yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-15316: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree.
Key phrases: hardcoded ecdsa ssh key
CVE-2020-15317: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree.
Key phrases: hardcoded rsa ssh key
CVE-2020-15318: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree.
Key phrases: hardcoded dsa ssh key
CVE-2020-15319: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree.
Key phrases: hardcoded rsa ssh key
CVE-2020-1532: <p>An elevation of privilege vulnerability exists when the Windows InstallService improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows InstallService handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15320: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account.
Key phrases: axiros password
CVE-2020-15321: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account.
Key phrases: axzyxel password
CVE-2020-15322: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account.
Key phrases: hardcoded password
CVE-2020-15323: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials.
Key phrases: password, default credentials, default credentials,
CVE-2020-15324: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.
Key phrases: world-readable, hardcoded credentials
CVE-2020-15325: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.
Key phrases: hardcoded erlang cookie
CVE-2020-15326: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem.
Key phrases: hardcoded certificate
CVE-2020-15327: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
Key phrases: authentication
CVE-2020-15328: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
Key phrases: opt axess var blobstorage permissions
CVE-2020-15329: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
Key phrases: weak data.fs permissions
CVE-2020-1533: <p>An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p><p>To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.</p><p>The security update addresses the vulnerability by ensuring the Windows WalletService properly handles objects in memory.</p>
Key phrases: elevation of privilege, elevation privilege, execute code
CVE-2020-15330: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.
Key phrases: hardcoded app_key
CVE-2020-15331: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
Key phrases: hardcoded oauth_secret_key
CVE-2020-15332: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.
Key phrases: opt axess etc default axess permissions
CVE-2020-15333: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" requests.
Key phrases: discover accounts via MySQL "select * from
CVE-2020-15334: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file.
Key phrases: escape-sequence injection into the /var/
CVE-2020-15335: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests.
Key phrases: authentication, registercpe requests
CVE-2020-15336: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests.
Key phrases: authentication, cnr requests
CVE-2020-15337: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
Key phrases: use of get request method with sensitive query strings
CVE-2020-15338: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
Key phrases: use of get request method with sensitive query strings
CVE-2020-15339: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS.
Key phrases: live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS, xss
CVE-2020-1534: <p>An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15340: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key.
Key phrases: hardcoded
CVE-2020-15341: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.
Key phrases: unauthenticated update_all_realm_license api
CVE-2020-15342: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API.
Key phrases: unauthenticated zy_install_user api
CVE-2020-15343: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API.
Key phrases: unauthenticated zy_install_user_key api
CVE-2020-15344: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.
Key phrases: unauthenticated zy_get_user_id_and_key api
CVE-2020-15345: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.
Key phrases: unauthenticated zy_get_instances_for_update api
CVE-2020-15346: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.
Key phrases: live globals api
CVE-2020-15347: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.
CVE-2020-15348: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code.
Key phrases: use of live/CPEManager/AXCampaignManager/, eval injection
CVE-2020-15349: BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process (copy, move, delete) as root and changing permissions.
Key phrases: any process (copy, local privilege escalation
CVE-2020-1535: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15350: RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the required buffer capacity and validate against the provided buffer size. The base64_estimate_decode_size() function calculates the expected decoded size with an arithmetic round-off error and does not take into account possible padding bytes. Due to this underestimation, it may be possible to craft base64 input that causes a buffer overflow.
Key phrases: buffer overflow
CVE-2020-15351: IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\\\\IDriveWindows with weak folder permissions granting any user modify permission (i.e., NT AUTHORITY\\\\Authenticated Users:(OI)(CI)(M)) to the contents of the directory and its sub-folders. In addition, the program installs a service called IDriveService that runs as LocalSystem. Thus, any standard user can escalate privileges to NT AUTHORITY\\\\SYSTEM by substituting the service's binary with a malicious one.
Key phrases: weak folder permissions, escalate privilege
CVE-2020-15352: An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Key phrases: conduct server-side request forgery (SSRF, xml external entity (xxe), server-side request forgery (ssrf), server side request forgery
CVE-2020-15357: Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell metacharacter in the ping, traceroute, or route options.
Key phrases: execute arbitrary commands, execute arbitrary commands via a shell metacharacter in, shell metacharacters
CVE-2020-15358: In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
Key phrases: multiselectorderby heap overflow
CVE-2020-1536: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15360: com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification.
Key phrases: privilege escalation because of a lack of client, client verification
CVE-2020-15362: wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.
Key phrases: execute arbitrary code, overwrite the default executable/binary path and, code injection
CVE-2020-15363: The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
Key phrases: side-map/?search_order= SQL Injection, sql injection
CVE-2020-15364: The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Key phrases: top-map/?search_location= reflected XSS, reflected xss
CVE-2020-15365: LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\\\\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.
Key phrases: out-of-bounds write, out of bounds write
CVE-2020-15366: An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Key phrases: execution of other code by prototype pollution, denial of service
CVE-2020-15367: Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
Key phrases: brute-force authentication
CVE-2020-15368: AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.
CVE-2020-15369: Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remote host.
Key phrases: obtain the exposed password, gain access, exposed password credentials
CVE-2020-1537: <p>An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p><p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p><p>The security update addresses the vulnerability by ensuring the Windows Remote Access properly handles file operations.</p>
Key phrases: gain elevated privileges.</p><p, elevation of privilege, elevation privilege, code execution
CVE-2020-15370: Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerability is due to incorrectly logging the user password in log files.
Key phrases: view a user password in cleartext
CVE-2020-15371: Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege escalation vulnerability.
Key phrases: code injection, privilege escalation
CVE-2020-15372: A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local authenticated attacker to modify shell variables, which may lead to an escalation of privileges or bypassing the logging.
Key phrases: modify shell variables, escalation of privileges, bypassing the logging, escalation privilege
CVE-2020-15373: Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote unauthenticated attackers to perform various attacks.
Key phrases: perform various attacks, buffer overflow
CVE-2020-15374: Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input.
Key phrases: reflected input
CVE-2020-15375: Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform escalation of privileges.
Key phrases: run arbitrary commands, run arbitrary commands and perform escalation of privileges, input validation weakness, improper input validation, escalation privilege
CVE-2020-15376: Brocade Fabric OS versions before v9.0.0 and after version v8.1.0, configured in Virtual Fabric mode contain a weakness in the ldap implementation that could allow a remote ldap user to login in the Brocade Fibre Channel SAN switch with "user" privileges if it is not associated with any groups.
Key phrases: login in the Brocade Fibre Channel SAN switch, weakness
CVE-2020-15377: Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF).
Key phrases: make requests to arbitrary hosts due to a, server-side request forgery (ssrf)
CVE-2020-15378: The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface.
Key phrases: docker container ports, attack surface
CVE-2020-15379: Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name.
Key phrases: a lack of proper validation, denial-of-service condition, denial of service
CVE-2020-1538: <p>An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows UPnP Device Host handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15380: Brocade SANnav before version 2.1.1 logs account credentials at the trace logging level.
Key phrases: account credentials
CVE-2020-15381: Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the jmx server.
Key phrases: cleartext transmission of authentication credentials of the jmx, improper authentication
CVE-2020-15382: Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password passw0rd if a password is not provided for PostgreSQL at install-time.
Key phrases: weak password
CVE-2020-15383: Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e to consume all memory leading to denial of service impacts possibly including a switch panic.
Key phrases: denial of service impacts
CVE-2020-15384: Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header.
Key phrases: information disclosure
CVE-2020-15385: Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission.
Key phrases: list directories, directory list
CVE-2020-15386: Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower response to CLI commands and other operations.
Key phrases: cpu load, slower response
CVE-2020-15387: The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.
Key phrases: insecure ssh communications, man in the middle
CVE-2020-15388: A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the history command to write arbitrary content to files.
Key phrases: write arbitrary content, abuse the history command to write arbitrary content
CVE-2020-15389: jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.
Key phrases: use-after-free, double-free, use after free, double free
CVE-2020-1539: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15390: pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.
Key phrases: security misconfiguration, improper access control
CVE-2020-15391: The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
Key phrases: execute actions on pods (on behalf of, remote code execution
CVE-2020-15392: A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.
Key phrases: determine if a username is valid or not, user enumeration, brute-force
CVE-2020-15393: In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.
Key phrases: memory leak
CVE-2020-15394: The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution.
Key phrases: Remote Code Execution, sql injection, remote code execution
CVE-2020-15395: In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).
Key phrases: stack-based buffer over-read, off-by-one, buffer over read
CVE-2020-15396: In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.
Key phrases: escalate privilege
CVE-2020-15397: HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
Key phrases: execute code in the context of the user, unprivileged users
CVE-2020-1540: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15400: CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Key phrases: remotely exploitable, xss
CVE-2020-15401: IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junction and an Object Manager symbolic link.
Key phrases: gain privileges, gain privileges for file deletion by manipulating malicious, malicious flagged file locations, ntfs junction, object manager symbolic link
CVE-2020-15408: An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite.
Key phrases: rewrite
CVE-2020-1541: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15411: An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
CVE-2020-15412: An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
Key phrases: send an event contact form
CVE-2020-15415: On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.
Key phrases: remote command execution via shell metacharacters in a
CVE-2020-15416: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703.
Key phrases: bypass authentication, bypass authentication on affected installations of NETGEAR R6700, execute code
CVE-2020-15417: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted gui_region in a string table file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9756.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of NETGEAR, overflow, file upload, execute code
CVE-2020-15418: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.
Key phrases: disclose sensitive information on affected installations of Veeam
CVE-2020-15419: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.
Key phrases: disclose sensitive information on affected installations of Veeam
CVE-2020-1542: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15420: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loader_ajax.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9259.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15421: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the check_ip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9707.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15422: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9731.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15423: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the dominio parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9732.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15424: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9735.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15425: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9742.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15426: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the serverip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9709.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15427: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_disk_usage.php. When parsing the folderName parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9713.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15428: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9714.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15429: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9716.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-1543: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15430: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9736.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15431: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9740.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15432: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the filespace parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9743.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15433: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the phpversion parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9715.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15434: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the canal parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9745.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15435: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_start parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9719.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.
Key phrases: gain privileges, gain privileges or cause a denial of service, use-after-free
CVE-2020-15437: The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized.
Key phrases: cause a denial of service by using the, null pointer dereference
CVE-2020-1544: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-1545: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-1546: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15466: In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations.
Key phrases: infinite loop
CVE-2020-15467: The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execution leading to server compromise.
Key phrases: remote code execution, server compromise
CVE-2020-15468: Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.
Key phrases: SQL Injection via the cart_edit.php active parameter, sql injection
CVE-2020-15469: In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
Key phrases: null pointer dereference
CVE-2020-1547: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15470: ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2020-15471: In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2020-15472: In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2020-15473: In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2020-15474: In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.
Key phrases: stack overflow
CVE-2020-15475: In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
Key phrases: use-after-free, use after free
CVE-2020-15476: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2020-15477: The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.
Key phrases: remote code execution, shell metacharacters
CVE-2020-15478: The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
Key phrases: exposure of sensitive data via SQL errors, sql errors
CVE-2020-15479: An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The driver's IOCTL request handler attempts to copy the input buffer onto the stack without checking its size and can cause a buffer overflow. This could lead to arbitrary Ring-0 code execution and escalation of privileges. This affects DirectIo32.sys and DirectIo64.sys.
Key phrases: buffer overflow, escalation of privileges, code execution, escalation privilege
CVE-2020-1548: <p>An information disclosure vulnerability exists when the Windows WaasMedic Service improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to improperly disclose memory.</p><p>The security update addresses the vulnerability by correcting how the Windows WaasMedic Service handles memory.</p>
Key phrases: gain execution, information disclosure
CVE-2020-15480: An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The kernel driver exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This could lead to arbitrary Ring-0 code execution and escalation of privileges. This affects DirectIo32.sys and DirectIo64.sys.
Key phrases: read and write to arbitrary Model Specific Registers, code execution, escalation of privileges, escalation privilege
CVE-2020-15481: An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. The kernel driver exposes IOCTL functionality that allows low-privilege users to map arbitrary physical memory into the address space of the calling process. This could lead to arbitrary Ring-0 code execution and escalation of privileges. This affects DirectIo32.sys and DirectIo64.sys drivers. This issue is fixed in BurnInTest v9.2, PerformanceTest v10.0 Build 1009, OSForensics v8.0.
Key phrases: map arbitrary physical memory into the address space, code execution, escalation of privileges, escalation privilege
CVE-2020-15482: An issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an unencrypted TELNET service by default, with a blank password for the admin account. This allows an attacker to gain root access to the device over the local network.
Key phrases: gain root access, gain root access to the device over the, unencrypted telnet service, blank password
CVE-2020-15483: An issue was discovered on Nescomed Multipara Monitor M1000 devices. The physical UART debug port provides a shell, without requiring a password, with complete access.
Key phrases: shell, complete access
CVE-2020-15484: An issue was discovered on Nescomed Multipara Monitor M1000 devices. The internal storage of the underlying Linux system stores data in cleartext, without integrity protection against tampering.
Key phrases: cleartext, integrity protection, tampering
CVE-2020-15485: An issue was discovered on Nescomed Multipara Monitor M1000 devices. The onboard Flash memory stores data in cleartext, without integrity protection against tampering.
Key phrases: cleartext, integrity protection, tampering
CVE-2020-15486: An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. Because the Bluetooth LE support is implemented without a requirement for pairing or security, any attacker can access the GATT server of the device and can sniff the data being broadcasted while a measurement is being done. Also, saved data can also be extracted over a Bluetooth connection. In addition, an attacker can launch a man-in-the-middle attack against data integrity.
Key phrases: man-in-the-middle, man in the middle, integrity