rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-29576 
The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:28:22.000Z
CVE-2020-29577 
The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:15:15.000Z
CVE-2020-29578 
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:02:12.000Z
CVE-2020-29579 
The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:05:21.000Z
CVE-2020-29580 
The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:13:21.000Z
CVE-2020-29581 
The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:07:40.000Z
CVE-2020-29582 
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:20:28.000Z
CVE-2020-29583 
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-22T00:00:00.000Z
CVE-2020-29587 
SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html() function to directly append the payload to a dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-14T15:07:16.000Z
CVE-2020-29591 
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T14:27:18.000Z
CVE-2020-29592 
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed (regardless of the file types allowed list in Media settings).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:23:12.000Z
CVE-2020-29593 
An issue was discovered in Orchard before 1.10. The Media Settings Allowed File Types list field allows an attacker to add a XSS payload that will execute when users attempt to upload a disallowed file type, causing the error to display.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:25:41.000Z
CVE-2020-29594 
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T06:17:19.000Z
CVE-2020-29595 
PlugIns\IDE_ACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV starting at IDE_ACDStd!JPEGTransW+0x00000000000031aa.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-07T18:49:59.000Z
CVE-2020-29596 
MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T21:36:06.000Z
CVE-2020-29597 
IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-07T19:09:10.000Z
CVE-2020-29599 
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-07T00:00:00.000Z
CVE-2020-29600 
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-07T19:52:14.000Z
CVE-2020-29601 
The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:09:45.000Z
CVE-2020-29602 
The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-08T15:11:30.000Z
CVE-2020-29603 
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T06:41:36.000Z
CVE-2020-29604 
An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private view status, or belonging to a private Project) via the bug_arr[] parameter. This provides full access to potentially confidential information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T06:45:19.000Z
CVE-2020-29605 
An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bug_arr[]= in a crafted bug_actiongroup_page.php URL. (The target Issues can have Private view status, or belong to a private Project.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-29T06:43:17.000Z
CVE-2020-29607 
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-16T14:28:27.000Z
CVE-2020-29608 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, watchOS 7.2. A remote attacker may be able to leak memory.
Problem types: description: A remote attacker may be able to leak memory
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:40:45.000Z
CVE-2020-29610 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 7.2, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. Processing a maliciously crafted audio file may disclose restricted memory.
Problem types: description: Processing a maliciously crafted audio file may disclose restricted memory
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:40:24.000Z
CVE-2020-29611 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, iCloud for Windows 12.0, watchOS 7.2. Processing a maliciously crafted image may lead to arbitrary code execution.
Problem types: description: Processing a maliciously crafted image may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:42:03.000Z
CVE-2020-29612 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to execute arbitrary code with system privileges.
Problem types: description: A malicious application may be able to execute arbitrary code with system privileges
Affected products: vendor: Apple
product: macOS
Published: 2021-04-02T17:39:41.000Z
CVE-2020-29613 
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.3 and iPadOS 14.3. An enterprise application installation prompt may display the wrong domain.
Problem types: description: An enterprise application installation prompt may display the wrong domain
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2021-04-02T17:41:05.000Z
CVE-2020-29614 
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. Processing a maliciously crafted file may lead to heap corruption.
Problem types: description: Processing a maliciously crafted file may lead to heap corruption
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:41:34.000Z
CVE-2020-29615 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 7.2, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. Processing a maliciously crafted image may lead to a denial of service.
Problem types: description: Processing a maliciously crafted image may lead to a denial of service
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:42:36.000Z
CVE-2020-29616 
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.
Problem types: description: Processing a maliciously crafted image may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
Published: 2021-04-02T17:42:19.000Z
CVE-2020-29617 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, iCloud for Windows 12.0, watchOS 7.2. Processing a maliciously crafted image may lead to heap corruption.
Problem types: description: Processing a maliciously crafted image may lead to heap corruption
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:43:33.000Z
CVE-2020-29618 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, iCloud for Windows 12.0, watchOS 7.2. Processing a maliciously crafted image may lead to arbitrary code execution.
Problem types: description: Processing a maliciously crafted image may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:43:14.000Z
CVE-2020-29619 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, iCloud for Windows 12.0, watchOS 7.2. Processing a maliciously crafted image may lead to heap corruption.
Problem types: description: Processing a maliciously crafted image may lead to heap corruption
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:44:12.000Z
CVE-2020-29620 
This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to elevate privileges.
Problem types: description: A malicious application may be able to elevate privileges
Affected products: vendor: Apple
product: macOS
Published: 2021-04-02T17:42:55.000Z
CVE-2020-29621 
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to bypass Privacy preferences.
Problem types: description: A malicious application may be able to bypass Privacy preferences
Affected products: vendor: Apple
product: macOS
Published: 2021-04-02T17:43:53.000Z
CVE-2020-29622 
A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
Problem types: description: Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges
Affected products: vendor: Apple
product: Security Update - Catalina
Published: 2021-10-19T13:12:47.000Z
CVE-2020-29623 
"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing history.
Problem types: description: A user may be unable to fully delete browsing history
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:44:36.000Z
CVE-2020-29624 
A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in watchOS 7.2, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. Processing a maliciously crafted font file may lead to arbitrary code execution.
Problem types: description: Processing a maliciously crafted font file may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:45:34.000Z
CVE-2020-29625 
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.
Problem types: description: Processing a maliciously crafted image may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
Published: 2021-04-02T17:45:18.000Z
CVE-2020-29629 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to read restricted memory.
Problem types: description: A malicious application may be able to read restricted memory
Affected products: vendor: Apple
product: macOS
Published: 2021-10-28T18:16:56.000Z
CVE-2020-29633 
An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. An attacker in a privileged network position may be able to bypass authentication policy.
Problem types: description: An attacker in a privileged network position may be able to bypass authentication policy
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-04-02T17:47:19.000Z
CVE-2020-29639 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted font may result in the disclosure of process memory.
Problem types: description: Processing a maliciously crafted font may result in the disclosure of process memory
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2021-04-02T17:44:58.000Z
CVE-2020-29651 
A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T06:58:22.000Z
CVE-2020-29652 
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-17T04:12:17.000Z
CVE-2020-29653 
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-13T12:02:10.000Z
CVE-2020-29654 
Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T23:46:01.000Z
CVE-2020-29655 
An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to influence the appearance of the login page, aka text injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T08:00:58.000Z
CVE-2020-29656 
An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unknown functionality" in a "known to be easy" manner via an unspecified "public exploit."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T08:00:42.000Z
CVE-2020-29657 
In JerryScript 2.3.0, there is an out-of-bounds read in main_print_unhandled_exception in the main-utils.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T08:06:13.000Z
CVE-2020-29658 
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-05T08:44:49.000Z
CVE-2020-29659 
A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execute code as SYSTEM by overflowing the sid parameter via a GET /settings&sid= attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T16:13:31.000Z
CVE-2020-29660 
A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T16:57:56.000Z
CVE-2020-29661 
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T16:57:41.000Z
CVE-2020-29662 
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-02T20:54:33.000Z
CVE-2020-29663 
Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T22:15:35.000Z