rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-28062 
An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. '/ Upload/Plugins /, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T16:36:44.000Z
CVE-2020-28063 
A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-13T14:07:35.000Z
CVE-2020-28070 
SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:54:16.000Z
CVE-2020-28071 
SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the admin authentication an attacker can upload an image in the gallery using a XSS payload in the description textarea called 'about' and reach a stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:54:20.000Z
CVE-2020-28072 
A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T20:48:08.000Z
CVE-2020-28073 
SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:54:23.000Z
CVE-2020-28074 
SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication system and become an admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-23T17:54:26.000Z
CVE-2020-28086 
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T18:09:51.000Z
CVE-2020-28087 
A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T22:38:00.000Z
CVE-2020-28088 
An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T22:38:30.000Z
CVE-2020-28091 
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T16:45:02.000Z
CVE-2020-28092 
PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&status=0&id=,?g=Team&m=Task&a=my&status=1&id=,?g=Team&m=Task&a=my&status=10&id=
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T21:44:09.000Z
CVE-2020-28093 
On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T06:21:34.000Z
CVE-2020-28094 
On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed test contain links to download malware named elive or CNKI E-Learning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T06:23:45.000Z
CVE-2020-28095 
On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T20:53:45.000Z
CVE-2020-28096 
FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T06:28:56.000Z
CVE-2020-28097 
The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-24T12:00:43.000Z
CVE-2020-28102 
cscms v4.1 allows for SQL injection via the "js_del" function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-11T15:41:34.000Z
CVE-2020-28103 
cscms v4.1 allows for SQL injection via the "page_del" function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-11T15:49:49.000Z
CVE-2020-28115 
SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T14:58:48.000Z
CVE-2020-28119 
Cross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:59:40.000Z
CVE-2020-28124 
Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T17:04:48.000Z
CVE-2020-28129 
Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:15:30.000Z
CVE-2020-28130 
An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T20:17:59.000Z
CVE-2020-28133 
An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in sales_inventory/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T19:03:49.000Z
CVE-2020-28136 
An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T19:06:21.000Z
CVE-2020-28137 
Cross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously restarting the router.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-10T16:26:11.000Z
CVE-2020-28138 
SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T18:56:20.000Z
CVE-2020-28139 
SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T18:58:49.000Z
CVE-2020-28140 
SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T19:00:25.000Z
CVE-2020-28141 
The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T15:45:16.000Z
CVE-2020-28144 
Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T12:48:41.000Z
CVE-2020-28145 
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-12T10:21:39.000Z
CVE-2020-28146 
Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-18T16:41:40.000Z
CVE-2020-28149 
myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: CSRF Token. The attack vector is: CSRF token injection to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-15T17:32:41.000Z
CVE-2020-28150 
I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-09T17:53:30.000Z
CVE-2020-28163 
libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2020-28165 
The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T11:01:33.000Z
CVE-2020-28168 
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-06T19:22:38.000Z
CVE-2020-28169 
The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T14:36:09.000Z
CVE-2020-28172 
A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in college_website/admin/ajax.php?action=login, thus gaining access to the website administrative panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T12:13:34.000Z
CVE-2020-28173 
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T12:13:41.000Z
CVE-2020-28175 
There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. Attackers can use constructed programs to increase user privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-03T17:54:15.000Z
CVE-2020-28183 
SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T22:05:04.000Z
CVE-2020-28184 
Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T14:28:16.000Z
CVE-2020-28185 
User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T14:26:55.000Z
CVE-2020-28186 
Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T14:30:11.000Z
CVE-2020-28187 
Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to /include/core/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T14:31:58.000Z
CVE-2020-28188 
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T00:00:00.000Z
CVE-2020-28190 
TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-24T14:34:32.000Z
CVE-2020-28191 
The console in Togglz before 2.9.4 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2020-28194 
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T13:13:47.000Z
CVE-2020-28196 
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-06T07:07:38.000Z
CVE-2020-28198 
The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to an exploitable stack buffer overflow. Note: the vulnerability can be exploited when it is used in "interactive" mode while, cause of a max number characters limitation, it cannot be exploited in batch or command line usage (e.g. dsmadmc.exe -id=username -password=pwd). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T19:25:28.000Z
CVE-2020-28199 
best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-26T14:56:33.000Z
CVE-2020-28200 
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-06-28T12:08:46.000Z
CVE-2020-28203 
An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier. There is a null pointer access/dereference while opening a crafted PDF file, leading the application to crash (denial of service).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T12:53:05.000Z
CVE-2020-28206 
An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows brute-force attacks on the passwords of users not in the administrator group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-02T18:34:06.000Z
CVE-2020-28208 
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-08T17:26:39.000Z
CVE-2020-28209 
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location.
Problem types: cwe_id: CWE-428
description: CWE-428 Windows Unquoted Search Path
Affected products: vendor: n/a
product: EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1
Published: 2020-11-19T21:15:07.000Z
CVE-2020-28210 
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting Stored)
Affected products: vendor: n/a
product: EcoStruxure Building Operation WebStation V2.0 - V3.1
Published: 2020-11-19T21:01:31.000Z
CVE-2020-28211 
A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger.
Problem types: cwe_id: CWE-863
description: A CWE-863: Incorrect Authorization
Affected products: vendor: n/a
product: PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
Published: 2020-11-19T21:03:37.000Z
CVE-2020-28212 
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: n/a
product: PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
Published: 2020-11-19T21:03:43.000Z
CVE-2020-28213 
A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus.
Problem types: cwe_id: CWE-494
description: CWE-494: Download of Code Without Integrity Check
Affected products: vendor: n/a
product: PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
Published: 2020-11-19T21:03:54.000Z
CVE-2020-28214 
A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide.
Problem types: cwe_id: CWE-760
description: CWE-760: Use of a One-Way Hash with a Predictable Salt
Affected products: vendor: n/a
product: Modicon M221 (all references, all versions)
Published: 2020-12-11T00:51:01.000Z
CVE-2020-28215 
A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: n/a
product: Easergy T300 (firmware 2.7 and older)
Published: 2020-12-11T00:51:07.000Z
CVE-2020-28216 
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: n/a
product: Easergy T300 (firmware 2.7 and older)
Published: 2020-12-11T00:51:11.000Z
CVE-2020-28217 
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: n/a
product: Easergy T300 (firmware 2.7 and older)
Published: 2020-12-11T00:51:15.000Z