rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-5765 
Nessus 8.10.0 and earlier were found to contain a Stored XSS vulnerability due to improper validation of input during scan configuration. An authenticated, remote attacker could potentially exploit this vulnerability to execute arbitrary code in a user's session. Tenable has implemented additional input validation mechanisms to correct this issue in Nessus 8.11.0.
Problem types: description: Stored XSS
Affected products: vendor: n/a
product: Tenable Nessus
Published: 2020-07-15T12:18:30.000Z
CVE-2020-5766 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: SRS Simple Hits Counter Plugin for WordPress
Published: 2020-07-13T14:20:33.000Z
CVE-2020-5767 
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.
Problem types: description: Cross-site Request Forgery
Affected products: vendor: n/a
product: Icegram Email Subscribers & Newsletters Plugin for WordPress
Published: 2020-07-17T21:22:59.000Z
CVE-2020-5768 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: Icegram Email Subscribers & Newsletters Plugin for WordPress
Published: 2020-07-17T21:22:53.000Z
CVE-2020-5769 
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by injecting malicious client-side code into the 'URL/ Host / Connection' form in the 'DATA TO SERVER' configuration section.
Problem types: description: Authenticated Stored Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-07-17T21:23:06.000Z
CVE-2020-5770 
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
Problem types: description: Cross-site Request Forgery
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-08-03T19:57:28.000Z
CVE-2020-5771 
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
Problem types: description: Inadequate Validation of Backup Archive Files
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-08-03T19:58:42.000Z
CVE-2020-5772 
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.
Problem types: description: Inadequate Validation of Package Files
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-08-03T19:53:01.000Z
CVE-2020-5773 
Improper Access Control in Teltonika firmware TRB2_R_00.02.04.01 allows a low privileged user to perform unauthorized write operations.
Problem types: description: Improper User Access Control
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-08-03T19:55:40.000Z
CVE-2020-5774 
Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session.
Problem types: description: Insufficient Session Expiration
Affected products: vendor: n/a
product: Tenable Nessus
Published: 2020-08-21T12:23:40.000Z
CVE-2020-5775 
Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: n/a
product: Instructure Canvas Learning Management System (LMS)
Published: 2020-08-21T17:36:56.000Z
CVE-2020-5776 
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
Problem types: description: Cross-site Request Forgery (CSRF)
Affected products: vendor: n/a
product: MAGMI
Published: 2020-09-01T20:34:52.000Z
CVE-2020-5777 
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication.
Problem types: description: Remote Authentication Bypass.
Affected products: vendor: n/a
product: MAGMI
Published: 2020-09-01T20:34:44.000Z
CVE-2020-5778 
A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type 8 message sent to default TCP RequestPort 10200. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to terminate ttmd.exe.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Trading Technologies Messaging
Published: 2020-09-02T19:21:19.000Z
CVE-2020-5779 
A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy_s() with an invalid parameter (i.e., a long src string parameter) as a part of processing a type 4 message sent to default TCP RequestPort 10200. It's been observed that ttmd.exe terminates as a result.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Trading Technologies Messaging
Published: 2020-09-02T19:21:29.000Z
CVE-2020-5780 
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
Problem types: description: Unauthenticated email forgery/spoofing in WordPress Email Subscribers plugin
Affected products: vendor: n/a
product: Icegram Email Subscribers & Newsletters Plugin for WordPress
Published: 2020-09-10T14:10:03.000Z
CVE-2020-5781 
In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: IgniteNet HeliOS GLinq
Published: 2020-09-23T15:33:52.000Z
CVE-2020-5782 
In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wan_type’ parameter, the wan interface for the device will become unreachable, which results in a denial of service condition for devices dependent on this connection.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: IgniteNet HeliOS GLinq
Published: 2020-09-23T15:33:45.000Z
CVE-2020-5783 
In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: IgniteNet HeliOS GLinq
Published: 2020-09-23T15:33:39.000Z
CVE-2020-5784 
Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-10-01T19:36:33.000Z
CVE-2020-5785 
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter.
Problem types: description: Reflected Cross-site Scripting
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-10-01T19:43:32.000Z
CVE-2020-5786 
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
Problem types: description: Cross-site Request Forgery
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-10-01T19:41:22.000Z
CVE-2020-5787 
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/services/packages/remove action.
Problem types: description: Directory traversal / arbitrary file delete
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-10-01T19:45:15.000Z
CVE-2020-5788 
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/system/admin/certificates/delete action.
Problem types: description: Directory traversal / arbitrary file delete
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-10-01T19:47:10.000Z
CVE-2020-5789 
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to read the contents of arbitrary files on disk.
Problem types: description: Directory traversal / arbitrary file read
Affected products: vendor: n/a
product: Teltonika Gateway TRB245
Published: 2020-10-01T19:39:43.000Z
CVE-2020-5790 
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
Problem types: description: Cross-site Request Forgery
Affected products: vendor: n/a
product: Nagios XI
Published: 2020-10-20T21:20:21.000Z
CVE-2020-5791 
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
Problem types: description: Authenticated OS Command Injection
Affected products: vendor: n/a
product: Nagios XI
Published: 2020-10-20T21:22:00.000Z
CVE-2020-5792 
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.
Problem types: description: Authenticated OS Command Argument Injection
Affected products: vendor: n/a
product: Nagios XI
Published: 2020-10-20T21:18:30.000Z
CVE-2020-5793 
A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.
Problem types: description: Local Privilege Escalation
Affected products: vendor: n/a
product: Tenable Nessus for Windows and Tenable Nessus Agent for Windows
Published: 2020-11-05T19:11:24.000Z
CVE-2020-5794 
A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.
Problem types: description: Local Privilege Escalation
Affected products: vendor: n/a
product: Nessus Network Monitor
Published: 2020-11-06T16:12:53.000Z
CVE-2020-5795 
UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router.
Problem types: description: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: n/a
product: TP-Link Archer A7 v5
Published: 2020-11-06T14:09:38.000Z
CVE-2020-5796 
Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges.
Problem types: description: Local Privilege Escalation
Affected products: vendor: n/a
product: Nagios XI
Published: 2020-11-13T19:55:44.000Z
CVE-2020-5797 
UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router.
Problem types: description: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: n/a
product: TP-Link Archer C9 A1
Published: 2020-11-21T05:32:37.000Z
CVE-2020-5798 
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Druva inSync macOS Client Installers for v6.8.0 and prior
Published: 2020-12-07T12:44:31.000Z
CVE-2020-5799 
The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restricted functionality and to other users' data.
Problem types: description: Backdoor Account
Affected products: vendor: n/a
product: Eat Spray Love
Published: 2020-12-07T12:40:16.000Z
CVE-2020-5800 
The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they would not normally have access to.
Problem types: description: Insufficient Access Controls
Affected products: vendor: n/a
product: Eat Spray Love
Published: 2020-12-07T12:40:30.000Z
CVE-2020-5801 
An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr.dll, resulting in process termination. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are affected.
Problem types: description: Unauthenticated Remote DoS
Affected products: vendor: n/a
product: Rockwell FactoryTalk Linx
Published: 2020-12-29T15:15:32.000Z
CVE-2020-5802 
An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TCP port 4241. This will cause an unhandled exception, resulting in termination of RSLinxNG.exe. Observed in FactoryTalk 6.11. All versions of FactoryTalk Linx are affected.
Problem types: description: Unauthenticated Remote Denial of Service
Affected products: vendor: n/a
product: Rockwell FactoryTalk Linx
Published: 2020-12-29T15:04:26.000Z
CVE-2020-5803 
Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root.
Problem types: description: Path traversal
Affected products: vendor: n/a
product: Marvell QConvergeConsole GUI
Published: 2020-12-18T20:52:50.000Z
CVE-2020-5804 
Marvell QConvergeConsole GUI <= 5.5.0.74 is affected by a path traversal vulnerability. The deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied path prior to using it in file deletion operations. An authenticated, remote attacker can leverage this vulnerability to delete arbitrary remote files as SYSTEM or root.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: Marvell QConvergeConsole GUI
Published: 2021-01-08T15:12:54.000Z
CVE-2020-5805 
In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC.
Problem types: description: Cleartext Storage of Sensitive Information
Affected products: vendor: n/a
product: Marvell QConvergeConsole GUI
Published: 2021-01-08T15:13:11.000Z
CVE-2020-5806 
An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are affected.
Problem types: description: Local Denial of Service
Affected products: vendor: n/a
product: Rockwell FactoryTalk Linx
Published: 2020-12-29T15:08:36.000Z
CVE-2020-5807 
An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attacker can specify long fields in the log entry, which can cause an unhandled exception in wcscpy_s() if a local user opens FactoryTalk Diagnostics Viewer (FTDiagViewer.exe) to view the log entry. Observed in FactoryTalk Diagnostics 6.11. All versions of FactoryTalk Diagnostics are affected.
Problem types: description: Unauthenticated Remote Denial of Service
Affected products: vendor: n/a
product: Rockwell FactoryTalk Diagnostics
Published: 2020-12-29T15:18:35.000Z
CVE-2020-5808 
In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: Tenable.sc
Published: 2020-12-21T17:45:49.000Z
CVE-2020-5809 
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.
Problem types: description: Stored Cross-Site Scripting
Affected products: vendor: n/a
product: Umbraco CMS
Published: 2020-12-30T15:18:06.000Z
CVE-2020-5810 
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.
Problem types: description: Stored Cross-Site Scripting
Affected products: vendor: n/a
product: Umbraco CMS
Published: 2020-12-30T15:18:02.000Z
CVE-2020-5811 
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: Umbraco CMS
Published: 2020-12-30T15:17:57.000Z
CVE-2020-5812 
Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.
Problem types: description: Improper Certificate Validation
Affected products: vendor: n/a
product: Tenable Nessus AMI
Published: 2021-02-05T23:44:56.000Z
CVE-2020-5820 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:01:32.000Z
CVE-2020-5821 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a DLL injection vulnerability, which is a type of issue whereby an individual attempts to execute their own code in place of legitimate code as a means to perform an exploit.
Problem types: description: DLL Injection
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:02:07.000Z
CVE-2020-5822 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:04:33.000Z
CVE-2020-5823 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:04:40.000Z
CVE-2020-5824 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a denial of service vulnerability, which is a type of issue whereby a threat actor attempts to tie up the resources of a resident application, thereby making certain functions unavailable.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:07:04.000Z
CVE-2020-5825 
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to an arbitrary file write vulnerability, which is a type of issue whereby an attacker is able to overwrite existing files on the resident system without proper privileges.
Problem types: description: Arbitrary File Write
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2020-02-11T17:07:31.000Z