rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10782 
An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality. This is fixed in Ansible version 3.7.1.
Problem types: cwe_id: CWE-276
description: CWE-276
cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Red Hat
product: Ansible Tower
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-06-18T12:49:07.000Z
CVE-2020-10783 
Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: CloudForms
Published: 2020-08-11T12:35:13.000Z
CVE-2020-10786 
A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T16:54:24.000Z
CVE-2020-10787 
An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password (aka the user password change script).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T16:54:47.000Z
CVE-2020-10788 
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T14:04:47.000Z
CVE-2020-10789 
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T14:00:49.000Z
CVE-2020-10790 
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T13:59:59.000Z
CVE-2020-10791 
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T13:58:31.000Z
CVE-2020-10792 
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T17:48:21.000Z
CVE-2020-10793 
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T14:12:20.000Z
CVE-2020-10794 
Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined with CVE-2020-10795 for remote root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T20:31:12.000Z
CVE-2020-10795 
Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T20:33:04.000Z
CVE-2020-10797 
An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:29:52.000Z
CVE-2020-10799 
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T22:40:23.000Z
CVE-2020-10800 
lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-21T14:06:56.000Z
CVE-2020-10802 
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T03:48:33.000Z
CVE-2020-10803 
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T03:48:16.000Z
CVE-2020-10804 
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T03:47:59.000Z
CVE-2020-10806 
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T15:34:08.000Z
CVE-2020-10807 
auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T15:50:57.000Z
CVE-2020-10808 
Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T16:07:34.000Z
CVE-2020-10809 
An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress() located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T17:42:35.000Z
CVE-2020-10810 
An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T17:42:26.000Z
CVE-2020-10811 
An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5Olayout.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T17:42:17.000Z
CVE-2020-10812 
An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T17:42:04.000Z
CVE-2020-10813 
A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T12:37:10.000Z
CVE-2020-10814 
A buffer overflow vulnerability in Code::Blocks 17.12 allows an attacker to execute arbitrary code via a crafted project file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:14:08.000Z
CVE-2020-10816 
Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-08T16:50:02.000Z
CVE-2020-10817 
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T18:19:48.000Z
CVE-2020-10818 
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T19:53:36.000Z
CVE-2020-10819 
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T19:53:28.000Z
CVE-2020-10820 
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T19:53:20.000Z
CVE-2020-10821 
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-22T19:53:12.000Z
CVE-2020-10823 
A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T16:04:38.000Z
CVE-2020-10824 
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T16:04:44.000Z
CVE-2020-10825 
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T16:04:57.000Z
CVE-2020-10826 
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T16:05:03.000Z
CVE-2020-10827 
A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T16:05:12.000Z
CVE-2020-10828 
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T16:05:21.000Z
CVE-2020-10829 
An issue was discovered on Samsung mobile devices with O(8.0), P(9.0), and Q(10.0) (Broadcom chipsets) software. A kernel driver heap overflow leads to arbitrary code execution. The Samsung ID is SVE-2019-15880 (March 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:01:53.000Z
CVE-2020-10830 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can view notifications by entering many PINs in Lockdown mode. The Samsung ID is SVE-2019-16590 (March 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:03:33.000Z
CVE-2020-10831 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can trigger an update to arbitrary touch-screen firmware. The Samsung ID is SVE-2019-16013 (March 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:05:17.000Z
CVE-2020-10832 
An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. Kernel Wi-Fi drivers allow out-of-bounds Read or Write operations (e.g., a buffer overflow). The Samsung IDs are SVE-2019-16125, SVE-2019-16134, SVE-2019-16158, SVE-2019-16159, SVE-2019-16319, SVE-2019-16320, SVE-2019-16337, SVE-2019-16464, SVE-2019-16465, SVE-2019-16467 (March 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:12:41.000Z
CVE-2020-10833 
An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The Samsung ID is SVE-2019-16532 (March 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:14:09.000Z
CVE-2020-10834 
An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can view notifications on the lock screen via Routines. The Samsung ID is SVE-2019-15074 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:15:25.000Z
CVE-2020-10835 
An issue was discovered on Samsung mobile devices with any (before February 2020 for Exynos modem chipsets) software. There is a buffer overflow in baseband CP message decoding. The Samsung IDs are SVE-2019-15816 and SVE-2019-15817 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:17:19.000Z
CVE-2020-10836 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The Widevine Trustlet allows read and write operations on arbitrary memory locations. The Samsung ID is SVE-2019-15873 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:18:28.000Z
CVE-2020-10837 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet allows a stack overflow and arbitrary code execution. The Samsung ID is SVE-2019-15984 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:19:51.000Z
CVE-2020-10838 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. PROCA allows a use-after-free and arbitrary code execution. The Samsung ID is SVE-2019-16132 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:20:45.000Z
CVE-2020-10839 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via a SIM card. The Samsung ID is SVE-2019-16193 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:21:51.000Z
CVE-2020-10840 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software. There is a kernel pointer leak in the vipx driver. The Samsung ID is SVE-2019-16293 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:22:48.000Z
CVE-2020-10841 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software. There is an arbitrary kfree in the vipx and vertex drivers. The Samsung ID is SVE-2019-16294 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:24:09.000Z
CVE-2020-10842 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software. There is a heap out-of-bounds write in the tsmux driver. The Samsung ID is SVE-2019-16295 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:25:18.000Z
CVE-2020-10843 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software. There are race conditions in the hdcp2 driver. The Samsung ID is SVE-2019-16296 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:26:18.000Z
CVE-2020-10844 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.x), and Q(10.0) software. There is an out-of-bounds read vulnerability in media.audio_policy. The Samsung ID is SVE-2019-16333 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:27:36.000Z
CVE-2020-10845 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a race condition leading to a use-after-free in MTP. The Samsung ID is SVE-2019-16520 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:28:29.000Z
CVE-2020-10846 
An issue was discovered on Samsung mobile devices with P(9.x) and Q(10.x) software. Attackers can enable the OEM unlock feature on a KG-enrolled devices, leading to potentially unwanted binaries being downloaded. The Samsung ID is SVE-2019-16554 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:29:21.000Z
CVE-2020-10847 
An issue was discovered on Samsung mobile devices with P(9.0) (Galaxy S8 and Note8) software. Facial recognition can be spoofed. The Samsung ID is SVE-2019-16614 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:30:10.000Z
CVE-2020-10848 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos 9810 chipsets) software. Arbitrary memory mapping exists in TEE. The Samsung ID is SVE-2019-16665 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:31:15.000Z
CVE-2020-10849 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885, Exynos8895, and Exynos9810 chipsets) software. The Gatekeeper trustlet allows a brute-force attack on the screen lock password. The Samsung ID is SVE-2019-14575 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:32:38.000Z
CVE-2020-10850 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The secure bootloade has a buffer overflow of the USB buffer, leading to arbitrary code execution. The Samsung ID is SVE-2019-15872 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:33:43.000Z
CVE-2020-10851 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. There is a stack overflow in the kperfmon driver. The Samsung ID is SVE-2019-15876 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:34:30.000Z
CVE-2020-10852 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a stack overflow in display driver. The Samsung ID is SVE-2019-15877 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:35:12.000Z
CVE-2020-10853 
An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery leaks cached data. The Samsung IDs are SVE-2019-16010, SVE-2019-16011, SVE-2019-16012 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:36:09.000Z
CVE-2020-10854 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Kernel stack addresses are leaked to userspace. The Samsung ID is SVE-2019-16161 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:37:02.000Z
CVE-2020-10855 
An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via AppTray. The Samsung ID is SVE-2019-16192 (January 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T17:37:50.000Z
CVE-2020-10857 
Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T19:16:26.000Z
CVE-2020-10858 
Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T19:14:23.000Z
CVE-2020-10859 
Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T20:16:42.000Z