rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-23931 
An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T17:41:07.000Z
CVE-2020-23932 
An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located in filedump.c. It allows an attacker to cause Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T17:41:07.000Z
CVE-2020-23934 
An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager" section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-18T21:01:58.000Z
CVE-2020-23935 
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T14:09:20.000Z
CVE-2020-23936 
PHPGurukul Vehicle Parking Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T14:01:37.000Z
CVE-2020-23945 
A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-27T14:12:52.000Z
CVE-2020-23957 
Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T20:31:17.000Z
CVE-2020-23960 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T15:54:01.000Z
CVE-2020-23962 
A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "announcement_gonggao" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-23T18:06:07.000Z
CVE-2020-23966 
SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2020-23967 
Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYSTEM due to insufficient control during autoupdate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-08T14:34:09.000Z
CVE-2020-23968 
Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\Logs\000-sngWSService1.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T19:44:02.000Z
CVE-2020-23971 
gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload function without authenticating to the application and also can upload files due the issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T15:05:13.000Z
CVE-2020-23972 
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:03:45.000Z
CVE-2020-23973 
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:21:35.000Z
CVE-2020-23974 
Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:42:00.000Z
CVE-2020-23975 
Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:45:33.000Z
CVE-2020-23976 
Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:48:16.000Z
CVE-2020-23977 
KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:52:47.000Z
CVE-2020-23978 
SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php"
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T13:59:43.000Z
CVE-2020-23979 
13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T14:02:21.000Z
CVE-2020-23980 
DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T12:45:50.000Z
CVE-2020-23981 
13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T14:04:06.000Z
CVE-2020-23982 
DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T14:07:46.000Z
CVE-2020-23983 
Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T14:35:30.000Z
CVE-2020-23984 
Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T14:31:52.000Z
CVE-2020-23986 
Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-05T23:37:44.000Z
CVE-2020-23989 
NeDi 1.9C allows pwsec.php oid XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-02T21:49:25.000Z
CVE-2020-23992 
Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-23995 
An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-13T19:49:35.000Z
CVE-2020-23996 
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-13T19:49:54.000Z
CVE-2020-24000 
SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T16:08:21.000Z
CVE-2020-24003 
Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Skype Client's microphone and camera access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T15:26:26.000Z
CVE-2020-24007 
Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T13:51:20.000Z
CVE-2020-24008 
Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T13:37:04.000Z
CVE-2020-24020 
Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to memcpy without length checks, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T14:36:15.000Z
CVE-2020-24025 
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T18:14:41.000Z
CVE-2020-24026 
TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. TinyShop allows XSS via the explain_first and again_explain parameters of the /evaluate/index.php page. The vulnerability may be exploited remotely, resulting in cross-site scripting (XSS) or information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T14:23:38.000Z
CVE-2020-24027 
In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T19:41:52.000Z
CVE-2020-24028 
ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. NOTE: as of 2025-10-14, the Supplier's perspective is that this "does not allow administrative privilege gain. Authorization is enforced server-side, restricting actions to the user’s own permission scope."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:14:18.000Z
CVE-2020-24029 
Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated against registered user emails and require a valid, short-lived token."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:09:41.000Z
CVE-2020-24030 
ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "not exploitable in the current implementation. Tokens are properly expired, invalidated, and bound to session context. Attempts to alter the token payload to extend its validity do not affect server-side validation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:08:48.000Z
CVE-2020-24032 
tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-18T20:15:45.000Z
CVE-2020-24033 
An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with escalated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T13:53:41.000Z
CVE-2020-24034 
Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sess_id, nonce, and ha1 values inside of the serialized session cookie, an attacker may alter the user value inside of this cookie, and assume the role and permissions of the user specified. By assuming the role of the user internal, which is inaccessible to end users by default, the attacker gains the permissions of the internal account, which includes the ability to flash custom firmware to the router, allowing the attacker to achieve a complete compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T17:20:23.000Z
CVE-2020-24036 
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-04T12:28:05.000Z
CVE-2020-24038 
myFax version 229 logs sensitive information in the export log module which allows any user to access critical information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:32:27.000Z
CVE-2020-24045 
A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. The restricted shell can be bypassed by presenting a fake vmware-tools ISO image to the guest virtual machine running SpamTitan Gateway. This ISO image should contain a valid Perl script at the vmware-freebsd-tools/vmware-tools-distrib/vmware-install.pl path. The fake ISO image will be mounted and the script wmware-install.pl will be executed with super-user privileges as soon as the hidden option to install VMware Tools is selected in the main menu of the restricted shell (option number 5). The contents of the script can be whatever the attacker wants, including a backdoor or similar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T16:37:18.000Z
CVE-2020-24046 
A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating system file /etc/passwd. This file cannot be accessed though the restricted shell, but it can be modified by abusing the Backup/Import Backup functionality of the web interface. An authenticated attacker would be able to obtain the file /var/tmp/admin.passwd after executing a Backup operation. This file can be manually modified to change the GUID of the user to 0 (root) and change the restricted shell to a normal shell /bin/sh. After the modification is done, the file can be recompressed to a .tar.bz file and imported again via the Import Backup functionality. The properties of the admin user will be overwritten and a root shell will be granted to the user upon the next successful login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T16:39:31.000Z
CVE-2020-24051 
The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issue to execute privileged operations without authentication, for instance, to create a new Administrator user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:23:54.000Z
CVE-2020-24052 
Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition (DTD) in an XML request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:25:50.000Z
CVE-2020-24053 
Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:27:05.000Z
CVE-2020-24054 
The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments; however, this can be circumvented using special shell variables, such as '${IFS}'. As a result, an attacker can execute arbitrary commands as 'root' on the units.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:28:06.000Z
CVE-2020-24055 
Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service implemented in the binary executable '/usr/sbin/DM' that listens on port TCP 6666. The service is vulnerable to a stack buffer overflow. It is worth noting that this service does not require any authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:29:22.000Z
CVE-2020-24056 
A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD Verint_FW_0_42units. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:30:26.000Z
CVE-2020-24057 
The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on the unit. This endpoint is vulnerable to a command injection. An authenticated attacker can leverage this issue to execute arbitrary commands as 'root'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T14:31:41.000Z
CVE-2020-24061 
Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-12T00:00:00.000Z
CVE-2020-24063 
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T20:05:08.000Z
CVE-2020-24074 
The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T14:02:15.000Z
CVE-2020-24075 
Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-24085 
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T20:20:25.000Z
CVE-2020-24088 
An issue was discovered in MmMapIoSpace routine in Foxconn Live Update Utility 2.1.6.26, allows local attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2020-24089 
An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-19T00:00:00.000Z
CVE-2020-24102 
Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2020-24104 
XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wireless.htm SET2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-30T21:31:56.000Z
CVE-2020-24113 
Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-24115 
In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T13:32:02.000Z
CVE-2020-24119 
A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T20:32:49.000Z
CVE-2020-24130 
A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-20T19:27:28.000Z
CVE-2020-24133 
A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or carry out denial of service (DOS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-14T21:18:39.000Z