yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-15487: Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution is possible by using this SQL injection to update certain database values, which are then executed by a bizRule eval() function in the yii/framework/web/auth/CAuthManager.php file. Resultant authorization bypass is also possible, by recovering or modifying password hashes and password reset tokens, allowing for administrative privileges to be obtained.
Key phrases: execute arbitrary SQL statements, bypass is also possible, by recovering or modifying password hashes, Resultant authorization bypass, be obtained, sql injection, remote command execution
CVE-2020-15488: Re:Desk 2.3 allows insecure file upload.
Key phrases: insecure file upload
CVE-2020-15489: An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges.
Key phrases: shell metacharacter injection, remote code execution, shell metacharacters, root privilege
CVE-2020-1549: <p>An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows CDP User Components handle memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15490: An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges. (The set of affected scripts is similar to CVE-2020-12266.)
Key phrases: buffer overflow, remote code execution, root privilege
CVE-2020-15492: An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.
Key phrases: read files on the server via Directory Traversal, filesystem access, directory traversal, unspecified other impact, unspecified impact
CVE-2020-15495: Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration.
Key phrases: an insecure XPC service configuration, local privilege escalation, insecure xpc service configuration
CVE-2020-15496: Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
Key phrases: local privilege escalation, insecure folder permissions
CVE-2020-15497: jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter. Note: It is asserted that this vulnerability is not present in the standard installation of Jalios JCMS
Key phrases: XSS via the types parameter, xss
CVE-2020-15498: An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files.
Key phrases: arbitrary server certificate
CVE-2020-15499: An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. They allow XSS via spoofed Release Notes on the Firmware Upgrade page.
Key phrases: XSS via spoofed Release Notes on the Firmware, xss, spoofing
CVE-2020-1550: <p>An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows CDP User Components handle memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15500: An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.
Key phrases: reflected xss
CVE-2020-15501: Smarter Coffee Maker before 2nd generation allows firmware replacement without authentication or authorization. User interaction is required to press a button. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Key phrases: press a button, firmware replacement, affects products
CVE-2020-15502: The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has stated "the favicon service adheres to our strict privacy policy.
Key phrases: potentially unwanted endpoint
CVE-2020-15503: LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
CVE-2020-15504: A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.
Key phrases: run arbitrary code, run arbitrary code remotely, sql injection
CVE-2020-15505: A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, remote code execution
CVE-2020-15506: An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authentication mechanisms via unspecified vectors.
Key phrases: bypass authentication, authentication bypass, bypass authentication mechanisms via unspecified vectors
CVE-2020-15507: An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to read files on the system via unspecified vectors.
Key phrases: read files on the system via unspecified vectors, arbitrary file reading
CVE-2020-15509: Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).
Key phrases: unencrypted communication
CVE-2020-1551: <p>An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-15511: HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Fixed in v202007-1.
Key phrases: default signup page, user registration
CVE-2020-15513: The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.
Key phrases: incorrect access control
CVE-2020-15514: The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.
Key phrases: XSS, xss
CVE-2020-15515: The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
Key phrases: Remote Code Execution, remote code execution
CVE-2020-15516: The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.
Key phrases: XSS that can be exploited via CSRF, xss, csrf
CVE-2020-15517: The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.
Key phrases: XSS, xss
CVE-2020-15518: VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.
Key phrases: achieve total control over filesystem I/O, device object dacl
CVE-2020-1552: <p>An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p><p>An attacker could exploit this vulnerability by running a specially crafted application on the victim system.</p><p>The update addresses the vulnerability by correcting the way the Windows Work Folder Service handles file operations.</p>
Key phrases: elevation of privilege, elevation privilege
CVE-2020-15521: Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .
Key phrases: cross-site scripting (xss)
CVE-2020-15522: Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Key phrases: timing issue
CVE-2020-15523: In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
Key phrases: invalid search path
CVE-2020-15525: GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.
Key phrases: incorrect access control
CVE-2020-15526: In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that defined by various options on the Configuration > Notifications pages to disable certificate checking for alert notifications. These TLS security checks are also ignored during monitoring of VMware machines. This would make SQL Monitor vulnerable to potential man-in-the-middle attacks when sending alert notification emails, posting to Slack or posting to webhooks. The vulnerability is fixed in version 10.1.7.
Key phrases: man-in-the-middle, man in the middle
CVE-2020-15528: An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks.
Key phrases: local escalation of privileges, weak file permissions, missing file integrity checks, escalation privilege
CVE-2020-15529: An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks.
Key phrases: local escalation of privileges, weak file permissions, opportunistic locks, escalation privilege
CVE-2020-1553: <p>An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context.</p><p>An attacker could exploit this vulnerability by running a specially crafted application on the victim system.</p><p>The update addresses the vulnerability by correcting the way the Windows Runtime handles objects in memory.</p>
Key phrases: run arbitrary code, elevation of privilege, elevation privilege
CVE-2020-15530: An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\\\\SYSTEM privileges because some parts of %PROGRAMFILES(X86)%\\\\Steam and/or %COMMONPROGRAMFILES(X86)%\\\\Steam have weak permissions during a critical time window. An attacker can make this time window arbitrarily long by using opportunistic locks.
Key phrases: gain NT AUTHORITY\\\\SYSTEM privileges, gain NT AUTHORITY\\\\SYSTEM privileges because some parts of, weak permissions, opportunistic locks
CVE-2020-15531: Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air remote code execution vulnerability in Bluetooth LE in EFR32 SoCs and associated modules running Bluetooth SDK, supporting Central or Observer roles.
Key phrases: buffer overflow, remote code execution
CVE-2020-15532: Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air denial of service vulnerability in Bluetooth LE in EFR32 SoCs and associated modules running Bluetooth SDK, supporting Central or Observer roles.
Key phrases: buffer overflow, denial of service
CVE-2020-15533: In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack.
Key phrases: alarmescalation module
CVE-2020-15535: An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.
Key phrases: persistent xss
CVE-2020-15536: An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
Key phrases: persistent xss
CVE-2020-15537: An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.
Key phrases: xss
CVE-2020-15538: XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.
Key phrases: xss
CVE-2020-15539: SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.
Key phrases: sql injection
CVE-2020-1554: <p>A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.</p><p>There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage.</p><p>The security update addresses the vulnerability by correcting how Windows Media Foundation handles objects in memory.</p>
Key phrases: memory corruption, convince
CVE-2020-15540: We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page.
Key phrases: SQL Injection via the username field on the, sql injection
CVE-2020-15541: SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.
Key phrases: remote command execution
CVE-2020-15542: SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.
CVE-2020-15543: SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.
Key phrases: argument path
CVE-2020-1555: <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p><p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p><p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p>
Key phrases: execute arbitrary code, gain the same user rights, remote code execution, web-based attack scenario, corrupt memory, convince
CVE-2020-1556: <p>An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p><p>To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.</p><p>The security update addresses the vulnerability by ensuring the Windows WalletService properly handles objects in memory.</p>
Key phrases: elevation of privilege, elevation privilege, execute code
CVE-2020-15562: An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
Key phrases: XSS via a crafted HTML e-mail, xss
CVE-2020-15563: An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Xen versions from 4.8 onwards are affected. Xen versions 4.7 and earlier are not affected. Only x86 systems are affected. Arm systems are not affected. Only x86 HVM guests using shadow paging can leverage the vulnerability. In addition, there needs to be an entity actively monitoring a guest's video frame buffer (typically for display purposes) in order for such a guest to be able to leverage the vulnerability. x86 PV guests, as well as x86 HVM guests using hardware assisted paging (HAP), cannot leverage the vulnerability.
Key phrases: Denial of Service (DoS), cause a hypervisor crash, make Xen de-reference a pointer guaranteed, inverted conditional, denial of service (dos)
CVE-2020-15564: An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the region is accessed with instructions that require a specific alignment. Unfortunately, there is no check that the address provided by the guest will be correctly aligned. As a result, a malicious guest could cause a hypervisor crash by passing a misaligned address. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). All Xen versions are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.
Key phrases: Denial of Service (DoS), cause a hypervisor crash because of a missing, denial of service (dos)
CVE-2020-15565: An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose. Host crashes (leading to a Denial of Service) and privilege escalation cannot be ruled out. Xen versions from at least 3.2 onwards are affected. Only x86 Intel systems are affected. x86 AMD as well as Arm systems are not affected. Only x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device assigned, and having page table sharing enabled can leverage the vulnerability. Note that page table sharing will be enabled (by default) only if Xen considers IOMMU and CPU large page size support compatible.
Key phrases: gain privileges, cause a host OS denial of service or, host os denial of service, privilege escalation, crash
CVE-2020-15566: An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO) used by the guest or the limit set by an administrator (max_event_channels in xl cfg). Due to the missing error checks, only (1) will be considered an error. All the other cases will provide a valid port and will result in a crash when trying to access the event channel. When the administrator configured a guest to allow more than 1023 event channels, that guest may be able to crash the host. When Xen is out-of-memory, allocation of new event channels will result in crashing the host rather than reporting an error. Xen versions 4.10 and later are affected. All architectures are affected. The default configuration, when guests are created with xl/libxl, is not vulnerable, because of the default event-channel limit.
Key phrases: cause a host OS crash because of incorrect, crash the host
CVE-2020-15567: An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable.
Key phrases: gain privileges, gain privileges or cause a denial of service, non-atomic modification, data corruption, privilege escalation
CVE-2020-15568: TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.
Key phrases: invalid parameter checking, code injection, dynamic class method invocation
CVE-2020-15569: PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
Key phrases: use-after-free, use after free
CVE-2020-1557: <p>A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.</p><p>An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.</p><p>The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.</p>
Key phrases: execute arbitrary code, remote code execution
CVE-2020-15570: The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file.
Key phrases: cause a denial of service via a malformed, memory allocation failures, malformed crash file
CVE-2020-15572: Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
Key phrases: use Mozilla Network Security Services (NSS), out-of-bounds memory access, remote denial-of-service (crash), out of bounds memory, denial of service
CVE-2020-15573: SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.
Key phrases: cross-script
CVE-2020-15574: SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.
Key phrases: same-site cookie attribute
CVE-2020-15575: SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.
Key phrases: XSS as demonstrated by Tenable Scan, xss
CVE-2020-15576: SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
Key phrases: information disclosure via an HTTP response
CVE-2020-15577: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID is SVE-2020-16830 (July 2020).
Key phrases: write files to the SD card, to write files
CVE-2020-15578: An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-2020-17270 (July 2020).
Key phrases: runtime permissions
CVE-2020-15579: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via the KNOX API. The Samsung ID is SVE-2020-17318 (July 2020).
Key phrases: bypass Factory Reset Protection
CVE-2020-1558: <p>A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.</p><p>An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.</p><p>The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.</p>
Key phrases: execute arbitrary code, remote code execution
CVE-2020-15580: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) by enrolling a new lock password. The Samsung ID is SVE-2020-17328 (July 2020).
Key phrases: bypass Factory Reset Protection
CVE-2020-15581: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual addresses via vectors involving shared memory. The Samsung ID is SVE-2020-17605 (July 2020).
Key phrases: discover virtual addresses via vectors involving shared memory, kernel logging feature
CVE-2020-15582: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software. The Bluetooth Low Energy (BLE) component has a buffer overflow with a resultant deadlock or crash. The Samsung ID is SVE-2020-16870 (July 2020).
Key phrases: buffer overflow, crash
CVE-2020-15583: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. StickerProvider allows directory traversal for access to system files. The Samsung ID is SVE-2020-17665 (July 2020).
Key phrases: system files, directory traversal
CVE-2020-15584: An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can trigger an out-of-bounds access and device reset via a 4K wallpaper image because ImageProcessHelper mishandles boundary checks. The Samsung ID is SVE-2020-18056 (July 2020).
Key phrases: out-of-bounds access, device reset, out of bounds access
CVE-2020-15586: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
Key phrases: data race
CVE-2020-15588: An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication.
Key phrases: integer overflow, heap-based buffer overflow, remote code execution with system privileges, untrusted communication, heap based buffer overflow
CVE-2020-15589: A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.
Key phrases: man-in-the-middle, unauthenticated remote code execution, man in the middle
CVE-2020-1559: <p>An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p><p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p><p>The security update addresses the vulnerability by ensuring the Windows Storage Services properly handle file operations.</p>
Key phrases: gain elevated privileges.</p><p, elevation of privilege, elevation privilege, code execution
CVE-2020-15590: A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a split tunnel OpenVPN bypass option. The PIA killswitch & associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending & receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically.
Key phrases: bypass an intended VPN kill switch mechanism and read sensitive information, bypass option. The PIA killswitch & associated iptables firewall, split tunnel OpenVPN bypass, cwe
CVE-2020-15591: fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).
Key phrases: eval injection (for unauthenticated remote code execution
CVE-2020-15592: SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a high privileged Windows service to perform administrative tasks and collect data from other processes. It distributes functionality among different processes and uses IPC (Inter-Process Communication) primitives to enable the processes to cooperate. The remotely callable methods from remotable objects available through interprocess communication allow loading of arbitrary plugins (i.e., C# assemblies) from the "%PROGRAMFILES(X86)%/Aternity Information Systems/Assistant/plugins directory, where the name of the plugin is passed as part of an XML-serialized object. However, because the name of the DLL is concatenated with the .\\\\plugins string, a directory traversal vulnerability exists in the way plugins are resolved.
Key phrases: perform administrative tasks and collect data from other, loading of arbitrary plugins (i.e., privilege escalation, directory traversal
CVE-2020-15593: SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perform administrative tasks and collect data from other processes. It distributes functionality among different processes and uses IPC (Inter-Process Communication) primitives to enable the processes to cooperate. Any user in the system is allowed to access the interprocess communication channel AternityAgentAssistantIpc, retrieve a serialized object and call object methods remotely. Among others, the methods allow any user to: (1) Create and/or overwrite arbitrary XML files across the system; (2) Create arbitrary directories across the system; and (3) Load arbitrary plugins (i.e., C# assemblies) from the "%PROGRAMFILES(X86)/Aternity Information Systems/Assistant/plugins directory and execute code contained in them.
Key phrases: overwrite arbitrary XML files, : (1) Create and/or overwrite arbitrary, execute code
CVE-2020-15594: An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product is deployed.
Key phrases: perform a scan in order to discover open, ssrf
CVE-2020-15595: An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.
Key phrases: obtain information, retrieve the entire list of the IP ranges
CVE-2020-15596: The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file.
Key phrases: conduct Path Disclosure attacks via a "fake, path disclosure
CVE-2020-15597: SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.
Key phrases: persistent XSS via the Project Name, persistent xss
CVE-2020-15598: Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit
Key phrases: know that a rule using a potentially problematic, denial of service, denial of service condition, resource issues
CVE-2020-15599: Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
Key phrases: XSS via the register.php user_firstname or user_lastname field, xss
CVE-2020-1560: <p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p><p>Exploitation of the vulnerability requires that a program process a specially crafted image file.</p><p>The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.</p>
Key phrases: remote code execution
CVE-2020-15600: An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
Key phrases: change the admin password, csrf
CVE-2020-15601: If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication. Enabling multi-factor authentication prevents this attack. Installations using manager native authentication or SAML authentication are not impacted by this vulnerability.
Key phrases: bypass manager authentication, authentication bypass, ldap authentication bypass
CVE-2020-15602: An untrusted search path remote code execution (RCE) vulnerability in the Trend Micro Secuity 2020 (v16.0.0.1146 and below) consumer family of products could allow an attacker to run arbitrary code on a vulnerable system. As the Trend Micro installer tries to load DLL files from its current directory, an arbitrary DLL could also be loaded with the same privileges as the installer if run as Administrator. User interaction is required to exploit the vulnerbaility in that the target must open a malicious directory or device.
Key phrases: run arbitrary code, run arbitrary code on a vulnerable system, remote code execution (rce)
CVE-2020-15603: An invalid memory read vulnerability in a Trend Micro Secuity 2020 (v16.0.0.1302 and below) consumer family of products' driver could allow an attacker to manipulate the specific driver to do a system call operation with an invalid address, resulting in a potential system crash.
Key phrases: manipulate the specific driver to do a system, invalid memory read, invalid address, system crash
CVE-2020-15604: An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-494: Update files are not properly verified.
Key phrases: combine this vulnerability with another attack to trick, ssl server certification validation, cwe-494
CVE-2020-15605: If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication. Enabling multi-factor authentication prevents this attack. Installations using manager native authentication or SAML authentication are not impacted by this vulnerability.
Key phrases: bypass manager authentication, authentication bypass, ldap authentication bypass
CVE-2020-15606: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9720.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15607: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9721.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15608: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the ai_service parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9724.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15609: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_stop parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9726.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-1561: <p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.</p><p>To exploit the vulnerability, a user would have to open a specially crafted file.</p><p>The security update addresses the vulnerability by correcting how Microsoft Graphics Components handle objects in memory.</p>
Key phrases: execute arbitrary code, remote code execution
CVE-2020-15610: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the modulo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9728.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15611: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_restart parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9734.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15612: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. When parsing the userLogin parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9737.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15613: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9739.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15614: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the cha parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9718.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code
CVE-2020-15615: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9746.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of CentOS, execute code