rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-24314 
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T12:59:49.000Z
CVE-2020-24315 
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T13:04:48.000Z
CVE-2020-24316 
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T13:09:23.000Z
CVE-2020-24327 
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-23T17:48:51.000Z
CVE-2020-24330 
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T16:19:09.000Z
CVE-2020-24331 
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T16:19:02.000Z
CVE-2020-24332 
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T16:18:52.000Z
CVE-2020-24333 
A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-22T14:50:02.000Z
CVE-2020-24334 
The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses specified in the DNS packet header corresponds to the response data available in the DNS packet, leading to an out-of-bounds read and Denial-of-Service in resolv.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:42:04.000Z
CVE-2020-24335 
An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-02T06:13:37.000Z
CVE-2020-24336 
An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. This bug can be exploited whenever NAT64 is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:43:01.000Z
CVE-2020-24337 
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming TCP packet, it is possible to cause a Denial-of-Service by achieving an infinite loop in the code that parses TCP options, aka tcp_parse_options() in pico_tcp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:44:00.000Z
CVE-2020-24338 
An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pico_dns_common.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writes that lead to Denial-of-Service and Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:45:04.000Z
CVE-2020-24339 
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pico_dns_common.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds reads that lead to Denial-of-Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:53:55.000Z
CVE-2020-24340 
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_handle_data_as_answers_generic() in pico_mdns.c does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the packet, leading to an out-of-bounds read, invalid pointer dereference, and Denial-of-Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:54:39.000Z
CVE-2020-24341 
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:55:33.000Z
CVE-2020-24342 
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:54:20.000Z
CVE-2020-24343 
Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:54:08.000Z
CVE-2020-24344 
JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:53:53.000Z
CVE-2020-24345 
JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the vendor states that the problem is the lack of the --stack-limit option
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:53:32.000Z
CVE-2020-24346 
njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:52:15.000Z
CVE-2020-24347 
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:52:07.000Z
CVE-2020-24348 
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:52:00.000Z
CVE-2020-24349 
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T18:51:50.000Z
CVE-2020-24352 
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T05:05:13.000Z
CVE-2020-24353 
Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-09T13:41:31.000Z
CVE-2020-24354 
Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T17:38:42.000Z
CVE-2020-24355 
Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T11:15:09.000Z
CVE-2020-24356 Local Privilege Escalation in cloudflared
`cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` searches for configuration files which could be abused by a malicious entity to execute commands as a privileged user. Version 2020.8.1 fixes this issue.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Cloudflare
product: cloudflared
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
version: 3.1
Published: 2020-10-02T14:16:23.809Z
CVE-2020-24359 
HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-20T16:20:20.000Z
CVE-2020-24360 
An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. The affected Arista EOS versions are: 4.24.2.4F and below releases in the 4.24.x train; 4.23.4M and below releases in the 4.23.x train; 4.22.6M and below releases in the 4.22.x train.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T18:08:57.000Z
CVE-2020-24361 
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-16T03:31:59.000Z
CVE-2020-24363 
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T15:49:15.000Z
CVE-2020-24364 
MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-24T18:35:53.000Z
CVE-2020-24365 
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed as the root user (uid 0). (Even if a login is required, most routers are left with default credentials.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T14:17:54.000Z
CVE-2020-24366 
Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T14:56:09.000Z
CVE-2020-24367 
Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that is later executed by a higher-privileged user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T20:43:28.000Z
CVE-2020-24368 
Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T14:25:07.000Z
CVE-2020-24369 
ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-17T16:06:42.000Z
CVE-2020-24370 
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-17T00:00:00.000Z
CVE-2020-24371 
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-17T16:06:14.000Z
CVE-2020-24372 
LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-17T16:05:57.000Z
CVE-2020-24373 
A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T20:00:17.000Z
CVE-2020-24374 
A DNS rebinding vulnerability in Freebox v5 before 1.5.29.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T20:00:13.000Z
CVE-2020-24375 
A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T18:08:03.000Z
CVE-2020-24376 
A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T20:00:25.000Z
CVE-2020-24377 
A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T20:00:29.000Z
CVE-2020-24379 
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T18:10:23.000Z
CVE-2020-24381 
GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T11:50:17.000Z
CVE-2020-24383 
An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check for proper '\0' termination of the resource record name string, leading to an out-of-bounds read, and potentially causing information leak or Denial-or-Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T22:56:22.000Z
CVE-2020-24384 
A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems. ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x are affected. aGalaxy versions 3.0.x, 3.2.x, and 5.0.x are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T13:46:34.000Z
CVE-2020-24385 
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td->td_emuldata in sys/compat/linux/linux_emul.h is not getting initialized and returns NULL from em_find().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:35:36.000Z
CVE-2020-24386 
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T16:25:43.000Z
CVE-2020-24387 
An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T19:39:23.000Z
CVE-2020-24388 
An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded length field of a message received from the device. This could lead to an oversized memcpy() call that will crash the running process. This could be used by an attacker to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T19:41:33.000Z
CVE-2020-24390 
eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-27T15:24:25.000Z
CVE-2020-24391 
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T20:52:58.000Z
CVE-2020-24392 
In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T22:42:17.000Z
CVE-2020-24393 
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T22:44:56.000Z
CVE-2020-24394 
In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T00:00:00.000Z
CVE-2020-24395 
The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T13:24:53.000Z
CVE-2020-24396 
homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T13:20:51.000Z
CVE-2020-24397 
An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T19:06:42.000Z
CVE-2020-24400 SQL injection allows arbitrary read from database
Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected products: vendor: Adobe
product: Magento Commerce
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2020-11-09T00:39:01.550Z
CVE-2020-24401 Incorrect permissions following the deletion of a user role or deactivation of a user
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization (CWE-863)
Affected products: vendor: Adobe
product: Magento Commerce
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2020-11-09T00:39:29.549Z