yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-2033: When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user. This access may be limited compared to the network access of regular users. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 when the prelogon feature is enabled; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when the prelogon feature is enabled.
Key phrases: access the GlobalProtect Server as allowed by configured, arp spoofing, man in the middle
CVE-2020-20335: Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a denial of service via the editorUpdateRow function in kilo.c.
Key phrases: cause a denial of service via the editorUpdateRow, buffer overflow
CVE-2020-2034: An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands with root privileges, os command injection, arbitrary os command
CVE-2020-20340: A SQL injection vulnerability in the 4.edu.php\\\\conn\\\\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.
Key phrases: access sensitive database information, sql injection
CVE-2020-20341: YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
Key phrases: server-side request forgery (ssrf), server side request forgery
CVE-2020-20343: WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attackers to arbitrarily add articles in the administrator background.
Key phrases: arbitrarily add articles in the administrator background, cross-site request forgery (csrf), cross site request forgery
CVE-2020-20344: WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module.
Key phrases: reflective cross-site scripting (xss)
CVE-2020-20345: WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box.
Key phrases: obtain cookies via a crafted payload entered into, reflective cross-site scripting (xss)
CVE-2020-20347: WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module.
Key phrases: stored cross-site scripting (xss)
CVE-2020-20348: WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module.
Key phrases: stored cross-site scripting (xss)
CVE-2020-20349: WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2035: When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication (SNI) field within the TLS Client Hello handshake. This allows a compromised host in a protected network to evade any security policy that uses URL filtering on a firewall configured with SSL Decryption in the Forward Proxy mode. A malicious actor can then use this technique to evade detection of communication on the TLS handshake phase between a compromised host and a remote malicious server. This technique does not increase the risk of a host being compromised in the network. It does not impact the confidentiality or availability of a firewall. This is considered to have a low impact on the integrity of the firewall because the firewall fails to enforce a policy on certain traffic that should have been blocked. This issue does not impact the URL filtering policy enforcement on clear text or encrypted web transactions. This technique can be used only after a malicious actor has compromised a host in the protected network and the TLS/SSL Decryption feature is enabled for the traffic that the attacker controls. Palo Alto Networks is not aware of any malware that uses this technique to exfiltrate data. This issue is applicable to all current versions of PAN-OS. This issue does not impact Panorama or WF-500 appliances.
Key phrases: evade any security policy that uses URL filtering, confidentiality, availability, integrity
CVE-2020-2036: A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.
Key phrases: execute arbitrary JavaScript code, reflected cross-site scripting (xss), convince
CVE-2020-20363: Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php.
Key phrases: crossi site scripting (xss)
CVE-2020-2037: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands with root privileges, os command injection, arbitrary os command
CVE-2020-2038: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands with root privileges, os command injection, arbitrary os command
CVE-2020-20389: Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.
Key phrases: cross site scripting (xss)
CVE-2020-2039: An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Key phrases: upload temporary files through the management web interface, uncontrolled resource consumption, availability
CVE-2020-20391: Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.
Key phrases: cross site scripting
CVE-2020-20392: SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.
Key phrases: sql injection
CVE-2020-2040: A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.
Key phrases: execute arbitrary code, disrupt system processes and potentially execute arbitrary code, buffer overflow, malicious request, root privilege
CVE-2020-20402: Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.
Key phrases: bypass password validation, bypass password validation and access sensitive information via, session fixation
CVE-2020-20406: A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Key phrases: xss
CVE-2020-2041: An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts all versions of PAN-OS 8.0, and PAN-OS 8.1 versions earlier than 8.1.16.
Key phrases: send a specifically crafted request to the device, insecure configuration, denial of service, crash
CVE-2020-20412: lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146.
CVE-2020-20413: SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.
Key phrases: execute arbitrary code, execute arbitrary code via the checktitle(), sql injection
CVE-2020-2042: A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Key phrases: execute arbitrary code, disrupt system processes and potentially execute arbitrary code, buffer overflow, root privilege
CVE-2020-20425: S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.
Key phrases: cross-site scripting (xss)
CVE-2020-20426: S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.
Key phrases: cross-site scripting (xss)
CVE-2020-2043: An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple times in one log entry. The first instance of the sensitive field is masked but subsequent instances are left in clear text. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4.
Key phrases: log file, information exposure
CVE-2020-2044: An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and later PAN-OS versions. Command usage is recorded, instead, in the req_stats.log file in PAN-OS 9.1 and later PAN-OS versions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.
Key phrases: log file, information exposure, sensitive information
CVE-2020-20444: Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/view_source.php' which "could" lead to RCE vulnerability .
Key phrases: read server files after login to the the, rce
CVE-2020-20445: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.
Key phrases: cause a Denial of Service, divide by zero, denial of service
CVE-2020-20446: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.
Key phrases: cause a Denial of Service, divide by zero, denial of service
CVE-2020-20448: FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of Service.
Key phrases: cause a Denial of Service, divide by zero, denial of service
CVE-2020-20450: FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service.
Key phrases: null pointer dereference, denial of service
CVE-2020-20451: Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.
Key phrases: denial of service, resource management errors
CVE-2020-20453: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service
Key phrases: cause a Denial of Service, divide by zero, denial of service
CVE-2020-20466: White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user.
Key phrases: unauthorized access
CVE-2020-20467: White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to create a task.
Key phrases: sensitive information disclosure, default_task_add.php
CVE-2020-20468: White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password.
Key phrases: csrf
CVE-2020-20469: White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the log_edit.php files failing to filter the csa_to_user parameter, remote attackers can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-20470: White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.
Key phrases: web site physical path leakage
CVE-2020-20471: White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerability to escalate to admin privileges.
Key phrases: unauthorized access, admin privileges
CVE-2020-20472: White Shark System (WSS) 1.3.2 has a sensitive information disclosure vulnerability. The if_get_addbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site.
Key phrases: obtain username information, sensitive information disclosure
CVE-2020-20473: White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the control_task.php, control_project.php, default_user.php files failing to filter the sort parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-20474: White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the default_task_edituser.php files failing to filter the csa_to_user parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-2048: An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.
Key phrases: log file, information exposure
CVE-2020-20486: IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr.
Key phrases: stack-buffer overflow, stack buffer overflow
CVE-2020-2049: A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions.
Key phrases: execute programs with SYSTEM privileges, local privilege escalation
CVE-2020-20490: A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS).
Key phrases: denial of service (DOS), heap buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2020-20491: SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.
Key phrases: execute arbitrary code, execute arbitrary code via the Fba plugin function, sql injection
CVE-2020-20495: bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.
Key phrases: arbitrary file deletion
CVE-2020-2050: An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate verification is used in conjunction with other authentication methods, the protections added by the certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Key phrases: bypass all client certificate checks, authentication bypass, gain access, bypass all client certificate checks with an invalid
CVE-2020-20502: Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
Key phrases: execute arbitrary code, execute arbitrary code via the token check function, cross site request forgery
CVE-2020-20508: Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
Key phrases: hijack user credentials via a crafted payload in, reflective cross-site scripting (xss)
CVE-2020-20514: A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
Key phrases: delete all users, cross-site request forgery (csrf)
CVE-2020-20521: Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the comment parameter, cross site scripting
CVE-2020-20522: Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the registering user parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the registering user parameter, cross site scripting
CVE-2020-20523: Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.
Key phrases: execute arbitrary code, execute arbitrary code during the Gila CMS installation, cross site scripting (xss)
CVE-2020-20545: Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'.
Key phrases: cross-site scripting (xss)
CVE-2020-20582: A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive information.
Key phrases: access sensitive information, server side request forgery (ssrf)
CVE-2020-20583: A SQL injection vulnerability in /question.php of LJCMS Version v4.3.R60321 allows attackers to obtain sensitive database information.
Key phrases: obtain sensitive database, obtain sensitive database information, sql injection
CVE-2020-20584: A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via the, cross site scripting
CVE-2020-20585: A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
Key phrases: access sensitive database information, sql injection
CVE-2020-20586: A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password.
Key phrases: edit any information of the administrator such as, cross site request forgery (csrf)
CVE-2020-20588: File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php.
Key phrases: run arbitrary code, run arbitrary code via avatar upload to index.php, file upload
CVE-2020-20589: Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
Key phrases: run arbitrary code, run arbitrary code via tha lang attribute of, cross site scripting (xss)
CVE-2020-20593: A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.
Key phrases: arbitrarily add an administrator account, cross-site request forgery (csrf), cross site request forgery
CVE-2020-20595: A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.
Key phrases: arbitrarily add a user account via /user/, cross-site request forgery (csrf), cross site request forgery
CVE-2020-20597: A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \\web\\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, cross-site scripting (xss)
CVE-2020-20598: A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, cross-site scripting (xss)
CVE-2020-20600: MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
Key phrases: stored cross-site scripting (xss)
CVE-2020-20601: An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted packet
CVE-2020-20605: Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.
Key phrases: cross-site scripting (xss)
CVE-2020-20625: Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
Key phrases: unauthenticated information disclosure and authenticated SQL injection via, authenticated sql injection
CVE-2020-20626: lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
Key phrases: authenticated stored XSS, authenticated stored xss
CVE-2020-20627: The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
Key phrases: unauthenticated settings change
CVE-2020-20628: controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
Key phrases: unauthenticated stored xss
CVE-2020-20633: ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation.
Key phrases: authenticated stored XSS and privilege escalation, authenticated stored xss
CVE-2020-20634: Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
Key phrases: activate its safe mode feature, exploited, disable
CVE-2020-20636: SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() function.
Key phrases: access sensitive information via the id parameter, sql injection
CVE-2020-20640: Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability.
Key phrases: bypass the security policy, cross site scripting (xss), bypass security
CVE-2020-20642: Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn.
Key phrases: cross site request forgery (csrf)
CVE-2020-20645: Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.
Key phrases: cross site scripting (xss)
CVE-2020-20657: Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while trying to connect.
Key phrases: cause a denial of service via an unexpected, buffer overflow
CVE-2020-20658: Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexpectiedly large space.
Key phrases: cause a denail of service when trying to, buffer overflow
CVE-2020-20662: libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2020-20663: libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2020-20664: libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.
Key phrases: segmentation violation
CVE-2020-20665: rudp v0.6 was discovered to contain a memory leak in the component main.c.
Key phrases: memory leak
CVE-2020-20670: An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted HTML file, arbitrary file upload
CVE-2020-20671: A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account.
Key phrases: arbitrarily add an administrator account, cross-site request forgery (csrf), cross site request forgery
CVE-2020-20672: An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file.
Key phrases: getshell via a crafted PHP file, arbitrary file upload
CVE-2020-20675: Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/.
Key phrases: sql injection
CVE-2020-20691: An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via bypassing
CVE-2020-20692: GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controllers/cm.php.
Key phrases: sql injection
CVE-2020-20693: A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.
Key phrases: arbitrarily add administrator accounts, cross-site request forgery (csrf)
CVE-2020-20695: A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2020-20696: A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2020-20697: Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie information via a crafted script to the address parameter.
Key phrases: execute arbitrary code, gain access, execute arbitrary code and gain access to senstivie, cross site scripting
CVE-2020-20698: A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.
Key phrases: getshell via modification of a PHP file, remote code execution (rce)
CVE-2020-20699: A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross site scripting (xss)
CVE-2020-20700: A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-20701: A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-20703: Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the operand parameter, buffer overflow
CVE-2020-20718: File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image file, file upload
CVE-2020-20725: Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in admin.php.
Key phrases: execute arbitrary code, execute arbitrary code via the name field in, cross site scripting
CVE-2020-20726: Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the cm/update_rows, cross site request forgery
CVE-2020-20735: File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the ljcms/index.php, file upload
CVE-2020-20739: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Key phrases: uninitialized variable
CVE-2020-20740: PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2020-20741: Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to bypass authentication via the "CE Remote Display Tool" as it does not close the incoming connection on the Windows CE side if the credentials are incorrect.
Key phrases: bypass authentication, bypass authentication via the "CE Remote Display, incorrect access control
CVE-2020-20746: A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60_EN allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via a crafted POST request to /goform/SetStaticRouteCfg.
Key phrases: execute arbitrary code, denial of service (DoS), execute arbitrary code or cause a denial of, stack-based buffer overflow, denial of service (dos), stack based buffer overflow
CVE-2020-2075: Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x  CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.
Key phrases: reboot the device via a crafted packet in, autoip
CVE-2020-2076: SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write files without authentication.
Key phrases: bypass by directly interfacing with the REST API, bypass current authentication, authentication bypass, to write files
CVE-2020-2077: SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly.
Key phrases: default permissions settings, sensitive data
CVE-2020-2078: Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information.
Key phrases: gain access, easily gain access to systems, compromising, sensitive information
CVE-2020-20781: A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the title, key words, description or content text fields.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2020-20796: FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.
Key phrases: sql injection
CVE-2020-20797: FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.
Key phrases: time-based blind sql injection
CVE-2020-20799: JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the commentText parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2020-20800: An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI.
Key phrases: sql injection
CVE-2020-20808: Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php.
Key phrases: execute arbitrary code, execute arbitrary code via the eindtijd and starttijd, cross site scripting
CVE-2020-20813: Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
Key phrases: cause a denial of service via crafted reset, control channel
CVE-2020-20891: Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Key phrases: cause a Denial of Service or other unspecified, buffer overflow, denial of service, unspecified impacts
CVE-2020-20892: An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.
Key phrases: cause a Denial of Service or other unspecified, denial of service, unspecified impacts
CVE-2020-20896: An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.
Key phrases: cause a Denial of Service or other unspecified, denial of service, unspecified impacts, null pointer dereference
CVE-2020-20898: Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Key phrases: cause a Denial of Service or other unspecified, integer overflow, denial of service, unspecified impacts
CVE-2020-2090: A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
Key phrases: connect to an attacker-specified URL within, cross-site request forgery, cross site request forgery
CVE-2020-20902: A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0), that could result in disclosure of information.
Key phrases: cwe-125, disclosure of information, out of bounds read
CVE-2020-20907: MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php.
Key phrases: file modification
CVE-2020-20908: Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Company Name input field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2020-2091: A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
Key phrases: connect to an attacker-specified URL within
CVE-2020-20913: SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
Key phrases: execute arbitrary code, execute arbitrary code via basic_title parameter, sql injection
CVE-2020-20914: SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the sql parameter, sql injection
CVE-2020-20915: SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.
Key phrases: execute arbitrary code, execute arbitrary code via sql parameter of the, sql injection
CVE-2020-20918: An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.
Key phrases: execute arbitrary php code, execute arbitrary php code via the hidden parameter, executing arbitrary php code
CVE-2020-20919: File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file.
Key phrases: execute arbitrary code, execute arbitrary code and access sensitive information via, file upload
CVE-2020-2092: Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
Key phrases: have Jenkins parse crafted XML documents, xml external entity (xxe)
CVE-2020-2093: A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attacker-specified recipient.
Key phrases: send an email with fixed content to an, cross-site request forgery, cross site request forgery
CVE-2020-2094: A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.
Key phrases: send a fixed email to an attacker-, missing permission check
CVE-2020-20943: A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.
Key phrases: force victim users into arbitrarily publishing new articles, cross-site request forgery (csrf)
CVE-2020-20944: An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
Key phrases: arbitrarily delete files
CVE-2020-20945: A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.
Key phrases: arbitrarily add administrator accounts, cross-site request forgery (csrf)
CVE-2020-20946: Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
Key phrases: stored cross-site scripting (xss)
CVE-2020-20948: An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
Key phrases: access sensitive files via modification of the ", arbitrary file download
CVE-2020-20949: Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
Key phrases: use Bleichenbacher's oracle attack to decrypt an, bleichenbachers oracle, remote information disclosure
CVE-2020-2095: Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-20950: Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
Key phrases: use Bleichenbacher's oracle attack to decrypt an, remote information disclosure
CVE-2020-20951: In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.
Key phrases: remote command execution
CVE-2020-2096: Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
Key phrases: reflected xss
CVE-2020-20969: File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the trashcan_restoreitem.php file, file upload
CVE-2020-2097: Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands as the OS user, arbitrary os command
CVE-2020-20971: Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
Key phrases: cross site request forgery (csrf)
CVE-2020-20975: In \\\\lib\\\\admin\\\\action\\\\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
Key phrases: sql injection
CVE-2020-20977: A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-20979: An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, arbitrary file upload
CVE-2020-2098: A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands as the OS user, cross-site request forgery, cross site request forgery, arbitrary os command
CVE-2020-20981: A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
Key phrases: access sensitive database information, sql injection
CVE-2020-20982: Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.
Key phrases: execute arbitrary code, gain escalated privileges, execute arbitrary code and gain escalated privileges, cross site scripting (xss), escalate privilege