rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15384 
Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header.
Problem types: description: information disclosure vulnerability
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T15:42:52.000Z
CVE-2020-15385 
Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission.
Problem types: description: information disclosure vulnerability
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T15:42:57.000Z
CVE-2020-15386 
Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower response to CLI commands and other operations.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2021-06-09T15:43:02.000Z
CVE-2020-15387 
The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.
Problem types: description: information disclosure vulnerability
Affected products: vendor: n/a
product: Brocade SANnav & Brocade Fabric OS
Published: 2021-06-09T15:24:45.000Z
CVE-2020-15388 
A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the history command to write arbitrary content to files.
Problem types: description: Improper Limitation of a Pathname to a Restricted Directory
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-03-18T17:59:10.000Z
CVE-2020-15389 
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T20:30:15.000Z
CVE-2020-15390 
pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T18:18:20.000Z
CVE-2020-15391 
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T19:45:02.000Z
CVE-2020-15392 
A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-07T13:58:47.000Z
CVE-2020-15393 
In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T21:58:55.000Z
CVE-2020-15394 
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T06:11:41.000Z
CVE-2020-15395 
In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T10:25:46.000Z
CVE-2020-15396 
In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T11:17:21.000Z
CVE-2020-15397 
HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T11:17:37.000Z
CVE-2020-15400 
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T11:42:19.000Z
CVE-2020-15401 
IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junction and an Object Manager symbolic link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T11:50:09.000Z
CVE-2020-15408 
An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:R
version: 3.1
Published: 2020-07-28T14:59:21.000Z
CVE-2020-15411 
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T13:15:20.000Z
CVE-2020-15412 
An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T13:15:40.000Z
CVE-2020-15415 
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T13:37:56.000Z
CVE-2020-15416 
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: NETGEAR
product: R6700
Credits: lang: en
value: d4rkn3ss from VNPT ISC
Published: 2020-07-28T17:10:39.000Z
CVE-2020-15417 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted gui_region in a string table file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9756.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: NETGEAR
product: R6700
Credits: lang: en
value: d4rkn3ss from VNPT ISC
Published: 2020-07-28T17:10:39.000Z
CVE-2020-15418 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Veeam
product: ONE
Credits: lang: en
value: rgod
Published: 2020-07-28T17:10:17.000Z
CVE-2020-15419 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Veeam
product: ONE
Credits: lang: en
value: rgod
Published: 2020-07-28T17:10:18.000Z
CVE-2020-15420 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loader_ajax.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9259.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:06.000Z
CVE-2020-15421 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the check_ip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9707.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:06.000Z
CVE-2020-15422 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9731.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:07.000Z
CVE-2020-15423 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the dominio parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9732.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:07.000Z
CVE-2020-15424 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9735.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:08.000Z
CVE-2020-15425 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9742.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:08.000Z
CVE-2020-15426 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the serverip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9709.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:08.000Z
CVE-2020-15427 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_disk_usage.php. When parsing the folderName parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9713.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:09.000Z
CVE-2020-15428 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9714.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:09.000Z
CVE-2020-15429 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9716.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:10.000Z
CVE-2020-15430 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9736.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:10.000Z
CVE-2020-15431 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9740.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:11.000Z
CVE-2020-15432 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the filespace parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9743.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:11.000Z
CVE-2020-15433 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the phpversion parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9715.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:12.000Z
CVE-2020-15434 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the canal parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9745.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:12.000Z
CVE-2020-15435 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_start parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9719.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CentOS Web Panel
product: CentOS Web Panel
Credits: lang: en
value: @PaulosYibelo & CasperTea
Published: 2020-07-28T17:01:12.000Z
CVE-2020-15436 
Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: linux kernel
Published: 2020-11-23T20:08:17.000Z
CVE-2020-15437 
The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: n/a
product: linux kernel
Published: 2020-11-23T20:10:28.000Z
CVE-2020-15466 
In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-05T10:04:58.000Z