rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8209 
Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: Citrix XenMobile Server
Published: 2020-08-17T15:37:15.000Z
CVE-2020-8210 
Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Citrix XenMobile Server
Published: 2020-08-17T15:39:33.000Z
CVE-2020-8211 
Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows SQL Injection.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: Citrix XenMobile Server
Published: 2020-08-17T15:40:20.000Z
CVE-2020-8212 
Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows access to privileged functionality.
Problem types: cwe_id: CWE-749
description: Exposed Dangerous Method or Function (CWE-749)
Affected products: vendor: n/a
product: Citrix XenMobile Server
Published: 2020-08-17T15:40:35.000Z
CVE-2020-8213 
An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing.
Problem types: cwe_id: CWE-209
description: Information Exposure Through an Error Message (CWE-209)
Affected products: vendor: UniFi
product: Protect for UniFi Cloud Key Gen2 Plus
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8214 
A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: servey
Published: 2020-07-20T15:02:56.000Z
CVE-2020-8215 
A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image.
Problem types: cwe_id: CWE-120
description: Classic Buffer Overflow (CWE-120)
Affected products: vendor: n/a
product: node-canvas
Published: 2020-07-20T15:01:38.000Z
CVE-2020-8216 
An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8217 
A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8218 
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8219 
An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.
Problem types: cwe_id: CWE-280
description: Improper Handling of Insufficient Permissions or Privileges (CWE-280)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8220 
A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8221 
A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8222 
A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8223 
A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-10-05T13:16:48.000Z
CVE-2020-8224 
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-08-10T13:35:37.000Z
CVE-2020-8225 
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
Problem types: cwe_id: CWE-312
description: Cleartext Storage of Sensitive Information (CWE-312)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-09-18T20:11:32.000Z
CVE-2020-8226 
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
Problem types: cwe_id: CWE-610
description: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
Affected products: vendor: n/a
product: https://github.com/phpbb/phpbb
Published: 2020-08-17T15:37:51.000Z
CVE-2020-8227 
Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-08-21T20:33:44.000Z
CVE-2020-8228 
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
Problem types: cwe_id: CWE-840
description: Business Logic Errors (CWE-840)
Affected products: vendor: n/a
product: Nextcloud Preferred Provider
Published: 2020-10-05T13:15:23.000Z
CVE-2020-8229 
A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-08-10T13:35:33.000Z
CVE-2020-8230 
A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory.
Problem types: cwe_id: CWE-119
description: Memory Corruption - Generic (CWE-119)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-08-17T15:36:50.000Z
CVE-2020-8231 
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2020-12-14T19:39:19.000Z
CVE-2020-8232 
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: EdgeSwitch firmware v1.9.0 and prior
Published: 2020-08-17T15:40:59.000Z
CVE-2020-8233 
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: EdgeSwitch firmware v1.9.0 and prior
Published: 2020-08-17T15:41:19.000Z
CVE-2020-8234 
A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection.
Problem types: cwe_id: CWE-613
description: Insufficient Session Expiration (CWE-613)
Affected products: vendor: n/a
product: EdgeSwitch firmware v1.9.0 and prior
Published: 2020-08-21T20:37:22.000Z
CVE-2020-8235 
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.
Problem types: cwe_id: CWE-639
description: Insecure Direct Object Reference (IDOR) (CWE-639)
Affected products: vendor: n/a
product: Nextcloud Deck app
Published: 2020-10-05T13:16:08.000Z
CVE-2020-8236 
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-10-30T18:11:49.000Z
CVE-2020-8237 
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: json-bigint
Published: 2020-09-18T20:12:51.000Z
CVE-2020-8238 
A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: Pulse Secure
product: Pulse Connect Secure/ Pulse Policy Secure
Published: 2020-09-29T13:41:05.000Z
CVE-2020-8239 
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side Upgrade due to Standalone Host Checker Client (Windows) and Windows PDC.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Pulse Secure Desktop Cient
Published: 2020-10-28T12:46:48.000Z
CVE-2020-8240 
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured with Credential Provider. This vulnerability only affects Windows PDC if the Embedded Browser is configured with the Credential Provider.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Pulse Secure Desktop Client
Published: 2020-10-28T12:41:44.000Z
CVE-2020-8241 
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Pulse Secure Dektop Client
Published: 2020-10-28T12:47:07.000Z
CVE-2020-8242 
Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: ExpressionEngine
Published: 2022-02-18T17:50:57.000Z
CVE-2020-8243 
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Pulse Connect Secre
Published: 2020-09-29T13:44:31.000Z
CVE-2020-8244 
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Problem types: cwe_id: CWE-126
description: Buffer Over-read (CWE-126)
Affected products: vendor: n/a
product: bl
Published: 2020-08-30T13:43:55.000Z
CVE-2020-8245 
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b leads to an HTML Injection attack against the SSL VPN web portal.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway
Published: 2020-09-18T20:12:07.000Z
CVE-2020-8246 
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b are vulnerable to a denial of service attack originating from the management network.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-09-18T20:12:26.000Z
CVE-2020-8247 
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b are vulnerable to escalation of privileges on the management interface.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-09-18T20:12:32.000Z
CVE-2020-8248 
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Pulse Secure Desktop Client
Published: 2020-10-28T12:40:34.000Z
CVE-2020-8249 
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow.
Problem types: cwe_id: CWE-120
description: Classic Buffer Overflow (CWE-120)
Affected products: vendor: n/a
product: Pulse Secure Desktop Client
Published: 2020-10-28T12:40:53.000Z
CVE-2020-8250 
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Pulse Secure Desktop Client
Published: 2020-10-28T12:41:11.000Z
CVE-2020-8251 
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-09-18T20:11:43.000Z
CVE-2020-8252 
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
Problem types: cwe_id: CWE-120
description: Classic Buffer Overflow (CWE-120)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-09-18T20:11:51.000Z
CVE-2020-8253 
Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 leads to the ability to access sensitive files.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Citrix XenMobile Server
Published: 2020-09-18T20:12:00.000Z
CVE-2020-8254 
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below recommendation(s):Disable Dynamic certificate trust for PDC.
Problem types: cwe_id: CWE-23
description: Relative Path Traversal (CWE-23)
Affected products: vendor: n/a
product: Pulse Secure Desktop Client
Published: 2020-10-28T12:46:28.000Z
CVE-2020-8255 
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerability is fixed using encrypted URL blacklisting that prevents these messages.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: Pulse Connect Secure / Pulse Policy Secure
Published: 2020-10-28T12:46:59.000Z
CVE-2020-8256 
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.
Problem types: cwe_id: CWE-611
description: XML External Entities (XXE) (CWE-611)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-09-29T13:41:32.000Z
CVE-2020-8257 
Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege escalation attacks
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Citrix Gateway Plug-in for Windows
Published: 2020-12-14T19:42:02.000Z
CVE-2020-8258 
Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacker to modify arbitrary files.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: n/a
product: Citrix Gateway Plug-in for Windows
Published: 2020-12-14T19:42:09.000Z
CVE-2020-8259 
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials (CWE-522)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-11-16T00:36:43.000Z
CVE-2020-8260 
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload of File with Dangerous Type (CWE-434)
Affected products: vendor: n/a
product: Pulse Connect Secure / Pulse Policy Secure
Published: 2020-10-28T12:47:13.000Z
CVE-2020-8261 
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
Problem types: cwe_id: CWE-120
description: Classic Buffer Overflow (CWE-120)
Affected products: vendor: n/a
product: Pulse Connect Secure / Pulse Policy Secure
Published: 2020-10-28T12:47:36.000Z
CVE-2020-8262 
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Pulse Connect Secure / Pulse Policy Secure
Published: 2020-10-28T12:47:55.000Z
CVE-2020-8263 
A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Pulse Connect Secure / Pulse Policy Secure
Published: 2020-10-28T12:48:17.000Z
CVE-2020-8264 
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-01-06T21:02:35.000Z
CVE-2020-8265 
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2021-01-06T21:01:15.000Z
CVE-2020-8267 
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect v1.14.11 and newer.This issue does not impact UniFi Cloud Key Gen 2 plus.This issue does not impact UDM-Pro customers with UniFi Protect stopped.Affected Products:UDM-Pro firmware 1.7.2 and earlier.UNVR firmware 1.3.12 and earlier.Mitigation:Update UniFi Protect to v1.14.11 or newer version; the UniFi Protect controller can be updated through your UniFi OS settings.Alternatively, you can update UNVR and UDM-Pro to:- UNVR firmware to 1.3.15 or newer.- UDM-Pro firmware to 1.8.0 or newer.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: UniFi Protect
Published: 2020-11-05T18:28:34.000Z