rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-35945 
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2021-01-01T03:28:27.000Z
CVE-2020-35946 
An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
version: 3.1
Published: 2021-01-01T03:28:09.000Z
CVE-2020-35947 
An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:C/UI:N
version: 3.1
Published: 2021-01-01T03:27:57.000Z
CVE-2020-35948 
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2021-01-01T03:27:47.000Z
CVE-2020-35949 
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2021-01-01T03:27:33.000Z
CVE-2020-35950 
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-01-01T03:27:16.000Z
CVE-2020-35951 
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:N/S:C/UI:N
version: 3.1
Published: 2021-01-01T03:27:03.000Z
CVE-2020-35952 
login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-03T03:49:31.000Z
CVE-2020-35962 
The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum token, lacks access control for fee swapping and thus allows price manipulation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-03T06:55:42.000Z
CVE-2020-35963 
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-03T18:15:48.000Z
CVE-2020-35964 
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-03T18:57:03.000Z
CVE-2020-35965 
decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T01:07:31.000Z
CVE-2020-35970 
An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T20:55:47.000Z
CVE-2020-35971 
A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T20:55:39.000Z
CVE-2020-35972 
An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T20:55:33.000Z
CVE-2020-35973 
An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T20:55:19.000Z
CVE-2020-35979 
An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T15:05:56.000Z
CVE-2020-35980 
An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T00:00:00.000Z
CVE-2020-35981 
An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T15:05:56.000Z
CVE-2020-35982 
An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T15:05:56.000Z
CVE-2020-35984 
A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T21:55:55.000Z
CVE-2020-35985 
A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T21:55:54.000Z
CVE-2020-35986 
A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T21:55:52.000Z
CVE-2020-35987 
A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T21:55:51.000Z
CVE-2020-35990 
Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attackers to cause a denial of service (DoS) via crafted .pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-35992 
Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T01:02:02.000Z
CVE-2020-36002 
Seat-Reservation-System 1.0 has a SQL injection vulnerability in index.php in the id parameter where attackers can obtain sensitive database information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T14:32:18.000Z
CVE-2020-36003 
The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T14:32:25.000Z
CVE-2020-36004 
AppCMS 2.0.101 in /admin/download_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitive database information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T22:15:37.000Z
CVE-2020-36005 
AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T22:15:48.000Z
CVE-2020-36006 
AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T22:15:58.000Z
CVE-2020-36007 
AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive information of other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T22:16:08.000Z
CVE-2020-36008 
OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T22:16:17.000Z
CVE-2020-36009 
OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T22:16:26.000Z
CVE-2020-36011 
A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T06:53:49.000Z
CVE-2020-36012 
Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-27T12:11:02.000Z
CVE-2020-36023 
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-36024 
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-36033 
SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T17:34:09.000Z
CVE-2020-36034 
SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manage_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-36037 
An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-36048 
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-07T23:24:33.000Z
CVE-2020-36049 
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-07T23:24:23.000Z
CVE-2020-36051 
Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T21:12:59.000Z
CVE-2020-36052 
Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T21:12:58.000Z
CVE-2020-36056 
Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scripting (XSS) vulnerability via the Ping diagnostic option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T12:48:41.000Z
CVE-2020-36062 
Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T15:03:42.000Z
CVE-2020-36064 
Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T12:43:48.000Z
CVE-2020-36065 
Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admin_save.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2020-36066 
GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-01-05T20:41:16.000Z
CVE-2020-36067 
GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-01-05T20:41:05.000Z
CVE-2020-36070 
Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-26T00:00:00.000Z
CVE-2020-36071 
SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-06T00:00:00.000Z
CVE-2020-36072 
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-06T00:00:00.000Z
CVE-2020-36073 
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-06T00:00:00.000Z
CVE-2020-36074 
SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-06T00:00:00.000Z
CVE-2020-36077 
SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the customer parameter of the orderadd.php file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2020-36079 
Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-26T22:49:40.000Z
CVE-2020-36082 
File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2020-36084 
SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_students.php?id= parameter via id field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-05T00:00:00.000Z
CVE-2020-36085 
Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary code via First and Last Name in Apply For This Job Form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2020-36109 
ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module that can cause code execution when an attacker constructs malicious data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T13:14:20.000Z
CVE-2020-36112 
CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in cart.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database on which the web application is running.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T14:46:37.000Z
CVE-2020-36115 
Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-28T19:15:37.000Z
CVE-2020-36120 
Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:50:40.000Z
CVE-2020-36124 
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user (clients and administrators).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T10:35:14.000Z