rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-11793 
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T12:40:21.000Z
CVE-2020-11795 
In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T13:52:48.000Z
CVE-2020-11796 
In JetBrains Space through 2020-04-22, the password authentication implementation was insecure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T13:52:50.000Z
CVE-2020-11797 
An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit could allow an attacker to access sensitive shared files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T18:15:24.000Z
CVE-2020-11798 
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-10T00:00:00.000Z
CVE-2020-11799 
Z-Cron 5.6 Build 04 allows an unprivileged attacker to elevate privileges by modifying a privileged user's task. This can also affect all users who are signed in on the system if a shell is placed in a location that other unprivileged users have access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T18:11:17.000Z
CVE-2020-11800 
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-07T15:02:53.000Z
CVE-2020-11803 
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval() function. The user has to be authenticated on the web platform before interacting with the page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T16:24:01.000Z
CVE-2020-11804 
An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T16:26:45.000Z
CVE-2020-11805 
Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:31:46.000Z
CVE-2020-11806 
In MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process does not validate the validity of the certificate presented by the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T12:42:51.000Z
CVE-2020-11807 
Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and sometimes terminal commands) on a server by making an avatar update and then visiting the avatar file under the /images/ path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-19T16:00:50.000Z
CVE-2020-11810 
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:47:01.000Z
CVE-2020-11811 
In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T16:24:11.000Z
CVE-2020-11812 
Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T16:37:14.000Z
CVE-2020-11813 
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T16:30:41.000Z
CVE-2020-11814 
A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T16:43:30.000Z
CVE-2020-11815 
In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs without the Maintenance Mode setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T16:57:06.000Z
CVE-2020-11816 
Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T16:50:37.000Z
CVE-2020-11817 
In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs with the Maintenance Mode setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:14:34.000Z
CVE-2020-11818 
In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T17:07:52.000Z
CVE-2020-11819 
In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T17:42:34.000Z
CVE-2020-11820 
Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T17:35:50.000Z
CVE-2020-11821 
In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:19:16.000Z
CVE-2020-11822 
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:24:18.000Z
CVE-2020-11823 
In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T18:36:24.000Z
CVE-2020-11825 
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T19:03:47.000Z
CVE-2020-11826 
Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a database without encryption and an attacker can read the password-protected notes without having the password. Notes are stored in the ZENTITY table in the memono.sqlite database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-16T18:48:36.000Z
CVE-2020-11827 
In GOG Galaxy 1.2.67, there is a service that is vulnerable to weak file/service permissions: GalaxyClientService.exe. An attacker can put malicious code in a Trojan horse GalaxyClientService.exe. After that, the attacker can re-start this service as an unprivileged user to escalate his/her privileges and run commands on the machine with SYSTEM rights.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T17:06:19.000Z
CVE-2020-11828 
In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger surfaceflinger.CPP), RGB is defined on the stack but uninitialized, so when the screenShot function to RGB value assignment, will not initialize the value is returned to the attackers, leading to values on the stack information leakage, the vulnerability can be used to bypass attackers ALSR.
Problem types: description: n/a
Affected products: vendor: Oppo
product: Color OS
Published: 2020-04-21T13:42:04.000Z
CVE-2020-11829 
Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: com.coloros.codebook
Published: 2020-11-19T15:51:07.000Z
CVE-2020-11830 
QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: com.oppo.qualityprotect
Published: 2020-11-19T15:51:09.000Z
CVE-2020-11831 
OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: com.oppo.ovoicemanager
Published: 2020-11-19T15:51:12.000Z
CVE-2020-11832 
In functions charging_limit_current_write and charging_limit_time_write in /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_charger.c have not checked the parameters, which causes a vulnerability.
Problem types: description: DOS Overflow
Affected products: vendor: n/a
product: OPPO Find X2
Published: 2020-12-31T17:58:58.000Z
CVE-2020-11833 
In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_mp2650.c, the function mp2650_data_log_write in mp2650_data_log_write does not check the parameter len which causes a vulnerability.
Problem types: description: DOS Overflow
Affected products: vendor: n/a
product: OPPO Find X2
Published: 2020-12-31T17:59:22.000Z
CVE-2020-11834 
In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_vooc.c, the function proc_fastchg_fw_update_write in proc_fastchg_fw_update_write does not check the parameter len, resulting in a vulnerability.
Problem types: description: DOS Overflow
Affected products: vendor: n/a
product: OPPO Find X2
Published: 2020-12-31T17:59:35.000Z
CVE-2020-11835 
In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_da9313.c, failure to check the parameter buf in the function proc_work_mode_write in proc_work_mode_write causes a vulnerability.
Problem types: description: DOS
Affected products: vendor: n/a
product: OPPO Find X2
Published: 2020-12-31T17:59:45.000Z
CVE-2020-11836 
OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb shell getprop ro.vendor.aee.enforcing” or “adb shell getprop ro.vendor.aee.enforcing” return no.
Problem types: description: Information Leak
Affected products: vendor: n/a
product: OPPO Android Phone with MTK chipset
Published: 2021-02-05T23:38:24.000Z
CVE-2020-11838 
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure.
Problem types: description: Cross Site Scripting.
Affected products: vendor: n/a
product: ArcSight Management Center.
Published: 2020-06-16T13:13:58.000Z
CVE-2020-11839 
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure.
Problem types: description: Cross Site Scripting
Affected products: vendor: n/a
product: ArcSight Logger.
Published: 2020-06-12T22:30:38.000Z
CVE-2020-11840 
Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure.
Problem types: description: Unauthorized information disclosure.
Affected products: vendor: n/a
product: ArcSight Management Center.
Published: 2020-06-16T13:11:49.000Z
CVE-2020-11841 
Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure.
Problem types: description: Unauthorized information disclosure.
Affected products: vendor: n/a
product: ArcSight Management Center.
Published: 2020-06-16T13:16:31.000Z
CVE-2020-11842 
Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 (7.8.49 or 7.8.0.49). The vulnerability allows an unauthenticated attackers to view information they may not have been authorized to view.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: Verastream Host Integrator (VHI)
Published: 2020-05-04T12:31:13.000Z
CVE-2020-11843 Potential information leakage in administrator enabled debug mode
This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: OpenText
product: NetIQ Access Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-06-11T07:23:38.502Z
CVE-2020-11844 Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.
Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Micro Focus
product: Hybrid Cloud Management
vendor: Micro Focus
product: ArcSight Investigate. versions
vendor: Micro Focus
product: ArcSight Transformation Hub
vendor: Micro Focus
product: ArcSight Interset
vendor: Micro Focus
product: ArcSight ESM (when ArcSight Fusion
vendor: Micro Focus
product: Service Management Automation (SMA)
vendor: Micro Focus
product: Operation Bridge Suite (Containerized)
vendor: Micro Focus
product: Network Operation Management
vendor: Micro Focus
product: Data Center Automation Containerized
vendor: Micro Focus
product: Identity Intelligence. versions
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-05-29T21:15:23.000Z
CVE-2020-11845 
Cross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow remote attackers to inject arbitrary web script or HTML.
Problem types: description: Cross Site Scripting.
Affected products: vendor: n/a
product: Service Manager.
Published: 2020-05-19T14:05:21.000Z
CVE-2020-11846 Improper handling of token allows access to restricted resource in Privileged Access Manager
A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricted access to all the application resources. This issue affects Privileged Access Manager before 3.7.0.1.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: OpenText
product: Privileged Access Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2024-08-21T13:37:11.454Z
CVE-2020-11847 Vulnerability in sshrelay in privileged access manager provides full system access.
SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: OpenText
product: Privileged Access Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-08-21T13:38:44.228Z
CVE-2020-11848 
Denial of service vulnerability on Micro Focus ArcSight Management Center. Affecting all versions prior to version 2.9.5. The vulnerability could cause the server to become unavailable, causing a denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: ArcSight Management Center
Published: 2020-08-19T14:25:31.000Z
CVE-2020-11849 Elevation of privilege and unauthorized access in Micro Focus Identity Manager product
Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prior to 4.7.3 and 4.8.1 hot fix 1. The vulnerability could allow information exposure that can result in an elevation of privilege or an unauthorized access.
Problem types: description: Elevation of privilege and/or unauthorized access
Affected products: vendor: Micro Fosus
product: Identity Manager
Credits: lang: en
value: Mark van Reijn, of IDFocus.
Published: 2020-07-08T13:30:36.737Z
CVE-2020-11850 Cross site scripting vulnerability in Self Service Password Reset
Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Reset before 4.5.0.2 and 4.4.0.6
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: OpenText
product: Self Service Password Reset
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2024-08-21T12:52:22.890Z
CVE-2020-11851 
Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in the execution of arbitrary code.
Problem types: description: Arbitrary code execution.
Affected products: vendor: Micro Focus
product: ArcSight Logger
Published: 2020-11-17T01:02:34.000Z
CVE-2020-11852 
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.
Problem types: description: Inject system commands into the call to the DKIM system command.
Affected products: vendor: n/a
product: Secure Messaging Gateway ( SMG).
Published: 2020-08-07T15:53:57.000Z