stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2020-23574 (severity: MEDIUM, weakness: CWE-119)
When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uploadfile_name1.htm form to a length of 368 or more bytes. This will create a buffer overflow condition, causing the application to crash.
CVE-2020-23575 (severity: HIGH, weakness: CWE-22)
A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.
CVE-2020-23576 (severity: MEDIUM, weakness: CWE-79)
Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
CVE-2020-23580 (severity: CRITICAL, weakness: NVD-CWE-Other)
Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.
CVE-2020-23582 (severity: MEDIUM, weakness: CWE-352)
A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID.
CVE-2020-23583 (severity: CRITICAL, weakness: CWE-77)
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.
CVE-2020-23584 (severity: CRITICAL, weakness: CWE-77)
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.
CVE-2020-23585 (severity: HIGH, weakness: CWE-352)
A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network".
CVE-2020-23586 (severity: MEDIUM, weakness: CWE-352)
A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule.
CVE-2020-23587 (severity: LOW, weakness: CWE-352)
A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ".
CVE-2020-23588 (severity: MEDIUM, weakness: CWE-352)
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp ".
CVE-2020-23589 (severity: MEDIUM, weakness: CWE-352)
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to cause a Denial of Service by Rebooting the router through " /mgm_dev_reboot.asp."
CVE-2020-23590 (severity: MEDIUM, weakness: CWE-352)
A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack to change the Password for "WLAN SSID" through "wlwpa.asp".
CVE-2020-23591 (severity: CRITICAL, weakness: CWE-434)
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor.
CVE-2020-23592 (severity: HIGH, weakness: CWE-352)
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.
CVE-2020-23593 (severity: MEDIUM, weakness: CWE-352)
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through ' /mgm_log_cfg.asp.' The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.
CVE-2020-23595 (severity: HIGH, weakness: CWE-352)
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
CVE-2020-23617 (severity: MEDIUM, weakness: CWE-79)
A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary web scripts or HTML via SCRIPT element.
CVE-2020-23618 (severity: MEDIUM, weakness: CWE-79)
A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page.
CVE-2020-23620 (severity: CRITICAL, weakness: CWE-502)
The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.
CVE-2020-23621 (severity: CRITICAL, weakness: CWE-502)
The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.
CVE-2020-23622 (severity: HIGH, weakness: CWE-918)
An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header
CVE-2020-23630 (severity: HIGH, weakness: CWE-89)
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
CVE-2020-23631 (severity: MEDIUM, weakness: CWE-352)
Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via the tongji parameter.
CVE-2020-23639 (severity: CRITICAL, weakness: CWE-77)
A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commands in Moxa's VPort 461 Series Industrial Video Servers.
CVE-2020-23643 (severity: MEDIUM, weakness: CWE-79)
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
CVE-2020-23644 (severity: MEDIUM, weakness: CWE-79)
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
CVE-2020-23647 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form.
CVE-2020-23648 (severity: HIGH, weakness: CWE-306)
Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator password without any authentication.
CVE-2020-23653 (severity: CRITICAL, weakness: CWE-502)
An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.
CVE-2020-23654 (severity: MEDIUM, weakness: CWE-79)
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."
CVE-2020-23655 (severity: MEDIUM, weakness: CWE-79)
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
CVE-2020-23656 (severity: MEDIUM, weakness: CWE-79)
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
CVE-2020-23657 (severity: MEDIUM, weakness: CWE-79)
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
CVE-2020-23658 (severity: MEDIUM, weakness: CWE-79)
PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.
CVE-2020-23659 (severity: MEDIUM, weakness: CWE-79)
WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.
CVE-2020-23660 (severity: MEDIUM, weakness: CWE-79)
webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."
CVE-2020-23679 (severity: CRITICAL, weakness: CWE-120)
Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field.
CVE-2020-23680 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibly other undisclosed impacts.
CVE-2020-23685 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to login.php.
CVE-2020-23686 (severity: HIGH, weakness: CWE-352)
Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts.
CVE-2020-23689 (severity: MEDIUM, weakness: CWE-79)
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.
CVE-2020-23691 (severity: CRITICAL, weakness: NVD-CWE-Other)
YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.
CVE-2020-23697 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
CVE-2020-23700 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
CVE-2020-23702 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.
CVE-2020-23705 (severity: MEDIUM, weakness: CWE-120)
A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
CVE-2020-23706 (severity: MEDIUM, weakness: CWE-787)
A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
CVE-2020-23707 (severity: MEDIUM, weakness: CWE-787)
A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
CVE-2020-23710 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.
CVE-2020-23711 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php.
CVE-2020-23715 (severity: HIGH, weakness: CWE-22)
Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download.
CVE-2020-23718 (severity: CRITICAL, weakness: CWE-79)
Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.
CVE-2020-23719 (severity: CRITICAL, weakness: CWE-79)
Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the bbsmeta parameter.
CVE-2020-23721 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.
CVE-2020-23722 (severity: HIGH, weakness: CWE-639)
An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters.
CVE-2020-23726 (severity: MEDIUM, weakness: NVD-CWE-Other)
There is a local denial of service vulnerability in Wise Care 365 5.5.4, attackers can cause computer crash (BSOD).
CVE-2020-23727 (severity: MEDIUM, weakness: NVD-CWE-Other)
There is a local denial of service vulnerability in the Antiy Zhijia Terminal Defense System 5.0.2.10121559 and an attacker can cause a computer crash (BSOD).
CVE-2020-23735 (severity: HIGH, weakness: CWE-862)
In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constructed program to increase user privileges
CVE-2020-23736 (severity: MEDIUM, weakness: NVD-CWE-Other)
There is a local denial of service vulnerability in DaDa accelerator 5.6.19.816,, attackers can use constructed programs to cause computer crashes (BSOD).
CVE-2020-23738 (severity: MEDIUM, weakness: NVD-CWE-Other)
There is a local denial of service vulnerability in Advanced SystemCare 13 PRO 13.5.0.174. Attackers can use a constructed program to cause a computer crash (BSOD)
CVE-2020-23740 (severity: HIGH, weakness: CWE-862)
In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed programs to increase user privileges.
CVE-2020-23741 (severity: MEDIUM, weakness: NVD-CWE-Other)
In AnyView (network police) network monitoring software 4.6.0.1, there is a local denial of service vulnerability in AnyView, attackers can use a constructed program to cause a computer crash (BSOD).
CVE-2020-23754 (severity: CRITICAL, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature.
CVE-2020-23761 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.
CVE-2020-23762 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script via the "titel" column on the "Eintrage hinzufugen" tab.
CVE-2020-23763 (severity: CRITICAL, weakness: CWE-89)
SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication.
CVE-2020-23765 (severity: HIGH, weakness: CWE-434)
A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. If an attacker is able to gain Administrator rights they will be able to use unsafe plugins to upload a backup file and control the server.
CVE-2020-23766 (severity: MEDIUM, weakness: CWE-22)
An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges.
CVE-2020-23768 (severity: HIGH, weakness: NVD-CWE-Other)
An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior to version 5.0.1. If exploited, this vulnerability will allow attackers to obtain users' personally identifiable information including e-mail address and telephone numbers.
CVE-2020-23774 (severity: MEDIUM, weakness: CWE-79)
A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
CVE-2020-23776 (severity: HIGH, weakness: CWE-918)
A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request.
CVE-2020-23790 (severity: CRITICAL, weakness: CWE-434)
An Arbitrary File Upload vulnerability was discovered in the Golo Laravel theme v 1.1.5.
CVE-2020-23793 (severity: HIGH, weakness: CWE-862)
An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects.
CVE-2020-23804 (severity: HIGH, weakness: CWE-674)
Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.
CVE-2020-23811 (severity: HIGH, weakness: NVD-CWE-Other)
xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.
CVE-2020-23814 (severity: MEDIUM, weakness: CWE-79)
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
CVE-2020-23824 (severity: HIGH, weakness: CWE-352)
ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution. The component is the Administration dashboard. When using admin/user credentials, if the admin/user admin opens a website with the malicious page that will run the CSRF.
CVE-2020-23826 (severity: HIGH, weakness: CWE-78)
The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API. NOTE: This may be a duplicate of CVE-2020-10176
CVE-2020-23828 (severity: CRITICAL, weakness: CWE-434)
A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE) on the hosting webserver by uploading a crafted PHP web-shell that bypasses the image upload filters. An attack uses /Online%20Course%20Registration/my-profile.php with the POST parameter photo.
CVE-2020-23829 (severity: HIGH, weakness: CWE-434)
interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution (RCE) on the hosting webserver by uploading a maliciously crafted image.
CVE-2020-23830 (severity: HIGH, weakness: CWE-352)
A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site.
CVE-2020-23831 (severity: MEDIUM, weakness: CWE-79)
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an unauthenticated victim clicks on a malicious URL and enters credentials.
CVE-2020-23832 (severity: MEDIUM, weakness: CWE-79)
A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login.
CVE-2020-23833 (severity: CRITICAL, weakness: CWE-89)
Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request.
CVE-2020-23834 (severity: HIGH, weakness: CWE-732)
Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem.
CVE-2020-23835 (severity: MEDIUM, weakness: CWE-79)
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a malicious URL and begins typing.
CVE-2020-23836 (severity: HIGH, weakness: CWE-352)
A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site.
CVE-2020-23837 (severity: HIGH, weakness: CWE-352)
A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or other) users after an authenticated admin visits a third-party site or clicks on a URL.
CVE-2020-23839 (severity: MEDIUM, weakness: CWE-79)
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.
CVE-2020-23849 (severity: MEDIUM, weakness: CWE-79)
Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
CVE-2020-23851 (severity: MEDIUM, weakness: CWE-787)
A stack-based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c:513:28, which could cause a denial of service by submitting a malicious jpeg image.
CVE-2020-23852 (severity: MEDIUM, weakness: CWE-787)
A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c (line 544 & line 545), which could cause a denial of service by submitting a malicious jpeg image.
CVE-2020-23856 (severity: MEDIUM, weakness: CWE-416)
Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointer variable caller->callee.
CVE-2020-23861 (severity: MEDIUM, weakness: CWE-787)
A heap-based buffer overflow vulnerability exists in LibreDWG 0.10.1 via the read_system_page function at libredwg-0.10.1/src/decode_r2007.c:666:5, which causes a denial of service by submitting a dwg file.
CVE-2020-23864 (severity: HIGH, weakness: NVD-CWE-Other)
An issue exits in IOBit Malware Fighter version 8.0.2.547. Local escalation of privileges is possible by dropping a malicious DLL file into the WindowsApps folder.
CVE-2020-23868 (severity: MEDIUM, weakness: CWE-79)
NeDi 1.9C allows inc/rt-popup.php d XSS.
CVE-2020-23872 (severity: HIGH, weakness: CWE-476)
A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).
CVE-2020-23873 (severity: CRITICAL, weakness: CWE-787)
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.
CVE-2020-23874 (severity: CRITICAL, weakness: CWE-787)
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.
CVE-2020-23876 (severity: HIGH, weakness: CWE-401)
pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.