rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-24581 
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable via the web user interface) that lets an authenticated user execute Operating System commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-22T18:05:02.000Z
CVE-2020-24582 
Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-10T16:11:44.000Z
CVE-2020-24583 
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T12:33:13.000Z
CVE-2020-24584 
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-01T12:36:06.000Z
CVE-2020-24585 
An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T13:04:34.000Z
CVE-2020-24586 
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T00:00:00.000Z
CVE-2020-24587 
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T00:00:00.000Z
CVE-2020-24588 
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T00:00:00.000Z
CVE-2020-24589 
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-08-21T19:06:07.000Z
CVE-2020-24590 
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-08-21T19:05:31.000Z
CVE-2020-24591 
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:N/PR:H/S:U/UI:N
version: 3.1
Published: 2020-08-21T19:05:53.000Z
CVE-2020-24592 
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:44:33.000Z
CVE-2020-24593 
Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:46:46.000Z
CVE-2020-24594 
Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:47:16.000Z
CVE-2020-24595 
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due to insufficient access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:47:42.000Z
CVE-2020-24598 
An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T21:27:02.000Z
CVE-2020-24599 
An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T21:25:09.000Z
CVE-2020-24600 
Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capexweb.cap_sendMail GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2020-24601 
In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T14:41:40.000Z
CVE-2020-24602 
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in the Server Properties and Security Audit Viewer JSP page
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T14:37:26.000Z
CVE-2020-24604 
A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in server-properties.jsp and security-audit-viewer.jsp
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T14:40:05.000Z
CVE-2020-24606 
Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N
version: 3.1
Published: 2020-08-24T17:06:24.000Z
CVE-2020-24609 
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie via crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T14:35:33.000Z
CVE-2020-24612 
An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2020-08-24T20:46:16.000Z
CVE-2020-24613 
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-24T21:06:22.000Z
CVE-2020-24614 
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T13:36:43.000Z
CVE-2020-24615 
Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:38:02.000Z
CVE-2020-24616 
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T17:04:08.000Z
CVE-2020-24617 
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T22:48:01.000Z
CVE-2020-24618 
In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without appropriate access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T19:48:08.000Z
CVE-2020-24619 
In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-22T11:51:44.000Z
CVE-2020-24620 
Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager can potentially reveal credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-01T16:25:48.000Z
CVE-2020-24621 
A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:40:21.000Z
CVE-2020-24622 
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-25T18:17:49.000Z
CVE-2020-24623 
A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V (VHD).
Problem types: description: remote sql injection
Affected products: vendor: n/a
product: HPE Universal API Framework for VMware ESXi (OVA) in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V (VHD)
Published: 2020-09-18T16:11:44.000Z
CVE-2020-24624 
Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.
Problem types: description: Directory traversal information disclosure vulnerability
Affected products: vendor: n/a
product: HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
Published: 2020-09-23T12:41:00.000Z
CVE-2020-24625 
Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.
Problem types: description: Directory traversal information disclosure vulnerability
Affected products: vendor: n/a
product: HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
Published: 2020-09-23T12:41:13.000Z
CVE-2020-24626 
Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.
Problem types: description: Directory traversal remote code execution
Affected products: vendor: n/a
product: HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
Published: 2020-09-23T12:41:19.000Z
CVE-2020-24627 
A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.
Problem types: description: remote stored xss
Affected products: vendor: n/a
product: HPE KVM IP Console Switches
Published: 2020-10-02T18:50:15.000Z
CVE-2020-24628 
A remote code injection vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.
Problem types: description: remote code injection
Affected products: vendor: n/a
product: HPE KVM IP Console Switches
Published: 2020-10-02T18:50:37.000Z
CVE-2020-24629 
A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: remote  urlaccesscontroller authentication bypass vulnerability
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:33:48.000Z
CVE-2020-24630 
A remote operatoronlinelist_content privilege escalation vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: remote  operatoronlinelist_content privilege escalation vulnerability
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:34:06.000Z
CVE-2020-24631 
A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote execution of arbitrary commands
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-10-26T15:22:32.000Z
CVE-2020-24632 
A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
Problem types: description: remote execution of arbitrary commandss
Affected products: vendor: n/a
product: Aruba Airwave Software
Published: 2020-10-26T15:23:01.000Z
CVE-2020-24633 
There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
Problem types: description: remote buffer overflow
Affected products: vendor: n/a
product: Aruba 9000 Gateway
vendor: n/a
product: Aruba 7000 Series Mobility Controllers
vendor: n/a
product: Aruba 7200 Series Mobility Controllers
Published: 2020-12-11T01:26:14.000Z
CVE-2020-24634 
An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
Problem types: description: remote injection of arbitrary commands
Affected products: vendor: n/a
product: Aruba 9000 Gateway
vendor: n/a
product: Aruba 7000 Series Mobility Controllers
vendor: n/a
product: Aruba 7200 Series Mobility Controllers
Published: 2020-12-11T01:22:50.000Z
CVE-2020-24635 
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
Problem types: description: remote execution of arbitrary commands
Affected products: vendor: n/a
product: Aruba Instant Access Points
Published: 2021-03-29T19:05:06.000Z
CVE-2020-24636 
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
Problem types: description: remote execution of arbitrary commands
Affected products: vendor: n/a
product: Aruba Instant Access Points
Published: 2021-03-29T19:08:15.000Z
CVE-2020-24637 
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
Problem types: description: remote buffer overflow
Affected products: vendor: n/a
product: Aruba 9000 Gateway
vendor: n/a
product: Aruba 7000 Series Mobility Controllers
vendor: n/a
product: Aruba 7200 Series Mobility Controllers
Published: 2020-12-11T01:33:22.000Z
CVE-2020-24638 
Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. These allow for a user with glassadmin privileges to execute arbitrary code as root on the underlying host operating system.
Problem types: description: Multiple Authenticated Command Injections via glassadmin cli
Affected products: vendor: n/a
product: Aruba AirWave Glass Software
Published: 2021-01-15T18:29:17.000Z
CVE-2020-24639 
There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system.
Problem types: description: Unauthenticated Arbitrary Code Execution in Web Administrative Interface
Affected products: vendor: n/a
product: Aruba AirWave Glass Software
Published: 2021-01-15T18:33:41.000Z
CVE-2020-24640 
There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system.
Problem types: description: Unauthenticated Arbitrary Command Execution in Web Administrative Interface
Affected products: vendor: n/a
product: Aruba AirWave Glass Software
Published: 2021-01-15T18:48:35.000Z
CVE-2020-24641 
In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.
Problem types: description: Remote Authentication Bypass via Unauthenticated Server-Side Request Forgery
Affected products: vendor: n/a
product: Aruba AirWave Glass Software
Published: 2021-01-15T18:26:04.000Z
CVE-2020-24646 
A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: tftpserver stack-based buffer overflow remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:34:23.000Z
CVE-2020-24647 
A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Problem types: description: remote accessmgrservlet classname input validation code execution vulnerability
Affected products: vendor: n/a
product: HPE Intelligent Management Center (iMC)
Published: 2020-10-19T17:34:37.000Z