yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-2203: A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.
Key phrases: connect to the globally configured Fortify on Demand, cross-site request forgery, cross site request forgery
CVE-2020-22030: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22031: A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, potential consequences
CVE-2020-22032: A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory corruption and other potential consequences.
Key phrases: buffer overflow, memory corruption, consequences
CVE-2020-22033: A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote malicious user cause a Denial of Service.
Key phrases: heap-based buffer overflow, denial of service
CVE-2020-22034: A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other potential consequences.
Key phrases: buffer overflow, memory corruption, consequences
CVE-2020-22035: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22036: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences.
Key phrases: heap-based buffer overflow, memory corruption, consequences
CVE-2020-22037: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.
Key phrases: denial of service, memory leak
CVE-2020-22038: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.
Key phrases: denial of service, memory leak
CVE-2020-22039: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.
Key phrases: denial of service, memory leak
CVE-2020-2204: A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.
Key phrases: connect to the globally configured Fortify on Demand, permission check
CVE-2020-22040: A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.
Key phrases: denial of service, memory leak
CVE-2020-22041: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc.
Key phrases: denial of service, memory leak
CVE-2020-22042: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graphparser.c.
Key phrases: denial of service, memory leak
CVE-2020-22043: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c.
Key phrases: denial of service, memory leak
CVE-2020-22044: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c.
Key phrases: denial of service, memory leak
CVE-2020-22046: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c.
Key phrases: denial of service, memory leak
CVE-2020-22048: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c.
Key phrases: denial of service, memory leak
CVE-2020-22049: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c.
Key phrases: denial of service, memory leak
CVE-2020-2205: Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators.
Key phrases: stored cross-site scripting (xss)
CVE-2020-22051: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter_frame function in vf_tile.c.
Key phrases: denial of service, memory leak
CVE-2020-22054: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c.
Key phrases: denial of service, memory leak
CVE-2020-22056: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config_input function in af_acrossover.c.
Key phrases: denial of service, memory leak
CVE-2020-22057: The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default security descriptor which allows attackers to access sensitive components and data.
Key phrases: access sensitive components and data, default security descriptor
CVE-2020-2206: Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
Key phrases: reflected cross-site scripting (xss)
CVE-2020-22061: SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows attackers to arbitrarily write data to the device via IOCTL 0x9C402140.
Key phrases: arbitrarily write data to the device via IOCTL
CVE-2020-2207: Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
Key phrases: reflected cross-site scripting (xss)
CVE-2020-22079: Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg.
Key phrases: execute arbitrary code, execute arbitrary code via the timeZone parameter to, stack-based buffer overflow, stack based buffer overflow
CVE-2020-2208: Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2020-22083: jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data
Key phrases: causing arbitrary code execution, be capable of causing arbitrary code execution, remote code execution
CVE-2020-2209: Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-2210: Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-2211: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-2212: Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration.
Key phrases: unencrypted
CVE-2020-22120: A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code.
Key phrases: execute arbitrary code, remote code execution (rce)
CVE-2020-22122: A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitive database information via a crafted POST request.
Key phrases: access sensitive database information via a crafted POST, sql injection
CVE-2020-22124: A vulnerability in the \\\\inc\\\\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.
Key phrases: access sensitive information
CVE-2020-2213: Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission (config.xml), or access to the master file system.
Key phrases: unencrypted
CVE-2020-2214: Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2020-22148: A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, stored cross site scripting (xss)
CVE-2020-2215: A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password.
Key phrases: connect to an attacker-specified HTTP server, cross-site request forgery, cross site request forgery
CVE-2020-22150: A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, cross site scripting (xss)
CVE-2020-22151: Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted zip file, permissions
CVE-2020-22152: Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
Key phrases: execute arbitrary code, execute arbitrary code via the page title, cross site scripting
CVE-2020-22153: File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .php file, file upload
CVE-2020-22158: MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker must modify the "name" parameter with the malicious code.
Key phrases: xss
CVE-2020-22159: EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upload, allowing an authenticated attacker to upload a webshell or overwrite any critical system files.
Key phrases: upload a webshell or overwrite any critical system, arbitrary file upload, critical system files
CVE-2020-2216: A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.
Key phrases: connect to an attacker-specified HTTP server, permission check
CVE-2020-22164: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\check_availability.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22165: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22166: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\forgot-password.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22167: PHPGurukul Hospital Management System in PHP v4.0 has a Persistent Cross-Site Scripting vulnerability in \\\\hms\\\\admin\\\\appointment-history.php. Remote registered users can exploit the vulnerability to obtain user cookie data.
Key phrases: obtain user cookie data, persistent cross-site scripting
CVE-2020-22168: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\change-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22169: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\appointment-history.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-2217: Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
Key phrases: reflected cross-site scripting (xss)
CVE-2020-22170: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\get_doctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22171: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\registration.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22172: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\get_doctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22173: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\edit-profile.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22174: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\book-appointment.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22175: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\\\hms\\\\admin\\\\betweendates-detailsreports.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
Key phrases: obtain database, sql injection, database sensitive information
CVE-2020-22176: PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can exploit the vulnerability to obtain user sensitive information.
Key phrases: obtain user sensitive information, sensitive information disclosure
CVE-2020-2218: Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-22181: A reflected cross site scripting (XSS) vulnerability was discovered on Samsung sww-3400rw Router devices via the m2 parameter of the sess-bin/command.cgi
Key phrases: cross site scripting (xss)
CVE-2020-2219: Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22198: SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.
Key phrases: sql injection
CVE-2020-22199: SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.
Key phrases: sql injection
CVE-2020-2220: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22200: Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.
Key phrases: directory traversal
CVE-2020-22201: phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.
Key phrases: execute arbitrary php
CVE-2020-22203: SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.
Key phrases: sql injection
CVE-2020-22204: SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. .
Key phrases: sql injection
CVE-2020-22205: SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.
Key phrases: sql injection
CVE-2020-22206: SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.
Key phrases: sql injection
CVE-2020-22208: SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
Key phrases: sql injection
CVE-2020-22209: SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
Key phrases: sql injection
CVE-2020-2221: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22210: SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
Key phrases: sql injection
CVE-2020-22211: SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
Key phrases: sql injection
CVE-2020-22212: SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
Key phrases: sql injection
CVE-2020-22217: Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.
Key phrases: buffer overflow
CVE-2020-22218: An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.
Key phrases: access out of bounds memory
CVE-2020-22219: Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.
Key phrases: run arbitrary code, run arbitrary code via crafted input to the, buffer overflow
CVE-2020-2222: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22222: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss function.
Key phrases: cross-site scripting (xss)
CVE-2020-22223: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function.
Key phrases: sql injection
CVE-2020-22224: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview function.
Key phrases: cross-site scripting (xss)
CVE-2020-22225: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function.
Key phrases: sql injection
CVE-2020-22226: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function.
Key phrases: sql injection
CVE-2020-2223: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-2224: Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22249: Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which would lead to the remote code execution
Key phrases: remote code execution, file upload
CVE-2020-2225: Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
Key phrases: cross-site scripting
CVE-2020-22251: Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
Key phrases: cross site scripting (xss)
CVE-2020-22253: Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39 were all discovered to have port 9530 open which allows unauthenticated attackers to make arbitrary Telnet connections with the victim device.
Key phrases: make arbitrary Telnet connections, make arbitrary Telnet connections with the victim device, port open
CVE-2020-2226: Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
Key phrases: cross-site scripting
CVE-2020-2227: Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-22273: Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings)
Key phrases: be changed (such as Payment Settings), csrf
CVE-2020-22274: JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.
Key phrases: CSV injection via a customer's profile, csv injection
CVE-2020-22275: Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.
Key phrases: submit an entry with malicious CSV commands, executable
CVE-2020-22276: WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
Key phrases: CSV injection via a form's entry, csv injection
CVE-2020-22277: Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Key phrases: CSV injection via a customer's profile, csv injection
CVE-2020-22278: phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.
Key phrases: CSV injection via Export Section, csv injection
CVE-2020-2228: Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
Key phrases: privilege escalation
CVE-2020-22283: A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows attackers to access sensitive information via a crafted ICMPv6 packet.
Key phrases: access sensitive information via a crafted ICMPv6 packet, buffer overflow
CVE-2020-22284: A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allows attackers to access sensitive information via a crafted 6LoWPAN packet.
Key phrases: access sensitive information via a crafted 6LoWPAN packet, buffer overflow
CVE-2020-2229: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2230: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2231: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
Key phrases: stored cross-site scripting (xss)
CVE-2020-22312: A cross-site scripting (XSS) vulnerability was discovered in the OJ/admin-tool /cal_scores.php function of HZNUOJ v1.0.
Key phrases: cross-site scripting (xss)
CVE-2020-2232: Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
Key phrases: plain text
CVE-2020-22327: An issue was discovered in HFish 0.5.1. When a payload is inserted where the name is entered, XSS code is triggered when the administrator views the information.
Key phrases: xss code
CVE-2020-2233: A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
Key phrases: enumerate credentials ID of credentials stored in Jenkins
CVE-2020-22330: Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
Key phrases: cross-site scripting (xss)
CVE-2020-22334: Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.php.
Key phrases: delete the administrator account via crafted request to, cross site request forgery (csrf)
CVE-2020-22336: An issue was discovered in pdfcrack 0.17 thru 0.18, allows attackers to execute arbitrary code via a stack overflow in the MD5 function.
Key phrases: execute arbitrary code, execute arbitrary code via a stack overflow in
CVE-2020-2234: A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified JDBC URL, permission check
CVE-2020-22345: /graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via shell metacharacters in, arbitrary os commands
CVE-2020-2235: A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified JDBC URL, cross-site request forgery (csrf), cross site request forgery
CVE-2020-22352: The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Key phrases: denial of service (NULL pointer dereference), cause a denial of service (NULL pointer, null pointer dereference
CVE-2020-2236: Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2237: A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous git revision.
Key phrases: rebuild a project at a previous git revision, cross-site request forgery (csrf), cross site request forgery
CVE-2020-2238: Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2239: Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
CVE-2020-22390: Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.
Key phrases: inject arbitrary code, csv injection, code execution
CVE-2020-22392: Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
Key phrases: cross site scripting (xss)
CVE-2020-22394: In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability.
Key phrases: cross-site scripting (xss)
CVE-2020-2240: A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts.
Key phrases: execute arbitrary SQL scripts, cross-site request forgery (csrf), arbitrary sql scripts, cross site request forgery
CVE-2020-22402: Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code.
Key phrases: obtain user sensitive information, obtain user sensitive information when a user reads, cross site scripting (xss)
CVE-2020-22403: Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.
Key phrases: add an administrator account, cross site request forgery (csrf), unspecified impacts
CVE-2020-2241: A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database server using attacker-specified credentials.
Key phrases: connect to an attacker-specified database server, cross-site request forgery (csrf), cross site request forgery
CVE-2020-2242: A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials.
Key phrases: Jenkins to connect to an attacker-specified, missing permission check
CVE-2020-22421: 74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key.
Key phrases: cross-site scripting (xss)
CVE-2020-22425: Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution.
Key phrases: sql injection, remote command execution
CVE-2020-22427: NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later time
Key phrases: remote code execution (rce), unspecified
CVE-2020-22428: SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.
Key phrases: cross site scripting (xss)
CVE-2020-22429: redox-os v0.1.0 was discovered to contain a use-after-free bug via the gethostbyaddr() function at /src/header/netdb/mod.rs.
Key phrases: use-after-free bug, use after free
CVE-2020-2243: Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2244: Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.
Key phrases: cross-site scripting (xss)
CVE-2020-2245: Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-22452: SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
Key phrases: sql injection
CVE-2020-22453: Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information.
Key phrases: XSS in multiple functions that store information, xss
CVE-2020-2246: Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents.
Key phrases: stored cross-site scripting (xss), exploitable
CVE-2020-2247: Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-22474: In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.
Key phrases: specify the "Language" parameter, local file inclusion
CVE-2020-22475: "Tasks" application version before 9.7.3 is affected by insecure permissions. The VoiceCommandActivity application component allows arbitrary applications on a device to add tasks with no restrictions.
Key phrases: allows arbitrary applications, add tasks with no restrictions, insecure permissions
CVE-2020-2248: Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
Key phrases: reflected cross-site scripting (xss)
CVE-2020-22481: An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered when the administrator views the information.
Key phrases: xss code
CVE-2020-2249: Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2020-2250: Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Key phrases: unencrypted, extended read permission
CVE-2020-2251: Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-2252: Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.
Key phrases: hostname validation
CVE-2020-22524: Buffer Overflow vulnerability in FreeImage_Load function in FreeImage Library 3.19.0(r1828) allows attackers to cuase a denial of service via crafted PFM file.
Key phrases: cuase a denial of service via crafted PFM, buffer overflow
CVE-2020-2253: Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
Key phrases: hostname validation
CVE-2020-22533: Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter
Key phrases: execute arbitrary code, execute arbitrary code via the lang parameter, cross site scripting
CVE-2020-22535: Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.
Key phrases: incorrect access control
CVE-2020-2254: Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.
Key phrases: read arbitrary files, read arbitrary files on the Jenkins controller file, undocumented feature flag
CVE-2020-2255: A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Key phrases: connect to an attacker-specified URL, permission check
CVE-2020-22550: Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server.
Key phrases: download sensitive files from the server, directory traversal
CVE-2020-22552: The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var function, the Snap7 server will be crashed.
Key phrases: last-data-unit flag, crashed
CVE-2020-2256: Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-2257: Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-22570: Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash
CVE-2020-2258: Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view that HTTP endpoint.
Key phrases: view that HTTP endpoint
CVE-2020-2259: Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-22597: An issue in Jerrscript- project Jerryscrip v. 2.3.0 allows a remote attacker to execute arbitrary code via the ecma_builtin_array_prototype_object_slice parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the ecma_builtin_array_prototype_object_slice parameter
CVE-2020-2260: A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
Key phrases: connect to an attacker-specified HTTP URL, permission check
CVE-2020-22607: Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.
Key phrases: cross site scripting
CVE-2020-22608: Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
Key phrases: cross site scripting
CVE-2020-22609: Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
Key phrases: cross site scripting (xss)
CVE-2020-2261: Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller
Key phrases: run arbitrary commands, run arbitrary commands on the Jenkins controller, execute commands
CVE-2020-22612: Installer RCE on settings file write in MyBB before 1.8.22.
Key phrases: installer rce, file write
CVE-2020-22617: Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.
Key phrases: use-after-free, use after free
CVE-2020-2262: Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step.
Key phrases: stored cross-site scripting (xss), exploitable
CVE-2020-22623: Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information.
Key phrases: gain sensitive information, directory traversal
CVE-2020-22628: Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.
Key phrases: buffer overflow
CVE-2020-2263: Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Key phrases: stored cross-site scripting (xss), exploitable
CVE-2020-2264: Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Key phrases: stored cross-site scripting (xss)
CVE-2020-22643: Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.
Key phrases: arbitrary file upload, remote code execution
CVE-2020-22647: An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions.
Key phrases: gain sensitive information, gain sensitive information via the GetBonusWithdraw and withdraw
CVE-2020-2265: Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step.
Key phrases: stored cross-site scripting (xss), exploitable
CVE-2020-22650: A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the occurrence of a large number of alarm events.
Key phrases: denial of service (DOS), memory leak, denial of service (dos), system crash
CVE-2020-22653: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to exploit the official image signature to force injection unauthorized image signature.
Key phrases: exploit the official image signature to force injection
CVE-2020-22654: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to bypass firmware image bad md5 checksum failed error.
Key phrases: bypass firmware image bad md5 checksum, bypass firmware image bad md5 checksum failed error
CVE-2020-22655: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to persistently to writing unauthorized image.
Key phrases: persistently to writing unauthorized image
CVE-2020-22656: In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to make the Secure Boot in failed attempts state (rfwd).
Key phrases: make the Secure Boot in failed attempts state