rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8100 Incomplete validation in detection code in Bitdefender Engines (VA-8589)
Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions prior to 7.84063.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Bitdefender
product: Bitdefender Engines
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-05-15T09:20:11.849Z
CVE-2020-8101 Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: ADT
product: LifeShield DIY HD Video Doorbell
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2021-02-02T11:10:14.062Z
CVE-2020-8102 Insufficient URL sanitization and validation in Safepay Browser (VA-8631)
Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Bitdefender
product: Bitdefender Total Security 2020
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Wladimir Palant
Published: 2020-06-22T09:35:14.496Z
CVE-2020-8103 Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)
A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Bitdefender
product: Bitdefender Antivirus Free
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ilias Dimopoulos of RedyOps Research Labs
Published: 2020-06-05T11:10:13.595Z
CVE-2020-8105 Command Execution due to unsanitized input
OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Abode
product: iota All-In-One Security Kit
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2021-12-20T13:40:10.796Z
CVE-2020-8107 Process Control vulnerability in Bitdefender Antivirus Plus
A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially crafted DLL file. This issue affects: Bitdefender Antivirus Plus versions prior to 24.0.26.136. Bitdefender Internet Security versions prior to 24.0.26.136. Bitdefender Total Security versions prior to 24.0.26.136.
Problem types: cwe_id: CWE-114
description: CWE-114 Process Control
Affected products: vendor: Bitdefender
product: Antivirus Plus
vendor: Bitdefender
product: Internet Security
vendor: Bitdefender
product: Total Security
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: 김동현 - dsu.kr
Published: 2022-02-18T08:20:11.896Z
CVE-2020-8108 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)
Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Bitdefender
product: Endpoint Security for Mac
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ricardo Ungureanu
Published: 2020-08-03T11:55:14.875Z
CVE-2020-8109 Bitdefender ace.xmd parser out-of-bounds write (VA-8772)
A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Bitdefender
product: Bitdefender Engines
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: David Lanzenberger
Published: 2020-10-01T13:05:23.197Z
CVE-2020-8110 Bitdefender ceva_emu.cvd module denial-of-service (VA-8766)
A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched from uninitialized memory. This can lead to denial-of-service. This issue affects: Bitdefender Engines version 7.84897 and prior versions.
Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: Bitdefender
product: Bitdefender Engines
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: David Lanzenberger
Published: 2020-10-02T09:55:17.917Z
CVE-2020-8112 
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T17:22:42.000Z
CVE-2020-8113 
GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T17:20:21.000Z
CVE-2020-8114 
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T14:44:19.000Z
CVE-2020-8115 
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8116 
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Problem types: cwe_id: CWE-471
description: Modification of Assumed-Immutable Data (MAID) (CWE-471)
Affected products: vendor: n/a
product: dot-prop
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8117 
Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.
Problem types: cwe_id: CWE-280
description: Improper Handling of Insufficient Permissions or Privileges (CWE-280)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8118 
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8119 
Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8120 
A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8121 
A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8122 
A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud server
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8123 
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Strapi
Published: 2020-02-04T19:08:57.000Z
CVE-2020-8124 
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: url-parse
Published: 2020-02-04T19:08:56.000Z
CVE-2020-8125 
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: klona npm module
Published: 2020-02-04T19:08:56.000Z
CVE-2020-8126 
A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allowing an operator user (Privilege-1) to escalate privileges and became administrator (Privilege-15).
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: EdgeSwitch
Published: 2020-02-07T14:56:17.000Z
CVE-2020-8127 
Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - DOM (CWE-79)
Affected products: vendor: n/a
product: reveal.js
Published: 2020-02-28T19:25:46.000Z
CVE-2020-8128 
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.
Problem types: cwe_id: CWE-829
description: Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
Affected products: vendor: n/a
product: jsreport
Published: 2020-02-14T21:30:21.000Z
CVE-2020-8129 
An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: script-manager
Published: 2020-02-14T21:28:27.000Z
CVE-2020-8130 
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Problem types: cwe_id: CWE-78
description: OS Command Injection (CWE-78)
Affected products: vendor: n/a
product: https://github.com/ruby/ruby
Published: 2020-02-24T14:41:26.000Z
CVE-2020-8131 
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: yarn
Published: 2020-02-24T14:41:23.000Z
CVE-2020-8132 
Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: pdf-image
Published: 2020-02-28T19:24:41.000Z
CVE-2020-8133 
A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file.
Problem types: cwe_id: CWE-657
description: Violation of Secure Design Principles (CWE-657)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-11-09T14:25:24.000Z
CVE-2020-8134 
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: Ghost
Published: 2020-03-20T18:26:42.000Z
CVE-2020-8135 
The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: uppy
Published: 2020-03-20T18:26:32.000Z
CVE-2020-8136 
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: fastify-multipart
Published: 2020-03-20T18:26:21.000Z
CVE-2020-8137 
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: blamer
Published: 2020-03-20T18:26:37.000Z
CVE-2020-8138 
A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-03-20T20:12:26.000Z
CVE-2020-8139 
A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-03-20T20:14:30.000Z
CVE-2020-8140 
A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-03-20T20:20:14.000Z
CVE-2020-8141 
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: dot
Published: 2020-03-15T17:04:40.000Z
CVE-2020-8142 
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was however possible for anyone with access to a Revive Adserver admin user interface to bypass such check and change e-email address or password of the currently logged in user by altering the form payload.The attack requires physical access to the user interface of a logged in user. If the POST payload was altered by turning the “pwold” parameter into an array, Revive Adserver would fetch and authorise the operation even if no password was provided.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization (CWE-863)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2020-04-03T20:52:35.000Z
CVE-2020-8143 
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2020-04-03T20:52:41.000Z
CVE-2020-8144 
The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware update information. If the version field contains ..\ character sequences, the destination file path to save the firmware can be manipulated to be outside the intended destination directory tree. Fixed in UniFi Video Controller v3.10.3 and newer.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: UniFi Video Controller (for Windows 7/8/10 x64)
Published: 2020-04-01T22:20:04.000Z
CVE-2020-8145 
The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP or CUSTOM_GROUP groups, can access these endpoints and overwrite the current application configuration. This can be abused for various purposes, including adding new administrative users. Affected Products: UniFi Video Controller v3.9.3 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.9.6 and newer.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: UniFi Video Controller (for Windows 7/8/10 x64)
Published: 2020-04-01T22:20:07.000Z
CVE-2020-8146 
In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the windows registry when installing UniFi-Video controller. Affected Products: UniFi Video Controller v3.10.2 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.10.3 and newer.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: UniFi Video Controller (for Windows 7/8/10 x64)
Published: 2020-04-01T22:21:21.000Z
CVE-2020-8147 
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.
Problem types: cwe_id: CWE-471
description: Modification of Assumed-Immutable Data (MAID) (CWE-471)
Affected products: vendor: n/a
product: utils-extend
Published: 2020-04-03T20:52:38.000Z
CVE-2020-8148 
UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: UniFi Cloud Key Gen2
Published: 2020-04-13T13:32:46.000Z
CVE-2020-8149 
Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: logkitty
Published: 2020-05-15T18:50:27.000Z