rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-5669 
Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-10-26T10:10:10.000Z
CVE-2020-5674 
Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: SEIKO EPSON CORPORATION
product: the installers of multiple SEIKO EPSON products
Published: 2020-11-24T06:55:23.000Z
CVE-2020-5675 
Out-of-bounds read vulnerability in GT21 model of GOT2000 series (GT2107-WTBD V01.39.000 and earlier, GT2107-WTSD V01.39.000 and earlier, GT2104-RTBD V01.39.000 and earlier, GT2104-PMBD V01.39.000 and earlier, and GT2103-PMBD V01.39.000 and earlier), GS21 model of GOT series (GS2110-WTBD V01.39.000 and earlier, GS2107-WTBD V01.39.000 and earlier, GS2110-WTBD-N V01.39.000 and earlier, and GS2107-WTBD-N V01.39.000 and earlier), and Tension Controller LE7-40GU-L series (LE7-40GU-L Screen package data for CC-Link IEF Basic V1.00, LE7-40GU-L Screen package data for MODBUS/TCP V1.00, and LE7-40GU-L Screen package data for SLMP V1.00) allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted packet. As a result, deterioration of communication performance or a denial-of-service (DoS) condition of the TCP communication functions of the products may occur.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: Mitsubishi Electric Corporation
product: GT21 model of GOT2000 series, GS21 model of GOT SIMPLE series, and Tension Controller LE7-40GU-L series
Published: 2020-12-04T07:10:19.000Z
CVE-2020-5676 
GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors.
Problem types: description: Information Disclosure
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2020-12-03T11:15:31.000Z
CVE-2020-5677 
Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2020-12-03T11:15:32.000Z
CVE-2020-5678 
Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2020-12-03T11:15:32.000Z
CVE-2020-5679 
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
Problem types: description: Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE
Published: 2020-12-03T11:15:32.000Z
CVE-2020-5680 
Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.
Problem types: description: Improper Input Validation
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE
Published: 2020-12-03T11:15:33.000Z
CVE-2020-5681 
Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirector versions 1.6x/1.6y and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: SEIKO EPSON CORPORATION
product: EpsonNet SetupManager and Offirio SynergyWare PrintDirector
Published: 2020-12-24T01:20:20.000Z
CVE-2020-5682 
Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: Improper Input Validation
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2020-12-16T07:45:18.000Z
CVE-2020-5683 
Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to alter the data by uploading a specially crafted file.
Problem types: description: Directory traversal
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2020-12-16T07:45:19.000Z
CVE-2020-5684 
iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.
Problem types: description: Improper server certificate verification
Affected products: vendor: NEC Corporation
product: Management software for NEC Storage disk array system
Published: 2020-12-24T01:20:20.000Z
CVE-2020-5685 
UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: UNIVERGE SV9500/SV8500 series
Published: 2021-01-13T09:40:35.000Z
CVE-2020-5686 
Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access the remote system maintenance feature and obtain the information by sending a specially crafted request to a specific URL.
Problem types: description: Incorrect Implementation of Authentication Algorithm
Affected products: vendor: NEC Corporation
product: UNIVERGE SV9500/SV8500 series
Published: 2021-01-13T09:40:36.000Z
CVE-2020-5720 
MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vulnerable to this attack if it connects to a malicious endpoint or if an attacker mounts a man in the middle attack.
Problem types: cwe_id: CWE-22
description: Path Traversal File Writing (CWE-22)
Affected products: vendor: n/a
product: MikroTik WinBox
Published: 2020-02-06T16:51:16.000Z
CVE-2020-5721 
MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuration file can extract a username and password to gain access to the router.
Problem types: cwe_id: CWE-260
description: CWE-260
Affected products: vendor: n/a
product: MikroTik WinBox
Published: 2020-04-15T20:50:45.000Z
CVE-2020-5722 
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Problem types: description: SQL Injection, HTML Injection
Affected products: vendor: n/a
product: Grandstream UCM6200 Series
Published: 2020-03-23T19:31:40.000Z
CVE-2020-5723 
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.
Problem types: cwe_id: CWE-312
description: Cleartext Password Storage (CWE-312)
Affected products: vendor: n/a
product: Grandstream UCM6200 series
Published: 2020-03-30T19:03:22.000Z
CVE-2020-5724 
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Grandstream UCM6200 series
Published: 2020-03-30T19:03:32.000Z
CVE-2020-5725 
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Grandstream UCM6200 series
Published: 2020-03-30T19:03:44.000Z
CVE-2020-5726 
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Grandstream UCM6200 series
Published: 2020-03-30T19:03:52.000Z
CVE-2020-5727 
Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an armed system.
Problem types: description: Unauthenticated Keypad Pairing Vulnerability
Affected products: vendor: n/a
product: SimpliSafe SS3
Published: 2020-05-02T15:22:02.000Z
CVE-2020-5728 
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: n/a
product: OpenMRS
Published: 2020-04-17T18:29:48.000Z
CVE-2020-5729 
In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Any page that is able to trigger a UI Framework Error is susceptible to this issue.
Problem types: description: Cross Site Scripting
Affected products: vendor: n/a
product: OpenMRS
Published: 2020-04-17T18:29:54.000Z
CVE-2020-5730 
In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: n/a
product: OpenMRS
Published: 2020-04-17T18:29:59.000Z
CVE-2020-5731 
In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: n/a
product: OpenMRS
Published: 2020-04-17T18:30:05.000Z
CVE-2020-5732 
In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators.
Problem types: description: Authentication Bypass
Affected products: vendor: n/a
product: OpenMRS
Published: 2020-04-17T18:27:00.000Z
CVE-2020-5733 
In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: OpenMRS
Published: 2020-04-17T18:27:07.000Z
CVE-2020-5734 
Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange.
Problem types: description: Unauthenticated Remote Buffer Overflow
Affected products: vendor: n/a
product: SolarWinds Dameware
Published: 2020-04-07T13:05:07.000Z
CVE-2020-5735 
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: Amcrest
Published: 2020-04-08T12:42:25.000Z
CVE-2020-5736 
Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Amcrest
Published: 2020-04-08T12:42:22.000Z
CVE-2020-5737 
Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue.
Problem types: description: Stored XSS
Affected products: vendor: n/a
product: Tenable.Sc
Published: 2020-04-17T18:24:29.000Z
CVE-2020-5738 
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface.
Problem types: cwe_id: CWE-59
description: CWE-59
Affected products: vendor: n/a
product: Grandstream GXP1600 Series
Published: 2020-04-14T13:48:44.000Z
CVE-2020-5739 
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: n/a
product: Grandstream GXP1600 Series
Published: 2020-04-14T13:48:50.000Z
CVE-2020-5740 
Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: Plex Media Server (Windows)
Published: 2020-04-22T15:02:23.000Z
CVE-2020-5741 
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
Problem types: description: Authenticated Remote Python Deserialization
Affected products: vendor: n/a
product: Plex Media Server (Windows)
Published: 2020-05-08T12:02:59.000Z
CVE-2020-5742 
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.
Problem types: description: Weak CORS Policy
Affected products: vendor: n/a
product: Plex Media Server
Published: 2020-06-15T19:26:18.000Z
CVE-2020-5743 
Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission.
Problem types: description: Authenticated Insecure Direct Object Reference
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:05:35.000Z
CVE-2020-5744 
Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk.
Problem types: description: Authenticated Directory Traversal / Arbitrary File Read
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:03:57.000Z
CVE-2020-5745 
Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
Problem types: description: Cross-site Request Forgery
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:10:39.000Z
CVE-2020-5746 
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted test.
Problem types: description: Authenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:08:20.000Z
CVE-2020-5747 
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted test.
Problem types: description: Authenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:02:17.000Z
CVE-2020-5748 
Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature.
Problem types: description: Unauthenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:12:13.000Z
CVE-2020-5749 
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted group.
Problem types: description: Authenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:15:02.000Z
CVE-2020-5750 
Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature.
Problem types: description: Unauthenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:16:24.000Z
CVE-2020-5751 
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted operator.
Problem types: description: Authenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: TCExam
Published: 2020-05-07T16:13:46.000Z
CVE-2020-5752 
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.
Problem types: description: Unauthenticated Path Traversal Vulnerability
Affected products: vendor: n/a
product: Druva inSync Windows Client
Published: 2020-05-21T14:03:16.000Z
CVE-2020-5753 
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Signal Private Messenger
Published: 2020-05-20T13:40:19.000Z
CVE-2020-5754 
Webroot endpoint agents prior to version v9.0.28.48 allows remote attackers to trigger a type confusion vulnerability over its listening TCP port, resulting in crashing or reading memory contents of the Webroot endpoint agent.
Problem types: description: Incorrect Type Conversion or Cast
Affected products: vendor: n/a
product: Webroot SecureAnywhere
Published: 2020-06-15T19:31:02.000Z
CVE-2020-5755 
Webroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\WrData\PKG" directory against renaming. This could allow attackers to trigger a crash or wait upon Webroot service restart to rewrite and hijack dlls in this directory for privilege escalation.
Problem types: description: Local Privilege Escalation
Affected products: vendor: n/a
product: Webroot SecureAnywhere
Published: 2020-06-15T19:31:15.000Z
CVE-2020-5756 
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.
Problem types: cwe_id: CWE-489
description: CWE-489
Affected products: vendor: Tenable
product: Grandstream GWN7000
Published: 2020-07-17T20:16:27.000Z
CVE-2020-5757 
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Grandstream UCM6200 Series
Published: 2020-07-17T20:35:44.000Z
CVE-2020-5758 
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Grandstream UCM6200 Series
Published: 2020-07-17T20:35:47.000Z
CVE-2020-5759 
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Grandstream UCM6200 Series
Published: 2020-07-17T20:35:51.000Z
CVE-2020-5760 
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Grandstream HT800 Series
Published: 2020-07-29T18:51:40.000Z
CVE-2020-5761 
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: n/a
product: Grandstream HT800 Series
Published: 2020-07-29T18:51:43.000Z
CVE-2020-5762 
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of the HTTP Authentication field.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Grandstream HT800 Series
Published: 2020-07-29T18:51:47.000Z
CVE-2020-5763 
Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by correctly answering a challenge prompt.
Problem types: cwe_id: CWE-489
description: CWE-489
Affected products: vendor: n/a
product: Grandstream HT800 Series
Published: 2020-07-29T18:51:50.000Z
CVE-2020-5764 
MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILE_LIST" with a "name" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In some instances, an attacker can achieve remote code execution by writing ".odex" and ".vdex" files in the "oat" directory of the MX Player application.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: MX Player Android App
Published: 2020-07-08T13:34:53.000Z