rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-26565 
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-31T16:43:53.000Z
CVE-2020-26566 
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-26T17:44:50.000Z
CVE-2020-26567 
An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access reboots the device, rendering it therefore unusable for several minutes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-08T12:22:15.000Z
CVE-2020-26569 
In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. This can result in traffic being discarded on the receiving VLAN. This affects versions: 4.21.12M and below releases in the 4.21.x train; 4.22.7M and below releases in the 4.22.x train; 4.23.5M and below releases in the 4.23.x train; 4.24.2F and below releases in the 4.24.x train.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T15:52:48.000Z
CVE-2020-26570 
The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T01:04:17.000Z
CVE-2020-26571 
The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T01:04:06.000Z
CVE-2020-26572 
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T01:03:56.000Z
CVE-2020-26574 
Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T14:32:24.000Z
CVE-2020-26575 
In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero.c by correcting the implementation of offset advancement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T14:57:03.000Z
CVE-2020-26582 
D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping (aka res_config_action=3&res_config_id=18).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T15:27:00.000Z
CVE-2020-26583 
An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users to upload JavaScript (in a file) via the expenses claiming functionality. However, to view the file, authentication is required. By exploiting this vulnerability, an attacker can persistently include arbitrary HTML or JavaScript code into the affected web page. The vulnerability can be used to change the contents of the displayed site, redirect to other sites, or steal user credentials. Additionally, users are potential victims of browser exploits and JavaScript malware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T05:09:54.000Z
CVE-2020-26584 
An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the attacker can lure a user into clicking a crafted link, he can execute arbitrary JavaScript code in the user's browser. The vulnerability can be used to change the contents of the displayed site, redirect to other sites, or steal user credentials. Additionally, users are potential victims of browser exploits and JavaScript malware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T05:10:41.000Z
CVE-2020-26596 
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-07T15:32:27.000Z
CVE-2020-26597 
An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. The Wi-Fi subsystem has incorrect input validation, leading to a crash. The LG ID is LVE-SMP-200022 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:15:09.000Z
CVE-2020-26598 
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. The Network Management component could allow an unauthorized actor to kill a TCP connection. The LG ID is LVE-SMP-200023 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:14:47.000Z
CVE-2020-26599 
An issue was discovered on Samsung mobile devices with Q(10.0) software. The DynamicLockscreen Terms and Conditions can be accepted without authentication. The Samsung ID is SVE-2020-17079 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:32:04.000Z
CVE-2020-26600 
An issue was discovered on Samsung mobile devices with Q(10.0) software. Auto Hotspot allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:36:43.000Z
CVE-2020-26601 
An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18034 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:36:30.000Z
CVE-2020-26602 
An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software. PendingIntent allows sdcard access by an unprivileged process. The Samsung ID is SVE-2020-18392 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:36:13.000Z
CVE-2020-26603 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Sticker Center allows directory traversal for an unprivileged process to read arbitrary files. The Samsung ID is SVE-2020-18433 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:32:16.000Z
CVE-2020-26604 
An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. PendingIntent allows an unprivileged process to access contact numbers. The Samsung ID is SVE-2020-18467 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:36:00.000Z
CVE-2020-26605 
An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by reading a log. The Samsung ID is SVE-2020-18596 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:35:44.000Z
CVE-2020-26606 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. An attacker can access certain Secure Folder content via a debugging command. The Samsung ID is SVE-2020-18673 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:32:42.000Z
CVE-2020-26607 
An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18418 (October 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:32:28.000Z
CVE-2020-26609 
fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator credentials to log in to the background.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T16:38:04.000Z
CVE-2020-26623 
SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-02T00:00:00.000Z
CVE-2020-26624 
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-02T00:00:00.000Z
CVE-2020-26625 
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-02T00:00:00.000Z
CVE-2020-26627 
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafted payload entered into the 'Admin Remark' parameter under the 'Contact Us Queries -> Unread Query' tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-10T00:00:00.000Z
CVE-2020-26628 
A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML code via a malicious payload appended to a username on the 'Edit Profile" page and triggered by another user visiting the profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-10T00:00:00.000Z
CVE-2020-26629 
A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-10T00:00:00.000Z
CVE-2020-26630 
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a special payload in the 'Doctor Specialization' field under the 'Go to Doctors' tab after logging in as an admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-10T00:00:00.000Z
CVE-2020-26641 
A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-28T19:58:26.000Z
CVE-2020-26642 
A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-28T19:58:25.000Z
CVE-2020-26649 
AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T14:12:01.000Z
CVE-2020-26650 
AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T14:13:34.000Z
CVE-2020-26652 
An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-26664 
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-08T17:40:41.000Z
CVE-2020-26668 
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-01T14:13:23.000Z
CVE-2020-26669 
A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-01T14:13:24.000Z
CVE-2020-26670 
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-01T14:13:25.000Z
CVE-2020-26672 
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T14:36:19.000Z
CVE-2020-26677 
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T11:58:21.000Z
CVE-2020-26678 
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile picture in order to place a malicious PHP file on the server and gain code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T11:50:40.000Z
CVE-2020-26679 
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T11:53:14.000Z
CVE-2020-26680 
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T11:54:59.000Z
CVE-2020-26682 
In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T13:19:23.000Z
CVE-2020-26683 
A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-26693 
A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-01T14:30:04.000Z
CVE-2020-26701 
Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T17:55:21.000Z
CVE-2020-26705 
The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-31T19:51:53.000Z
CVE-2020-26707 
An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-31T19:51:54.000Z
CVE-2020-26708 
requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-29T00:00:00.000Z
CVE-2020-26709 
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-29T00:00:00.000Z
CVE-2020-26710 
easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-29T00:00:00.000Z
CVE-2020-26712 
REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T14:17:33.000Z
CVE-2020-26713 
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T14:17:55.000Z
CVE-2020-26728 
A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T18:05:36.000Z
CVE-2020-26732 
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-14T00:00:00.000Z
CVE-2020-26733 
Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-14T15:57:23.000Z
CVE-2020-26759 
clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T12:56:55.000Z
CVE-2020-26762 
A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorized attacker to perform remote-code-execution due to a crafted GET-Request. The overflow occurs in binary ipcam_cgi due to a missing type check in function doGetSysteminfo(). This has been fixed in version: IC-3116W v3.08.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-01T14:56:08.000Z
CVE-2020-26763 
The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-05T14:49:09.000Z
CVE-2020-26766 
A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management System With Admin Panel 2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-26T01:54:20.000Z
CVE-2020-26768 
Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site once the URL is clicked or visited. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials, force malware execution, user redirection and others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-07T12:43:12.000Z
CVE-2020-26772 
Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-08T20:18:24.000Z
CVE-2020-26773 
Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker to execute arbitrary SQL commands via the date parameter in includes/reservation.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-07T14:19:01.000Z