rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15798 
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SIMATIC HMI Comfort Panels (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC HMI KTP Mobile Panels
vendor: Siemens
product: SINAMICS GH150
vendor: Siemens
product: SINAMICS GL150 (with option X30)
vendor: Siemens
product: SINAMICS GM150 (with option X30)
vendor: Siemens
product: SINAMICS SH150
vendor: Siemens
product: SINAMICS SL150
vendor: Siemens
product: SINAMICS SM120
vendor: Siemens
product: SINAMICS SM150
vendor: Siemens
product: SINAMICS SM150i
Published: 2021-02-09T15:38:17.000Z
CVE-2020-15799 
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SCALANCE X-200 switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
Published: 2021-01-12T20:18:33.000Z
CVE-2020-15800 
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). The webserver of the affected devices contains a vulnerability that may lead to a heap overflow condition. An attacker could cause this condition on the webserver by sending specially crafted requests. This could stop the webserver temporarily.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SCALANCE X-200 switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
vendor: Siemens
product: SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Published: 2021-01-12T20:18:33.000Z
CVE-2020-15801 
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-17T02:15:04.000Z
CVE-2020-15802 
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-11T13:07:22.000Z
CVE-2020-15803 
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-17T00:00:00.000Z
CVE-2020-15806 
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T18:14:43.000Z
CVE-2020-15807 
GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-17T15:35:44.000Z
CVE-2020-15809 
spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-24T16:54:47.000Z
CVE-2020-15810 
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:34:04.000Z
CVE-2020-15811 
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-02T16:35:04.000Z
CVE-2020-15813 
Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code (in all versions that support LDAP) does not implement proper certificate validation (regardless of whether the "Allow self-signed certificates" option is used). Therefore, any attacker with the ability to intercept network traffic between a Graylog server and an LDAP server is able to redirect traffic to a different LDAP server (unnoticed by the Graylog server due to the lack of certificate validation), effectively bypassing Graylog's authentication mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-17T18:05:06.000Z
CVE-2020-15816 
In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-17T19:16:07.000Z
CVE-2020-15817 
In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:05:37.000Z
CVE-2020-15818 
In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:03:57.000Z
CVE-2020-15819 
JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:07:14.000Z
CVE-2020-15820 
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:08:41.000Z
CVE-2020-15821 
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:15:24.000Z
CVE-2020-15822 
In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T18:45:49.000Z
CVE-2020-15823 
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:17:00.000Z
CVE-2020-15824 
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:21:43.000Z
CVE-2020-15825 
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:39:03.000Z
CVE-2020-15826 
In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:32:39.000Z
CVE-2020-15827 
In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:24:52.000Z
CVE-2020-15828 
In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:48:14.000Z
CVE-2020-15829 
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:40:40.000Z
CVE-2020-15830 
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:51:35.000Z
CVE-2020-15831 
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:50:17.000Z
CVE-2020-15832 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The poof.cgi script contains undocumented code that provides the ability to remotely reboot the device. An adversary with the private key (but not the root password) can remotely reboot the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:36:34.000Z
CVE-2020-15833 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location that cannot be modified by the device owner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:39:35.000Z
CVE-2020-15834 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in a QR encoded picture that an unauthenticated adversary can download via the web-management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:41:31.000Z
CVE-2020-15835 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the management interface as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:42:32.000Z
CVE-2020-15836 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:44:26.000Z
CVE-2020-15838 
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-09T06:37:47.000Z
CVE-2020-15839 
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-22T17:27:49.000Z
CVE-2020-15840 
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T14:56:23.000Z
CVE-2020-15841 
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R
version: 3.1
Published: 2020-07-20T01:06:39.000Z
CVE-2020-15842 
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2020-07-20T01:06:54.000Z
CVE-2020-15843 
ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client\, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal\. The folder permissions allow "Full Control" to "Everyone". An authenticated local attacker can exploit this to replace the TSClientB.exe binary in the Terminal directory, which is executed on logon for every user. Alternatively, the attacker can replace any of the binaries in the Client or Install directories. The latter requires additional user interaction, for example starting the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T22:16:43.000Z
CVE-2020-15849 
Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for authorization bypass and taking over additional accounts by means of modifying password-reset tokens stored in the database. Remote command execution is also possible by leveraging this to abuse the Yii framework's bizRule functionality, allowing for arbitrary PHP code to be executed by the application. Remote command execution is also possible by using this together with a separate insecure file upload vulnerability (CVE-2020-15488).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T18:28:20.000Z
CVE-2020-15850 
Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gain root privileges. This occurs because the database containing the users of the web application and the password-recovery secret value is readable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T20:23:24.000Z
CVE-2020-15851 
Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access unencrypted backup repositories and the Nakivo Controller configuration via a network accessible transporter service. It is also possible to create or delete backup repositories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T20:24:52.000Z
CVE-2020-15852 
An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-20T18:54:52.000Z
CVE-2020-15853 
supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: supybot-fedora
Published: 2022-10-18T00:00:00.000Z
CVE-2020-15855 
Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: bodhi
Published: 2022-10-07T00:00:00.000Z
CVE-2020-15858 
Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:P/A:L/C:H/I:H/PR:N/S:U/UI:R
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 6.2
baseSeverity: MEDIUM
Published: 2020-08-21T00:00:00.000Z
CVE-2020-15859 
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T15:25:03.000Z
CVE-2020-15860 
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T16:01:41.000Z
CVE-2020-15861 
Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T18:28:30.000Z
CVE-2020-15862 
Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T00:00:00.000Z
CVE-2020-15863 
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T15:40:29.000Z
CVE-2020-15864 
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-17T19:42:49.000Z
CVE-2020-15865 
A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled and executed on the server that processes this file. This can be used to fully compromise the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-18T20:02:51.000Z
CVE-2020-15866 
mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. It can be triggered via the stack_copy function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T14:54:09.000Z
CVE-2020-15867 
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T13:04:43.000Z
CVE-2020-15868 
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-12T21:20:40.000Z