rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8150 
A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.
Problem types: cwe_id: CWE-310
description: Cryptographic Issues - Generic (CWE-310)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-11-09T14:19:42.000Z
CVE-2020-8151 
There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: https://github.com/rails/activeresource
Published: 2020-05-12T13:01:36.000Z
CVE-2020-8152 
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials (CWE-522)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-11-16T00:36:11.000Z
CVE-2020-8153 
Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Groupfolders
Published: 2020-05-12T13:01:33.000Z
CVE-2020-8154 
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
Problem types: cwe_id: CWE-639
description: Insecure Direct Object Reference (IDOR) (CWE-639)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-05-12T13:01:26.000Z
CVE-2020-8155 
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-05-12T13:01:29.000Z
CVE-2020-8156 
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: Nextcloud Mail
Published: 2020-05-12T13:01:22.000Z
CVE-2020-8157 
UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and Cloud Key gen2 Plus contains a vulnerability that allows unrestricted root access through the serial interface (UART).
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: UniFi Cloud Key Gen2, Cloud Key Gen2 plus
Published: 2020-05-02T15:19:33.000Z
CVE-2020-8158 
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
Problem types: cwe_id: CWE-471
description: Modification of Assumed-Immutable Data (MAID) (CWE-471)
Affected products: vendor: n/a
product: typeorm
Published: 2020-09-18T20:12:16.000Z
CVE-2020-8159 
There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: https://github.com/rails/actionpack-page_caching
Published: 2020-05-12T13:01:43.000Z
CVE-2020-8160 
MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: MendixSSO
Published: 2021-01-06T14:03:44.000Z
CVE-2020-8161 
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
Problem types: cwe_id: CWE-548
description: Information Exposure Through Directory Listing (CWE-548)
Affected products: vendor: n/a
product: https://github.com/rack/rack
Published: 2020-07-02T00:00:00.000Z
CVE-2020-8162 
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.
Problem types: cwe_id: CWE-602
description: Client-Side Enforcement of Server-Side Security (CWE-602)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2020-06-19T17:02:42.000Z
CVE-2020-8163 
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2020-07-02T18:35:12.000Z
CVE-2020-8164 
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2020-06-19T17:04:13.000Z
CVE-2020-8165 
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2020-06-19T17:05:30.000Z
CVE-2020-8166 
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2020-07-02T18:35:17.000Z
CVE-2020-8167 
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: http://github.com/rails/rails
Published: 2020-06-19T17:16:06.000Z
CVE-2020-8168 
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: AirMax AirOS for TI, XW and XM boards
Published: 2020-05-26T15:43:00.000Z
CVE-2020-8169 
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2020-12-14T19:41:54.000Z
CVE-2020-8170 
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: AirMax AirOS for TI, XW and XM boards
Published: 2020-05-26T15:37:27.000Z
CVE-2020-8171 
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: AirMax AirOS for TI, XW and XM boards
Published: 2020-05-26T15:40:53.000Z
CVE-2020-8172 
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: https://github.com/nodejs/node
Published: 2020-06-08T13:08:16.000Z
CVE-2020-8173 
A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.
Problem types: cwe_id: CWE-310
description: Cryptographic Issues - Generic (CWE-310)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-10-30T18:12:26.000Z
CVE-2020-8174 
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
Problem types: cwe_id: CWE-119
description: Memory Corruption - Generic (CWE-119)
Affected products: vendor: n/a
product: https://github.com/nodejs/node
Published: 2020-07-24T21:45:37.000Z
CVE-2020-8175 
Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: jpeg-js
Published: 2020-07-24T21:26:45.000Z
CVE-2020-8176 
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: koa-shopify-auth
Published: 2020-07-02T18:35:21.000Z
CVE-2020-8177 
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
Problem types: cwe_id: CWE-99
description: Resource Injection (CWE-99)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2020-12-14T19:42:16.000Z
CVE-2020-8178 
Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.
Problem types: cwe_id: CWE-78
description: OS Command Injection (CWE-78)
Affected products: vendor: n/a
product: jison
Published: 2020-07-15T16:10:35.000Z
CVE-2020-8179 
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Deck
Published: 2020-07-02T18:35:19.000Z
CVE-2020-8180 
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Nextcloud Talk
Published: 2020-06-08T13:08:19.000Z
CVE-2020-8181 
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
Problem types: cwe_id: CWE-840
description: Business Logic Errors (CWE-840)
Affected products: vendor: n/a
product: Nextcloud Contact
Published: 2020-07-10T15:48:41.000Z
CVE-2020-8182 
Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Deck
Published: 2020-10-05T13:17:28.000Z
CVE-2020-8183 
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.
Problem types: cwe_id: CWE-256
description: Plaintext Storage of a Password (CWE-256)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-10-30T18:13:18.000Z
CVE-2020-8184 
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
Problem types: cwe_id: CWE-784
description: Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CWE-784)
Affected products: vendor: n/a
product: https://github.com/rack/rack
Published: 2020-06-19T00:00:00.000Z
CVE-2020-8185 
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2020-07-02T18:35:06.000Z
CVE-2020-8186 
A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: devcert
Published: 2020-07-10T15:37:18.000Z
CVE-2020-8187 
Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service attack.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway
Published: 2020-07-10T15:35:56.000Z
CVE-2020-8188 
We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectively that fixes vulnerabilities found on Protect firmware v1.13.2, v1.14.9 and prior according to the description below:View only users can run certain custom commands which allows them to assign themselves unauthorized roles and escalate their privileges.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: Protect for UniFi Cloud Key Gen2 Plus, UniFi Dream Machine Pro, UNVR
Published: 2020-07-02T18:35:14.000Z
CVE-2020-8189 
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: n/a
product: Desktop Client
Published: 2020-08-21T20:34:54.000Z
CVE-2020-8190 
Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway
Published: 2020-07-10T15:32:34.000Z
CVE-2020-8191 
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-07-10T15:38:10.000Z
CVE-2020-8192 
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: fastify
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8193 
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-07-10T15:38:28.000Z
CVE-2020-8194 
Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-07-10T15:38:54.000Z
CVE-2020-8195 
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-07-10T15:39:35.000Z
CVE-2020-8196 
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-07-10T15:39:54.000Z
CVE-2020-8197 
Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway
Published: 2020-07-10T15:40:09.000Z
CVE-2020-8198 
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in Stored Cross-Site Scripting (XSS).
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
Published: 2020-07-10T15:39:14.000Z
CVE-2020-8199 
Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalation to root.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Citrix Gateway Plug-in for Linux
Published: 2020-07-10T15:40:38.000Z
CVE-2020-8200 
Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Citrix StoreFront
Published: 2020-09-18T20:13:00.000Z
CVE-2020-8201 
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-09-18T20:12:43.000Z
CVE-2020-8202 
Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password.
Problem types: cwe_id: CWE-307
description: Brute Force (CWE-307)
Affected products: vendor: n/a
product: Nextcloud Preferred Providers
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8203 
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling (CWE-770)
Affected products: vendor: n/a
product: lodash
Published: 2020-07-15T16:10:27.000Z
CVE-2020-8204 
A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - DOM (CWE-79)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8205 
The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: n/a
product: uppy
Published: 2020-07-20T15:00:53.000Z
CVE-2020-8206 
An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2020-07-30T12:53:02.000Z
CVE-2020-8207 
Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Citrix Workspace App for Windows
Published: 2020-07-24T21:24:36.000Z
CVE-2020-8208 
Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS).
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Citrix XenMobile Server
Published: 2020-08-17T15:36:10.000Z