rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-36173 
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T14:32:07.000Z
CVE-2020-36174 
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T14:31:44.000Z
CVE-2020-36175 
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T14:31:54.000Z
CVE-2020-36176 
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T14:47:34.000Z
CVE-2020-36177 
RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T15:54:40.000Z
CVE-2020-36178 
oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T20:57:57.000Z
CVE-2020-36179 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:30:38.000Z
CVE-2020-36180 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:30:31.000Z
CVE-2020-36181 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:29:19.000Z
CVE-2020-36182 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:30:22.000Z
CVE-2020-36183 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:30:15.000Z
CVE-2020-36184 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:30:07.000Z
CVE-2020-36185 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:29:59.000Z
CVE-2020-36186 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:29:51.000Z
CVE-2020-36187 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:29:44.000Z
CVE-2020-36188 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:29:36.000Z
CVE-2020-36189 
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T22:29:28.000Z
CVE-2020-36190 
RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T19:38:20.000Z
CVE-2020-36191 
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T03:36:09.000Z
CVE-2020-36192 
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php page, as well as on the list.php page (a pop-up on the Affected Issues id hyperlink). Additionally, if the attacker has "Update threshold" in the plugin's configuration (set to the "updater" access level by default), then they can link any Issue to a Changeset by entering the Issue's Id, even if they do not have access to it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-18T19:05:03.000Z
CVE-2020-36193 
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-18T19:24:18.000Z
CVE-2020-36194 XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS hero
An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Jakub Korepta
Published: 2021-07-01T02:00:17.242Z
CVE-2020-36195 SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-89
description: CWE-89 SQL Injection
cwe_id: CWE-943
description: CWE-943 Improper Neutralization of Special Elements in Data Query Logic
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: Media Streaming add-on
vendor: QNAP Systems Inc.
product: Multimedia Console
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yaniv Puyeski
Published: 2021-04-17T03:50:13.274Z
CVE-2020-36196 Stored XSS Vulnerability in QuLog Center
A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: QuLog Center
Credits: lang: en
value: Jan Hoff
Published: 2021-07-01T02:00:18.925Z
CVE-2020-36197 Improper Access Control Vulnerability in Music Station
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: QNAP Systems Inc.
product: Music Station
vendor: QNAP Systems Inc.
product: Music Station
vendor: QNAP Systems Inc.
product: Music Station
vendor: QNAP Systems Inc.
product: Music Station
vendor: QNAP Systems Inc.
product: Music Station
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Trend Micro ZDI - ZDI-CAN-12048
Published: 2021-05-13T02:55:12.525Z
CVE-2020-36198 Command Injection Vulnerability in Malware Remover
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP Systems Inc. Malware Remover 3.x.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: Malware Remover
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Trend Micro ZDI - ZDI-CAN-12891
Published: 2021-05-13T02:55:13.209Z
CVE-2020-36199 
TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.
Problem types: description: Arbitrary Code execution
Affected products: vendor: n/a
product: Kaspersky TinyCheck
Published: 2021-01-21T21:20:28.000Z
CVE-2020-36200 
TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: n/a
product: Kaspersky TinyCheck
Published: 2021-01-21T21:23:00.000Z
CVE-2020-36201 
An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-21T20:39:08.000Z
CVE-2020-36202 
An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:07:50.000Z
CVE-2020-36203 
An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:07:40.000Z
CVE-2020-36204 
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:07:26.000Z
CVE-2020-36205 
An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:07:13.000Z
CVE-2020-36206 
An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:06:59.000Z
CVE-2020-36207 
An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:06:46.000Z
CVE-2020-36208 
An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:06:15.000Z
CVE-2020-36209 
An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:06:01.000Z
CVE-2020-36210 
An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:05:45.000Z
CVE-2020-36211 
An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:05:33.000Z
CVE-2020-36212 
An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:05:21.000Z
CVE-2020-36213 
An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:05:10.000Z
CVE-2020-36214 
An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:05:01.000Z
CVE-2020-36215 
An issue was discovered in the hashconsing crate before 1.1.0 for Rust. Because HConsed does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:04:49.000Z
CVE-2020-36216 
An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:04:39.000Z
CVE-2020-36217 
An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:04:27.000Z
CVE-2020-36218 
An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider (!Send|!Sync) objects, leading to a data race.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:04:13.000Z
CVE-2020-36219 
An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:04:00.000Z
CVE-2020-36220 
An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:03:48.000Z
CVE-2020-36221 
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:44:47.000Z
CVE-2020-36222 
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:44:38.000Z
CVE-2020-36223 
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:43:28.000Z
CVE-2020-36224 
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:44:29.000Z
CVE-2020-36225 
A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:44:21.000Z
CVE-2020-36226 
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:44:13.000Z
CVE-2020-36227 
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:43:37.000Z
CVE-2020-36228 
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:44:05.000Z
CVE-2020-36229 
A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:43:57.000Z
CVE-2020-36230 
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-25T09:43:47.000Z
CVE-2020-36231 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.
Problem types: description: Insecure Direct Object References (IDOR)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-02-01T23:40:12.974Z
CVE-2020-36232 
The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.
Problem types: description: Security Misconfiguration
Affected products: vendor: Atlassian
product: Atlassian Gadgets
Published: 2021-02-22T20:46:59.290Z
CVE-2020-36233 
The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
Problem types: description: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Atlassian
product: Bitbucket Server
vendor: Atlassian
product: Bitbucket Data Center
Published: 2021-02-18T15:16:22.101Z
CVE-2020-36234 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-02-15T00:00:15.314Z