yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-21572: Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, allows attackers to cause a denial of service.
Key phrases: cause a denial of service, buffer overflow
CVE-2020-21573: An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted image file.
Key phrases: cause a denial of service via a crafted
CVE-2020-21574: Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is passed to the delimitedread function.
Key phrases: cause a denial of service via a long, buffer overflow
CVE-2020-2158: Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21583: An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.
Key phrases: execute arbitrary commands, gain escalated privlidges or execute arbitrary commands via
CVE-2020-21585: Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module.
Key phrases: upload webshells via zip plugin module
CVE-2020-21588: Buffer overflow in Core FTP LE v2.2 allows local attackers to cause a denial or service (crash) via a long string in the Setup->Users->Username editbox.
Key phrases: cause a denial or service (crash), buffer overflow, denial of service
CVE-2020-2159: Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands on the Jenkins master, job configure access, arbitrary os command
CVE-2020-21590: Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter.
Key phrases: list files in arbitrary directories via the dir, directory traversal
CVE-2020-21594: libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21595: libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21596: libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file.
Key phrases: global buffer overflow
CVE-2020-21597: libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21598: libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21599: libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-2160: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Key phrases: craft URLs that allow bypassing CSRF protection of, bypassing CSRF protection of any target URL, csrf protection
CVE-2020-21600: libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21601: libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafted a file.
Key phrases: stack buffer overflow
CVE-2020-21602: libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21603: libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow
CVE-2020-21604: libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow fault
CVE-2020-21605: libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file.
Key phrases: segmentation fault
CVE-2020-21606: libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file.
Key phrases: heap buffer overflow fault
CVE-2020-2161: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
Key phrases: stored xss
CVE-2020-2162: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.
Key phrases: stored xss, file upload
CVE-2020-21627: Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current_action.php?action=reboot, which allows attackers to cause a denial of service (DoS) via unspecified vectors.
Key phrases: denial of service (DoS), cause a denial of service (DoS), ruijie rg-uac commit, denial of service (dos), unspecified vectors
CVE-2020-2163: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.
Key phrases: stored xss
CVE-2020-21639: Ruijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS) vulnerability via the rule_name parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2020-2164: Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-21641: Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.
Key phrases: read arbitrary files, out-of-band xml external entity (oob-xxe)
CVE-2020-21642: Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.
Key phrases: run arbitrary code, directory traversal
CVE-2020-21643: Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
Key phrases: run arbitrary code, run arbitrary code via the callback parameter to, cross site scripting (xss)
CVE-2020-21648: WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php.
Key phrases: arbitrary file deletion
CVE-2020-21649: Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \\controller\\index.php, which can be exploited via the sql() method.
Key phrases: server-side request forgery (ssrf), server side request forgery
CVE-2020-2165: Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21650: Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\Config.php, which can be exploited via the add() method.
Key phrases: remote code execution (rce)
CVE-2020-21651: Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\point.php, which can be exploited via the add() method.
Key phrases: remote code execution (rce)
CVE-2020-21652: Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\Config.php, which can be exploited via the addqq() method.
Key phrases: remote code execution (rce)
CVE-2020-21653: Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \\controller\\index.php, which can be exploited via the sj() method.
Key phrases: server-side request forgery (ssrf), server side request forgery
CVE-2020-21654: emlog v6.0 contains a vulnerability in the component admin\\template.php, which allows attackers to getshell via a crafted Zip file.
Key phrases: getshell via a crafted Zip file, emlog
CVE-2020-21656: XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.
Key phrases: stored cross-site scripting (xss)
CVE-2020-21658: A Cross-Site Request Forgery (CSRF) in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a crafted URL.
Key phrases: arbitrarily add administrator accounts via a crafted URL, cross-site request forgery (csrf)
CVE-2020-2166: Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21662: SQL injection vulnerability in yunyecms 2.0.2 allows remote attackers to run arbitrary SQL commands via XFF.
Key phrases: run arbitrary SQL commands, run arbitrary SQL commands via XFF, sql injection
CVE-2020-21665: In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh.
Key phrases: malicious parameter, sql injection
CVE-2020-21667: In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection.
Key phrases: sql injection
CVE-2020-2167: Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21674: Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (out-of-bounds write in heap memory resulting into a crash) via a crafted archive file. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.
Key phrases: denial of service (out-of-bounds write in heap memory resulting into a crash), cause a denial of service (out-, heap-based buffer overflow, heap based buffer overflow, out of bounds write
CVE-2020-21675: A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), stack-based buffer overflow, denial of service (dos), stack based buffer overflow
CVE-2020-21676: A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), stack-based buffer overflow, denial of service (dos), stack based buffer overflow
CVE-2020-21677: A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a denial of service (DOS) via converting a crafted PNG file into Sixel format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-21678: A global buffer overflow in the genmp_writefontmacro_latex component in genmp.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into mp format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), buffer overflow, denial of service (dos)
CVE-2020-21679: Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote attackers to cause a denial of service via converting of crafted image file to pcx format.
Key phrases: cause a denial of service via converting of, buffer overflow
CVE-2020-2168: Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21680: A stack-based buffer overflow in the put_arrow() component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pict2e format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), stack-based buffer overflow, denial of service (dos), stack based buffer overflow
CVE-2020-21681: A global buffer overflow in the set_color component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), buffer overflow, denial of service (dos)
CVE-2020-21682: A global buffer overflow in the set_fill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), buffer overflow, denial of service (dos)
CVE-2020-21683: A global buffer overflow in the shade_or_tint_name_after_declare_color in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), buffer overflow, denial of service (dos)
CVE-2020-21684: A global buffer overflow in the put_font in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pict2e format.
Key phrases: denial of service (DOS), cause a denial of service (DOS), buffer overflow, denial of service (dos)
CVE-2020-21685: Buffer Overflow vulnerability in hash_findi function in hashtbl.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.
Key phrases: cause a denial of service via crafted asm, buffer overflow
CVE-2020-21686: A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file.
Key phrases: cause a denial of service via crafted asm, stack-use-after-scope issue
CVE-2020-21687: Buffer Overflow vulnerability in scan function in stdscan.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.
Key phrases: cause a denial of service via crafted asm, buffer overflow
CVE-2020-21688: A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, heap-use-after-free, use after free
CVE-2020-2169: A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
Key phrases: reflected xss
CVE-2020-21697: A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file.
Key phrases: denial of service (DOS), cause a denial of service (DOS), heap-use-after-free, denial of service (dos), use after free
CVE-2020-21699: The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests.
Key phrases: integer overflow, sensitive information
CVE-2020-2170: Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting in a stored XSS vulnerability.
Key phrases: stored xss
CVE-2020-2171: Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-21710: A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted PDF file.
Key phrases: cause a denial of service via opening of, divide by zero issue
CVE-2020-2172: Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-21722: Buffer Overflow vulnerability in oggvideotools 0.9.1 allows remote attackers to run arbitrary code via opening of crafted ogg file.
Key phrases: run arbitrary code, run arbitrary code via opening of crafted ogg, buffer overflow
CVE-2020-21723: A Segmentation Fault issue discovered StreamSerializer::extractStreams function in streamSerializer.cpp in oggvideotools 0.9.1 allows remote attackers to cause a denial of service (crash) via opening of crafted ogg file.
Key phrases: denial of service (crash), cause a denial of service (crash), segmentation fault
CVE-2020-21724: Buffer Overflow vulnerability in ExtractorInformation function in streamExtractor.cpp in oggvideotools 0.9.1 allows remaote attackers to run arbitrary code via opening of crafted ogg file.
Key phrases: run arbitrary code, run arbitrary code via opening of crafted ogg, buffer overflow
CVE-2020-21725: OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid parameter.
Key phrases: sql injection
CVE-2020-21726: OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the cid parameter.
Key phrases: sql injection
CVE-2020-21729: JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2020-2173: Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content.
Key phrases: xss
CVE-2020-21731: Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code.
Key phrases: cross site scripting (xss)
CVE-2020-21732: Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename.
Key phrases: cross site scripting (xss)
CVE-2020-21733: Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.
Key phrases: xss
CVE-2020-2174: Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a reflected cross-site scripting vulnerability.
Key phrases: cross-site scripting
CVE-2020-2175: Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2176: Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.
Key phrases: cross-site scripting (xss)
CVE-2020-2177: Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-2178: Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-21783: In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
Key phrases: cross site scripting (xss)
CVE-2020-21784: phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
Key phrases: code injection
CVE-2020-21785: In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.
Key phrases: command injection
CVE-2020-21786: In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
Key phrases: arbitrary file inclusion, getshell
CVE-2020-21787: CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
Key phrases: file upload getshell
CVE-2020-21788: In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.
Key phrases: ssrf
CVE-2020-2179: Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-2180: Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21806: SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php..
Key phrases: sql injection
CVE-2020-21808: SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
Key phrases: sql injection
CVE-2020-21809: SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
Key phrases: sql injection
CVE-2020-2181: Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.
CVE-2020-21813: A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114.
Key phrases: heap based buffer overflow
CVE-2020-21814: A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97.
Key phrases: heap based buffer overflow
CVE-2020-21815: A null pointer deference issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114, which causes a denial of service (application crash).
Key phrases: denial of service (application crash), null pointer deference issue
CVE-2020-21816: A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46.
Key phrases: buffer overflow
CVE-2020-21817: A null pointer dereference issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:29. which causes a denial of service (application crash).
Key phrases: denial of service (application crash), null pointer dereference issue
CVE-2020-21818: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48.
Key phrases: heap based buffer overflow
CVE-2020-21819: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641via htmlescape ../../programs/escape.c:51.
Key phrases: heap based buffer overflow
CVE-2020-2182: Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.
CVE-2020-21827: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2379.
Key phrases: heap based buffer overflow
CVE-2020-2183: Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access.
Key phrases: copy artifacts from jobs they have no permission, improper permission checks, improper permissions
CVE-2020-21830: A heap based buffer overflow vulneraibility exists in GNU LibreDWG 0.10 via bit_calc_CRC ../../src/bits.c:2213.
Key phrases: heap based buffer overflow
CVE-2020-21831: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.
Key phrases: heap based buffer overflow
CVE-2020-21832: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2417.
Key phrases: heap based buffer overflow
CVE-2020-21833: A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:2440.
Key phrases: heap based buffer overflow
CVE-2020-21834: A null pointer deference issue exists in GNU LibreDWG 0.10 via get_bmp ../../programs/dwgbmp.c:164.
Key phrases: null pointer deference issue
CVE-2020-21835: A null pointer deference issue exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2337.
Key phrases: null pointer deference issue
CVE-2020-21836: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_preview ../../src/decode.c:3175.
Key phrases: heap based buffer overflow
CVE-2020-21838: A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:2842.
Key phrases: heap based buffer overflow
CVE-2020-21839: An issue was discovered in GNU LibreDWG 0.10. Crafted input will lead to an memory leak in dwg_decode_eed ../../src/decode.c:3638.
Key phrases: memory leak
CVE-2020-2184: A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
Key phrases: create and manipulate tags, cross-site request forgery, cross site request forgery
CVE-2020-21840: A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985.
Key phrases: heap based buffer overflow
CVE-2020-21841: A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135.
Key phrases: heap based buffer overflow
CVE-2020-21842: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.
Key phrases: heap based buffer overflow
CVE-2020-21843: A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318.
Key phrases: heap based buffer overflow
CVE-2020-21844: GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. The impact is: execute arbitrary code (remote). The component is: read_2004_section_header ../../src/decode.c:2580.
Key phrases: execute arbitrary code, memcpy-param-overlap, execute arbitrary code (remote)
CVE-2020-21845: Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
Key phrases: HTML Injection in the 'admin dashboard Manage, html injection
CVE-2020-2185: Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks.
Key phrases: man in the middle
CVE-2020-21854: Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page.
Key phrases: cross site scripting
CVE-2020-2186: A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances.
Key phrases: provision instances, cross-site request forgery, cross site request forgery
CVE-2020-21861: File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.
Key phrases: execute arbitrary php code, execute arbitrary php code via duxcms/AdminUpload, file upload, executing arbitrary php code
CVE-2020-21862: Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del.
Key phrases: delete arbitrary files, delete arbitrary files via /admin/AdminBackup/, directory traversal
CVE-2020-21865: ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.
Key phrases: remote code execution (rce)
CVE-2020-2187: Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks.
Key phrases: hostname validation, man-in-the-middle, man in the middle
CVE-2020-2188: A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2020-21881: Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.
Key phrases: modtify application data via article/admin/, cross site request forgery (csrf)
CVE-2020-21883: Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover.
Key phrases: os command injection, device takeover
CVE-2020-21884: Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.
Key phrases: cross-site request forgery (csrf), cross site request forgery
CVE-2020-2189: Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21890: Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impact(s) via opening of crafted PDF document.
Key phrases: cause a denial of service or other unspecified, buffer overflow, unspecified impact(s)
CVE-2020-21896: A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers to cause a denial of service via opening of a crafted PDF file.
Key phrases: cause a denial of service via opening of, use after free
CVE-2020-2190: Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-2191: Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels.
Key phrases: adding and removing agent labels
CVE-2020-21913: International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
Key phrases: use after free bug
CVE-2020-2192: A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels.
Key phrases: add or remove agent labels, cross-site request forgery, cross site request forgery
CVE-2020-21929: A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, stored cross site scripting (xss)
CVE-2020-2193: Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-21930: A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, stored cross site scripting (xss)
CVE-2020-21932: A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized token and uid.
Key phrases: bypass login and obtain a partially authorized token, obtain a partially authorized token and uid.
CVE-2020-21933: An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar package.
CVE-2020-21934: An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypassed.
Key phrases: authentication
CVE-2020-21935: A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, command injection
CVE-2020-21936: An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetStationSettings, GetWebsiteFilterSettings and GetNetworkSettings without authentication.
Key phrases: access the components GetStationSettings, getmultiplehnaps
CVE-2020-21937: An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary system commands.
Key phrases: execute arbitrary system commands, command injection
CVE-2020-2194: Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-2195: Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.
Key phrases: cross-site scripting
CVE-2020-2196: Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
Key phrases: perform all administrative actions provided by the plugin, csrf protection
CVE-2020-21967: File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page.
Key phrases: run arbitrary code, run arbitrary code via the add new file, file upload
CVE-2020-2197: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.
CVE-2020-21976: An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands.
Key phrases: execute arbitrary commands, webshell and execute arbitrary commands, arbitrary file upload
CVE-2020-2198: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.
CVE-2020-21987: HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session.
Key phrases: execute arbitrary HTML, cross site scripting (xss), arbitrary html
CVE-2020-21989: HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Key phrases: perform certain actions via HTTP requests without performing, cross site request forgery (csrf), administrative privileges
CVE-2020-2199: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
Key phrases: cross-site scripting
CVE-2020-21990: Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this, via a specially crafted request to gain access to sensitive information.
Key phrases: gain access, information disclosure, sensitive information, improper access control, access sensitive information
CVE-2020-21991: AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in changeparams.php script. Setting the autologin value to 1 allows an unauthenticated attacker to permanently disable the authentication security control and access the management interface with admin privileges without providing credentials.
Key phrases: authentication bypass, permanently disable the authentication security control and access
CVE-2020-21992: Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due to the 'par' POST parameter not being sanitized when called with the 'testemail' module through web.cgi binary. The vulnerable CGI binary (ELF 32-bit LSB executable, ARM) is calling the 'sh' executable via the system() function to issue a command using the mailx service and its vulnerable string format parameter allowing for OS command injection with root privileges. An attacker can remotely execute system commands as the root user using default credentials and bypass access controls in place.
Key phrases: bypass access controls, for OS command injection with root privileges, remote command injection, os command injection, default credentials,
CVE-2020-21993: In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
Key phrases: execute arbitrary HTML code
CVE-2020-21994: AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file '/xml/authClients.xml' and obtain administrative login information that allows for a successful authentication bypass attack.
Key phrases: bypass attack, authentication bypass, obtain administrative login information, issue a request to an unprotected directory that, for a successful authentication bypass attack, clear-text credentials disclosure, clear text credentials
CVE-2020-21995: Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the system.
Key phrases: gain Telnet, SSH and FTP access, hardcoded credentials
CVE-2020-21996: AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to cause a denial of service scenario.
Key phrases: unauthenticated reboot command execution, denial of service scenario
CVE-2020-21997: Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control.
Key phrases: authentication bypass, unauthenticated database backup download, information disclosure, session hijacking, full system control
CVE-2020-21998: In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.
CVE-2020-21999: iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.
Key phrases: execute arbitrary shell commands, authenticated os command injection, default credentials,
CVE-2020-2200: Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master.
Key phrases: os command injection
CVE-2020-22000: HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'set_command_on' and 'set_command_off' POST parameters in '/system/systemplugins/customcommand/customcommand.plugin.php' by using an unsanitized PHP exec() function.
Key phrases: execute arbitrary shell commands, authenticated os command execution, csrf
CVE-2020-22001: HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopback) IP address value allowing remote control of the smart home solution.
Key phrases: authentication bypass, remote control of the smart home solution, spoofing
CVE-2020-22002: An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.
Key phrases: unauthenticated server-side request forgery (ssrf)
CVE-2020-22007: OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges.
Key phrases: execute arbitrary commands, interrupt the boot sequence and execute arbitrary commands, os command injection, root privilege
CVE-2020-2201: Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22015: Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code.
Key phrases: execute arbitrary code, obtain sensitive information, buffer overflow, denial of service
CVE-2020-22016: A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other potential consequences.
Key phrases: buffer overflow, memory corruption, consequences
CVE-2020-22017: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22019: Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service.
Key phrases: buffer overflow, denial of service
CVE-2020-2202: A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2020-22020: Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service.
Key phrases: buffer overflow, denial of service
CVE-2020-22021: Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service.
Key phrases: buffer overflow, denial of service
CVE-2020-22022: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22023: A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22024: Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c, which could let a remote malicious user cause Denial of Service.
Key phrases: buffer overflow, denial of service
CVE-2020-22025: A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22026: Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a Denial of Service.
Key phrases: buffer overflow, denial of service
CVE-2020-22027: A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22028: Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service.
Key phrases: buffer overflow, denial of service
CVE-2020-22029: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences