-2020-23234 
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T19:12:02.000Z
CVE-2020-23238 
Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T19:41:50.000Z
CVE-2020-23239 
Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T19:49:32.000Z
CVE-2020-23240 
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T20:06:58.000Z
CVE-2020-23241 
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T20:12:55.000Z
CVE-2020-23242 
Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T20:19:43.000Z