rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-26084 Cisco Edge Fog Fabric Resource Exposure Vulnerability
A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected system. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device.
Problem types: cwe_id: CWE-668
description: CWE-668
Affected products: vendor: Cisco
product: Cisco Edge Fog Fabric
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2020-11-06T18:15:29.448Z
CVE-2020-26085 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: Cisco
product: Cisco Jabber
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-01-06T23:35:12.594Z
CVE-2020-26086 Cisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected device. An attacker could exploit this vulnerability by accessing information that should not be accessible to users with low privileges. A successful exploit could allow the attacker to gain access to sensitive information.
Problem types: cwe_id: CWE-668
description: CWE-668
Affected products: vendor: Cisco
product: Cisco TelePresence Endpoint Software (TC/CE)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2020-11-06T18:15:33.870Z
CVE-2020-26088 
A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T14:06:29.000Z
CVE-2020-26097 
The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on the Internet, remote root access on the device is possible. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T17:46:36.000Z
CVE-2020-26098 
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:43:32.000Z
CVE-2020-26099 
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:43:26.000Z
CVE-2020-26100 
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:43:16.000Z
CVE-2020-26101 
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:43:08.000Z
CVE-2020-26102 
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:59.000Z
CVE-2020-26103 
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:53.000Z
CVE-2020-26104 
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:46.000Z
CVE-2020-26105 
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:40.000Z
CVE-2020-26106 
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:32.000Z
CVE-2020-26107 
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:25.000Z
CVE-2020-26108 
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:42:12.000Z
CVE-2020-26109 
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:41:09.000Z
CVE-2020-26110 
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:40:59.000Z
CVE-2020-26111 
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:40:50.000Z
CVE-2020-26112 
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:40:42.000Z
CVE-2020-26113 
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:40:34.000Z
CVE-2020-26114 
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:40:26.000Z
CVE-2020-26115 
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T05:40:17.000Z
CVE-2020-26116 
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-27T00:00:00.000Z
CVE-2020-26117 
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-27T03:30:25.000Z
CVE-2020-26118 
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2021-01-11T14:53:26.000Z
CVE-2020-26120 
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-27T20:07:52.000Z
CVE-2020-26121 
An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can leverage this to force a wiki to have a page with a disallowed title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-27T20:08:00.000Z
CVE-2020-26122 
Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism, the attacker who obtains the administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-07T15:34:55.000Z
CVE-2020-26124 
openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:28:03.000Z
CVE-2020-26129 
In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:09:55.000Z
CVE-2020-26130 
Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenTFTPServerMT.exe or the OpenTFTPServerSP.exe binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T00:00:00.000Z
CVE-2020-26131 
Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenDHCPServer.exe (Regular) or the OpenDHCPLdap.exe (LDAP Based) binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T00:00:00.000Z
CVE-2020-26132 
An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the HomeDNSServer.exe binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T00:00:00.000Z
CVE-2020-26133 
An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the DualServer.exe binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T00:00:00.000Z
CVE-2020-26134 
Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:29:04.000Z
CVE-2020-26135 
Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-02T08:29:28.000Z
CVE-2020-26136 
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T19:37:45.000Z
CVE-2020-26137 
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T00:00:00.000Z
CVE-2020-26138 
In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T17:35:06.000Z
CVE-2020-26139 
An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:37:55.000Z
CVE-2020-26140 
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:34:42.000Z
CVE-2020-26141 
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:42:11.000Z
CVE-2020-26142 
An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:41:14.000Z
CVE-2020-26143 
An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:36:38.000Z
CVE-2020-26144 
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:33:04.000Z
CVE-2020-26145 
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:35:10.000Z
CVE-2020-26146 
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:39:07.000Z
CVE-2020-26147 
An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T19:40:19.000Z
CVE-2020-26148 
md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) via a malformed Markdown document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T18:48:41.000Z
CVE-2020-26149 
NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T12:05:31.000Z
CVE-2020-26150 
info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T21:16:22.000Z
CVE-2020-26153 
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T10:44:57.000Z
CVE-2020-26154 
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T22:02:17.000Z
CVE-2020-26155 
Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for binaries to be manipulated by non-administrator users. Additionally, entries are made to the PATH environment variable which, in conjunction with these weak permissions, could enable an attacker to perform a DLL hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T16:17:01.000Z
CVE-2020-26157 
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T03:35:52.000Z
CVE-2020-26158 
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T03:35:35.000Z
CVE-2020-26160 
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2020-09-30T12:57:10.000Z
CVE-2020-26161 
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-26T17:29:39.000Z
CVE-2020-26162 
Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-09T06:42:29.000Z
CVE-2020-26163 
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T15:28:54.000Z
CVE-2020-26164 
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-07T18:07:51.000Z
CVE-2020-26165 
qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T20:38:22.000Z
CVE-2020-26166 
The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-05T12:00:35.000Z
CVE-2020-26167 
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-04T16:39:21.000Z