saikiranpennam/new_cves_pps huggingface dataset:
Explain the vulnerability: CVE-2020-17106
Description:HEVC Video Extensions Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17014
Description:Windows Print Spooler Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17444
Description:An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv6 extension headers are valid) doesn't check whether the header extension length field would overflow. Therefore, if it wraps around to zero, iterating through the extension headers will not increment the current data pointer. This leads to an infinite loop and Denial-of-Service in pico_ipv6_check_headers_sequence() in pico_ipv6.c.
Explain the vulnerability: CVE-2020-17468
Description:An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check for a valid length of an extension header, and therefore an out-of-bounds read can occur in _fnet_ip6_ext_header_handler_options in fnet_ip6.c, leading to Denial-of-Service.
Explain the vulnerability: CVE-2020-17038
Description:Win32k Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17096
Description:Windows NTFS Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17429
Description:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11337.
Explain the vulnerability: CVE-2020-17079
Description:Raw Image Extension Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17137
Description:DirectX Graphics Kernel Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17422
Description:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11195.
Explain the vulnerability: CVE-2020-17530
Description:Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Explain the vulnerability: CVE-2020-17475
Description:Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
Explain the vulnerability: CVE-2020-17025
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17526
Description:Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
Explain the vulnerability: CVE-2020-17033
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17121
Description:Microsoft SharePoint Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17048
Description:Chakra Scripting Engine Memory Corruption Vulnerability
Explain the vulnerability: CVE-2020-17418
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZIX files. A crafted id in a channel element can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11197.
Explain the vulnerability: CVE-2020-17361
Description:An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided (instead of throwing an exception). This could result in data being lost during the copy, with varying consequences depending on the subsequent use of the destination buffer. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Explain the vulnerability: CVE-2020-17398
Description:This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-11302.
Explain the vulnerability: CVE-2020-17091
Description:Microsoft Teams Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17496
Description:vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
Explain the vulnerability: CVE-2020-17029
Description:Windows Canonical Display Driver Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17479
Description:jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
Explain the vulnerability: CVE-2020-17480
Description:TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
Explain the vulnerability: CVE-2020-17087
Description:Windows Kernel Local Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17068
Description:Windows GDI+ Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17438
Description:An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.
Explain the vulnerability: CVE-2020-17443
Description:An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this, the operation that calculates the size of the ICMPv6 echo replies has an integer wrap around, leading to memory corruption and, eventually, Denial-of-Service in pico_icmp6_send_echoreply_not_frag in pico_icmp6.c.
Explain the vulnerability: CVE-2020-17156
Description:Visual Studio Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17506
Description:Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
Explain the vulnerability: CVE-2020-17382
Description:The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).
Explain the vulnerability: CVE-2020-17414
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-11229.
Explain the vulnerability: CVE-2020-17044
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17551
Description:ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
Explain the vulnerability: CVE-2020-17101
Description:HEIF Image Extensions Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17394
Description:This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the OEMNet component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11132.
Explain the vulnerability: CVE-2020-17402
Description:This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. By examining a log file, an attacker can disclose a memory address. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11063.
Explain the vulnerability: CVE-2020-17005
Description:Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Explain the vulnerability: CVE-2020-17510
Description:Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Explain the vulnerability: CVE-2020-17140
Description:Windows SMB Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17454
Description:WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.
Explain the vulnerability: CVE-2020-17141
Description:Microsoft Exchange Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17053
Description:Internet Explorer Memory Corruption Vulnerability
Explain the vulnerability: CVE-2020-17403
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11003.
Explain the vulnerability: CVE-2020-17395
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the prl_naptd process. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11134.
Explain the vulnerability: CVE-2020-17415
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.35798. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit PhantomPDF Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-11308.
Explain the vulnerability: CVE-2020-17045
Description:Windows KernelStream Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17100
Description:Visual Studio Tampering Vulnerability
Explain the vulnerability: CVE-2020-17383
Description:A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote configuration of the device through the WebUI.
Explain the vulnerability: CVE-2020-17012
Description:Windows Bind Filter Driver Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17442
Description:An issue was discovered in picoTCP 1.7.0. The code for parsing the hop-by-hop IPv6 extension headers does not validate the bounds of the extension header length value, which may result in Integer Wraparound. Therefore, a crafted extension header length value may cause Denial-of-Service because it affects the loop in which the extension headers are parsed in pico_ipv6_process_hopbyhop() in pico_ipv6.c.
Explain the vulnerability: CVE-2020-17069
Description:Windows NDIS Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17439
Description:An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata() in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query with a transaction ID that matches the transaction ID of an incoming reply. Provided that the default DNS cache is quite small (only four records) and that the transaction ID has a very limited set of values that is quite easy to guess, this can lead to DNS cache poisoning.
Explain the vulnerability: CVE-2020-17497
Description:eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4.
Explain the vulnerability: CVE-2020-17028
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17478
Description:ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.
Explain the vulnerability: CVE-2020-17090
Description:Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17458
Description:A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.
Explain the vulnerability: CVE-2020-17399
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11303.
Explain the vulnerability: CVE-2020-17376
Description:An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.
Explain the vulnerability: CVE-2020-17360
Description:An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h contains multiple boundary checks that are performed to prevent out-of-bounds memory read/write. However, two of these boundary checks contain an integer overflow that leads to a bypass of these checks, and out-of-bounds read/write. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Explain the vulnerability: CVE-2020-17419
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11192.
Explain the vulnerability: CVE-2020-17120
Description:Microsoft SharePoint Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17435
Description:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11358.
Explain the vulnerability: CVE-2020-17065
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17462
Description:CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
Explain the vulnerability: CVE-2020-17531
Description:A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Explain the vulnerability: CVE-2020-17024
Description:Windows Client Side Rendering Print Provider Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17136
Description:Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17073
Description:Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17423
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of ARW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11196.
Explain the vulnerability: CVE-2020-17119
Description:Microsoft Outlook Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17508
Description:The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.
Explain the vulnerability: CVE-2020-17158
Description:Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17436
Description:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11432.
Explain the vulnerability: CVE-2020-17066
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17089
Description:Microsoft SharePoint Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17123
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17031
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17477
Description:Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP password hashes (sambaNTPassword, krb5Key, sambaPasswordHistory, and pwhistory) via LDAP search requests. For example, a teacher can gain administrator access via an NTLM hash.
Explain the vulnerability: CVE-2020-17027
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17498
Description:In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ4 decompression.
Explain the vulnerability: CVE-2020-17162
Description:Microsoft Windows Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17070
Description:Windows Update Medic Service Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17135
Description:Azure DevOps Server Spoofing Vulnerability
Explain the vulnerability: CVE-2020-17142
Description:Microsoft Exchange Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17457
Description:Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FILE_INIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages.
Explain the vulnerability: CVE-2020-17007
Description:Windows Error Reporting Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17115
Description:Microsoft SharePoint Server Spoofing Vulnerability
Explain the vulnerability: CVE-2020-17400
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11304.
Explain the vulnerability: CVE-2020-17396
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11217.
Explain the vulnerability: CVE-2020-17103
Description:Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17416
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11497.
Explain the vulnerability: CVE-2020-17046
Description:Windows Error Reporting Denial of Service Vulnerability
Explain the vulnerability: CVE-2020-17380
Description:A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
Explain the vulnerability: CVE-2020-17504
Description:The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.
Explain the vulnerability: CVE-2020-17011
Description:Windows Port Class Library Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17085
Description:Microsoft Exchange Server Denial of Service Vulnerability
Explain the vulnerability: CVE-2020-17528
Description:Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
Explain the vulnerability: CVE-2020-17482
Description:An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory.
Explain the vulnerability: CVE-2020-17752
Description:Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart contract implemented at address 0xB49E984A83d7A638E7F2889fc8328952BA951AbE, an implementation for MillionCoin (MON).
Explain the vulnerability: CVE-2020-17139
Description:Windows Overlay Filter Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17355
Description:Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (restart of agents) by crafting a malformed DHCP packet which leads to an incorrect route being installed.
Explain the vulnerability: CVE-2020-17354
Description:LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.
Explain the vulnerability: CVE-2020-17092
Description:Windows Network Connections Service Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17138
Description:Windows Error Reporting Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17753
Description:An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount of tokens to an arbitrary address.
Explain the vulnerability: CVE-2020-17495
Description:django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
Explain the vulnerability: CVE-2020-17529
Description:Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying and invalid fragmentation offset value specified in the IP header. This is only impacts builds with both CONFIG_EXPERIMENTAL and CONFIG_NET_TCP_REASSEMBLY build flags enabled.
Explain the vulnerability: CVE-2020-17483
Description:An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have been deployed.
Explain the vulnerability: CVE-2020-17084
Description:Microsoft Exchange Server Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17010
Description:Win32k Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17440
Description:An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain name bytes in DNS response packets when a name lacks this termination, and eventually leads to dereferencing the pointer at an invalid/arbitrary address, within newdata() and parse_name() in resolv.c.
Explain the vulnerability: CVE-2020-17381
Description:An issue was discovered in Ghisler Total Commander 9.51. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the %SYSTEMDRIVE%\totalcmd\TOTALCMD64.EXE binary.
Explain the vulnerability: CVE-2020-17102
Description:WebP Image Extensions Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17047
Description:Windows Network File System Denial of Service Vulnerability
Explain the vulnerability: CVE-2020-17397
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the handling of network packets. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11253.
Explain the vulnerability: CVE-2020-17401
Description:This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the VGA virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated array. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11363.
Explain the vulnerability: CVE-2020-17952
Description:A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
Explain the vulnerability: CVE-2020-17456
Description:SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.
Explain the vulnerability: CVE-2020-17006
Description:Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Explain the vulnerability: CVE-2020-17071
Description:Windows Delivery Optimization Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17421
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11194.
Explain the vulnerability: CVE-2020-17564
Description:Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component.
Explain the vulnerability: CVE-2020-17476
Description:Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
Explain the vulnerability: CVE-2020-17026
Description:Windows Remote Access Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17533
Description:Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
Explain the vulnerability: CVE-2020-17163
Description:Visual Studio Code Python Extension Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17030
Description:Windows MSCTF Server Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17525
Description:Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7
Explain the vulnerability: CVE-2020-17067
Description:Microsoft Excel Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17088
Description:Windows Common Log File System Driver Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17122
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17509
Description:ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.
Explain the vulnerability: CVE-2020-17159
Description:Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17362
Description:search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
Explain the vulnerability: CVE-2020-17118
Description:Microsoft SharePoint Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17514
Description:Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
Explain the vulnerability: CVE-2020-17451
Description:flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
Explain the vulnerability: CVE-2020-17001
Description:Windows Print Spooler Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17113
Description:Windows Camera Codec Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17056
Description:Windows Network File System Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17390
Description:This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the hypervisor kernel extension. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-10030.
Explain the vulnerability: CVE-2020-17105
Description:AV1 Video Extension Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17410
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11135.
Explain the vulnerability: CVE-2020-17040
Description:Windows Hyper-V Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17386
Description:Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
Explain the vulnerability: CVE-2020-17017
Description:Microsoft SharePoint Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17129
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17083
Description:Microsoft Exchange Server Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17484
Description:An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.
Explain the vulnerability: CVE-2020-17353
Description:scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
Explain the vulnerability: CVE-2020-17148
Description:Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17518
Description:Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Explain the vulnerability: CVE-2020-17373
Description:SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.
Explain the vulnerability: CVE-2020-17365
Description:Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.
Explain the vulnerability: CVE-2020-17109
Description:HEVC Video Extensions Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17430
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11332.
Explain the vulnerability: CVE-2020-17060
Description:Microsoft SharePoint Server Spoofing Vulnerability
Explain the vulnerability: CVE-2020-17125
Description:Microsoft Excel Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17037
Description:Windows WalletService Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17467
Description:An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.
Explain the vulnerability: CVE-2020-17522
Description:When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
Explain the vulnerability: CVE-2020-17021
Description:Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Explain the vulnerability: CVE-2020-17534
Description:There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file: https://github.com/apache/netbeans-html4j/commit/fa70e507e5555e1adb4f6518479fc408a7abd0e6
Explain the vulnerability: CVE-2020-17076
Description:Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17426
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11230.
Explain the vulnerability: CVE-2020-17133
Description:Microsoft Dynamics Business Central/NAV Information Disclosure
Explain the vulnerability: CVE-2020-17099
Description:Windows Lock Screen Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17563
Description:Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id=".
Explain the vulnerability: CVE-2020-17077
Description:Windows Update Stack Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2020-17427
Description:This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11334.
Explain the vulnerability: CVE-2020-17132
Description:Microsoft Exchange Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2020-17098
Description:Windows GDI+ Information Disclosure Vulnerability
Explain the vulnerability: CVE-2020-17470
Description:An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.
Explain the vulnerability: CVE-2020-17020
Description:Microsoft Word Security Feature Bypass Vulnerability
Explain the vulnerability: CVE-2020-17759
Description:An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.
Explain the vulnerability: CVE-2020-17036
Description:Windows Function Discovery SSDP Provider Information Disclosure Vulnerability