rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10209 
Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows man-in-the-middle attackers to execute arbitrary commands with root level privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T23:43:53.000Z
CVE-2020-10210 
Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B, an attacker may remotely log in through SSH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T22:10:05.000Z
CVE-2020-10211 
A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T12:31:02.000Z
CVE-2020-10212 
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T23:30:11.000Z
CVE-2020-10213 
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T00:29:46.000Z
CVE-2020-10214 
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T00:30:13.000Z
CVE-2020-10215 
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T00:30:05.000Z
CVE-2020-10216 
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T00:29:54.000Z
CVE-2020-10218 
A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:22:13.000Z
CVE-2020-10220 
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T22:37:43.000Z
CVE-2020-10221 
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T21:03:47.000Z
CVE-2020-10222 
npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to Heap Corruption at npdf!nitro::get_property+2381 via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T21:46:26.000Z
CVE-2020-10223 
npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to JBIG2Decode CNxJBIG2DecodeStream Heap Corruption at npdf!CAPPDAnnotHandlerUtils::create_popup_for_markup+0x12fbe via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T21:46:15.000Z
CVE-2020-10224 
An unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul Online Book Store 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T22:11:58.000Z
CVE-2020-10225 
An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T22:11:43.000Z
CVE-2020-10227 
A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From field of an email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-14T19:58:33.000Z
CVE-2020-10228 
A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-14T19:56:58.000Z
CVE-2020-10229 
A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and deleting accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-14T19:55:07.000Z
CVE-2020-10230 
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:34:23.000Z
CVE-2020-10231 
TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_171205, NC250 through 1.3.0_Build_171205, NC260 through 1.5.1_Build_190805, and NC450 through 1.5.0_Build_181022 devices allow a remote NULL Pointer Dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-01T13:57:21.000Z
CVE-2020-10232 
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T23:52:55.000Z
CVE-2020-10233 
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-08T23:52:43.000Z
CVE-2020-10234 
The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver. If the user provides a NULL entry for the dwIoControlCode parameter, a kernel panic (aka BSOD) follows. The IOCTL codes can be found in the dispatch function: 0x8001E000, 0x8001E004, 0x8001E008, 0x8001E00C, 0x8001E010, 0x8001E014, 0x8001E020, 0x8001E024, 0x8001E040, 0x8001E044, and 0x8001E048. \DosDevices\AscRegistryFilter and \Device\AscRegistryFilter are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T18:58:10.000Z
CVE-2020-10235 
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T15:04:46.000Z
CVE-2020-10236 
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T15:04:23.000Z
CVE-2020-10237 
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T15:04:32.000Z
CVE-2020-10238 
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:44:48.000Z
CVE-2020-10239 
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:45:49.000Z
CVE-2020-10240 
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:46:34.000Z
CVE-2020-10241 
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:47:31.000Z
CVE-2020-10242 
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:48:15.000Z
CVE-2020-10243 
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T15:50:50.000Z
CVE-2020-10244 
JPaseto before 0.3.0 generates weak hashes when using v2.local tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:54:01.000Z
CVE-2020-10245 
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T03:45:20.000Z
CVE-2020-10246 
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:32:10.000Z
CVE-2020-10247 
MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:31:59.000Z
CVE-2020-10248 
BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:56:17.000Z
CVE-2020-10249 
BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to val_soft.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:56:08.000Z
CVE-2020-10250 
BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninstall.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:55:59.000Z
CVE-2020-10251 
In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c. It can be triggered via an image with a width or height value that exceeds the actual size of the image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T03:58:33.000Z
CVE-2020-10252 
An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authenticated attacker can interact with local services blindly (aka Blind SSRF) or conduct a Denial Of Service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T06:12:52.000Z
CVE-2020-10254 
An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T06:02:12.000Z
CVE-2020-10255 
Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attacks known as Target Row Refresh (TRR), aka the TRRespass issue. To exploit this vulnerability, the attacker needs to create certain access patterns to trigger bit flips on affected memory modules, aka a Many-sided RowHammer attack. This means that, even when chips advertised as RowHammer-free are used, attackers may still be able to conduct privilege-escalation attacks against the kernel, conduct privilege-escalation attacks against the Sudo binary, and achieve cross-tenant virtual-machine access by corrupting RSA keys. The issue affects chips produced by SK Hynix, Micron, and Samsung. NOTE: tracking DRAM supply-chain issues is not straightforward because a single product model from a single vendor may use DRAM chips from different manufacturers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T15:59:59.000Z
CVE-2020-10256 
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to perform brute-force calculations of encryption keys and thus succeed at decryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-27T13:28:10.000Z
CVE-2020-10257 
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T23:41:34.000Z
CVE-2020-10262 
An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the mi_console command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro (LX06), (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’s SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T17:26:32.000Z
CVE-2020-10263 
An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro LX06, (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’ SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T17:31:00.000Z
CVE-2020-10264 RTDE Interface allows unauthenticated reading of robot data and unauthenticated writing of registers and outputs
CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows setting registers, the speed slider fraction as well as digital and analog Outputs. Additionally unautheticated reading of robot data is also possible
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Universal Robots A/S
product: Universal Robots Robot Controllers CB 3.1
vendor: Universal Robots A/S
product: Universal Robots Robot Controllers e-Series
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Bernhard Dieber, Benjamin Breiling (and many others)
Published: 2020-04-06T12:08:40.625Z
CVE-2020-10265 RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions
Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.
Problem types: cwe_id: CWE-306
description: CWE-306 (Missing Authentication for Critical Function)
Affected products: vendor: Universal Robots
product: Universal Robots Robot Controllers CB 2, CB3, e-series
Credits: lang: en
value: Bernhard Dieber, Benjamin Breiling (and many others)
Published: 2020-04-06T12:08:40.665Z
CVE-2020-10266 RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot
UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots (e.g. in the UR10), no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universal Robots. An attacker could exploit this flaw by crafting a custom component with the SDK, performing Person-In-The-Middle attacks (PITM) and shipping the maliciously-crafted component on demand.
Problem types: cwe_id: CWE-353
description: CWE-353 (Missing Support for Integrity Check)
Affected products: vendor: Universal Robots
product: URx
Credits: lang: en
value: Víctor Mayoral Vilches <victor@aliasrobotics.com>, Mike Karamousadakis, Lander Usategui San Juan
Published: 2020-04-06T12:08:40.708Z
CVE-2020-10267 RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions
Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components (URCaps). These files (*.urcaps) are stored under '/root/.urcaps' as plain zip files containing all the logic to add functionality to the UR3, UR5 and UR10 robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property.
Problem types: cwe_id: CWE-311
description: CWE-311 (Missing Encryption of Sensitive Data)
Affected products: vendor: Universal Robots
product: UR3, UR5 and UR10
Credits: lang: en
value: Víctor Mayoral Vilches <victor@aliasrobotics.com>
Published: 2020-04-06T12:08:40.743Z
CVE-2020-10268 RVD#2550: Terminate Critical Services in KUKA controller KR C4
Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes needs to be performed. Be noted that this only can be accomplished either by a Kuka technician or by Kuka issued calibration hardware that interfaces with the manipulator furthering the delay and increasing operational costs.
Problem types: cwe_id: CWE-749
description: CWE-749
Affected products: vendor: KUKA Roboter GmbH
product: KR3R540, KRC4, KSS8.5.7HF1, Win7_Embedded
Credits: lang: en
value: Alias Robotics (group, https://aliasrobotics.com)
Published: 2020-06-16T17:55:11.700Z
CVE-2020-10269 RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Bernhard Dieber (Joanneum Research), Alias Robotics (https://aliasrobotics.com/)
Published: 2020-06-24T05:05:16.169Z