rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-11515 
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T16:51:42.000Z
CVE-2020-11516 
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T16:55:39.000Z
CVE-2020-11518 
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T13:25:34.000Z
CVE-2020-11519 
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sectors via a \\.\SecureDocDevice handle. Exploiting this vulnerability results in privileged code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T17:48:25.000Z
CVE-2020-11520 
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T17:47:09.000Z
CVE-2020-11521 
libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T16:07:52.000Z
CVE-2020-11522 
libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T16:10:32.000Z
CVE-2020-11523 
libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T16:12:56.000Z
CVE-2020-11524 
libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T16:14:32.000Z
CVE-2020-11525 
libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T16:16:02.000Z
CVE-2020-11526 
libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T16:18:18.000Z
CVE-2020-11527 
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T16:26:25.000Z
CVE-2020-11528 
bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T16:48:50.000Z
CVE-2020-11529 
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T18:17:52.000Z
CVE-2020-11530 
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-08T19:10:36.000Z
CVE-2020-11531 
The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-08T20:01:36.000Z
CVE-2020-11532 
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-08T20:02:24.000Z
CVE-2020-11533 
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T19:02:47.000Z
CVE-2020-11534 
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely execute code on a victim's server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T14:56:35.000Z
CVE-2020-11535 
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T14:56:21.000Z
CVE-2020-11536 
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T14:56:10.000Z
CVE-2020-11537 
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T14:56:05.000Z
CVE-2020-11538 
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-25T18:32:06.000Z
CVE-2020-11539 
An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T13:27:10.000Z
CVE-2020-11541 
In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the local Administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-08T13:05:06.000Z
CVE-2020-11542 
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T21:26:53.000Z
CVE-2020-11543 
OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been resolved in OpsRamp Gateway firmware version 7.0.0 where an administrator and a system user accounts are the only available user accounts for the gateway appliance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:32:00.000Z
CVE-2020-11544 
An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the upload section on the file-manager page contains an arbitrary file upload vulnerability via add_cars.php. There are no upload restrictions for executable files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T15:26:56.000Z
CVE-2020-11545 
Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters (login.php), and id parameter (book_car.php) This allows an attacker to dump the MySQL database and to bypass the login authentication prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T15:25:20.000Z
CVE-2020-11546 
SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T19:16:21.000Z
CVE-2020-11547 
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T23:23:04.000Z
CVE-2020-11548 
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-04T23:48:14.000Z
CVE-2020-11549 
An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The root account has the same password as the Web-admin component. Thus, by exploiting CVE-2020-11551, it is possible to achieve remote code execution with root privileges on the embedded Linux system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T15:47:26.000Z
CVE-2020-11550 
An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote leak of sensitive/arbitrary Wi-Fi information, such as SSIDs and Pre-Shared-Keys (PSK).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T15:46:26.000Z
CVE-2020-11551 
An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi configuration data such as authentication details (e.g., the Web-admin password), network settings, DNS settings, system administration interface configuration, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T15:45:30.000Z
CVE-2020-11552 
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-11T15:43:14.000Z
CVE-2020-11553 
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There is pervasive CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-09T12:35:28.000Z
CVE-2020-11554 
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive information via info.php4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-09T12:34:08.000Z
CVE-2020-11555 
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive credential information from backup files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-09T12:31:59.000Z
CVE-2020-11556 
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) and reflected XSS vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-09T12:31:01.000Z
CVE-2020-11557 
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's cookie value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-09T12:29:27.000Z
CVE-2020-11558 
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-05T20:00:33.000Z
CVE-2020-11560 
NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T00:00:00.000Z
CVE-2020-11561 
In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T14:31:14.000Z
CVE-2020-11565 
An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T00:08:41.000Z
CVE-2020-11576 
Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T17:40:50.000Z
CVE-2020-11579 
An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T17:15:08.000Z
CVE-2020-11580 
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T20:03:00.000Z
CVE-2020-11581 
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T20:03:38.000Z
CVE-2020-11582 
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T20:03:20.000Z
CVE-2020-11583 
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-03T20:12:17.000Z
CVE-2020-11584 
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-03T20:05:46.000Z
CVE-2020-11585 
There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T20:27:46.000Z
CVE-2020-11586 
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:35:16.000Z
CVE-2020-11587 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:34:59.000Z
CVE-2020-11588 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to two files that contain customer data and application paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:34:51.000Z
CVE-2020-11589 
An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:34:34.000Z
CVE-2020-11590 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:34:22.000Z
CVE-2020-11591 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:34:12.000Z
CVE-2020-11592 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:34:00.000Z
CVE-2020-11593 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:33:49.000Z
CVE-2020-11594 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:33:32.000Z
CVE-2020-11595 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:33:20.000Z
CVE-2020-11596 
A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make HTTP GET requests to a certain URL and obtain information about what files and directories reside on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:33:03.000Z
CVE-2020-11597 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:32:15.000Z