yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-20988: A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross site scripting (xss)
CVE-2020-20989: A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.
Key phrases: arbitrarily delete logs, cross-site request forgery (csrf), cross site request forgery
CVE-2020-2099: Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
Key phrases: obtain the connection secrets for those agents,, impersonate
CVE-2020-20990: A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via the, cross site scripting (xss)
CVE-2020-2100: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.
Key phrases: udp amplification reflection denial of service
CVE-2020-21003: Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.
Key phrases: cross site scripting (xss)
CVE-2020-21005: WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because the upload file type is controllable, the user can modify the upload file type to get webshell.
Key phrases: file upload
CVE-2020-2101: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
Key phrases: obtain this secret., use a timing attack to obtain this secret
CVE-2020-21012: Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the email parameter, unauthenticated sql injection
CVE-2020-21013: emlog v6.0.0 contains a SQL injection via /admin/comment.php.
Key phrases: sql injection
CVE-2020-21014: emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
Key phrases: arbitrary file deletion
CVE-2020-21016: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.
Key phrases: execute arbitrary code, execute arbitrary code as root via HNAP1/
CVE-2020-2102: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
Key phrases: non-constant time comparison function
CVE-2020-2103: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
Key phrases: exposed session identifiers
CVE-2020-21038: Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.
Key phrases: open redirect
CVE-2020-2104: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.
CVE-2020-21041: Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
Key phrases: buffer overflow, denial of service
CVE-2020-21046: A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader version 2.1.5.20 Stable. This issue allows authenticated non-administrative user to escalate their privilege and conduct code execution as a SYSTEM privilege.
Key phrases: escalate their privilege and conduct code execution as, local privilege escalation, escalate privilege
CVE-2020-21047: The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.
Key phrases: bypass the missing bound checks, denial-of-service, application crashes, out-of-bounds write, off-by-one error, reachable assertion, elf files, denial of service, out of bounds write
CVE-2020-21048: An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
Key phrases: denial of service (DOS), cause a denial of service (DOS), denial of service (dos)
CVE-2020-21049: An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.
Key phrases: denial of service (DOS), cause a denial of service (DOS), invalid read, denial of service (dos)
CVE-2020-2105: REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
Key phrases: rest api endpoints, clickjacking
CVE-2020-21050: Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
Key phrases: stack buffer overflow
CVE-2020-21052: Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment function.
Key phrases: execute arbitrary code, execute arbitrary code via the nickame parameter of, cross site scripting
CVE-2020-21053: Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\\devices\\device_imports.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross site scriptiong (xss)
CVE-2020-21054: Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\\vars\\vars_textarea.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross site scripting (xss)
CVE-2020-21055: A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variables in app\\edit\\filerename.php.
Key phrases: rename any file of the system.via the (, directory traversal
CVE-2020-21056: Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\\edit\\foldernew.php.
Key phrases: create folders via the folder variale to app\\edit\\foldernew.php, directory traversal
CVE-2020-21057: Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/folderdelete.php.
Key phrases: delete folders on the system via the folder, directory traversal
CVE-2020-21058: Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.
Key phrases: execute arbitrary code, execute arbitrary code via the mermaid sytax, cross site scripting
CVE-2020-2106: Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.
Key phrases: stored xss
CVE-2020-21060: SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.
Key phrases: gain privileges, gain privileges via the delete function of the, sql injection
CVE-2020-21066: An issue was discovered in Bento4 v1.5.1.0. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42aac.
Key phrases: denial of service (program crash), heap-buffer-overflow, heap buffer overflow
CVE-2020-2107: Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-2108: Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.
Key phrases: xxe
CVE-2020-21081: A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.
Key phrases: cross-site request forgery (csrf), cross site request forgery
CVE-2020-21082: A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names.
Key phrases: steal administrator and user cookies via crafted payloads, cross-site scripting (xss)
CVE-2020-21087: Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool.
Key phrases: injecting arbitrary web script or HTML, execute arbitrary code by injecting arbitrary web script, cross site scripting (xss)
CVE-2020-21088: Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page"
Key phrases: injecting arbitrary web script or HTML, obtain sensitive information, obtain sensitive information by injecting arbitrary web script, cross site scripting (xss)
CVE-2020-2109: Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
Key phrases: default parameter expressions
CVE-2020-2110: Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
CVE-2020-21101: Cross Site Scriptiong vulnerabilityin Screenly screenly-ose all versions, including v1.8.2 (2019-09-25-Screenly-OSE-lite.img), in the 'Add Asset' page via manipulation of a 'URL' field, which could let a remote malicious user execute arbitrary code.
Key phrases: execute arbitrary code, cross site scriptiong
CVE-2020-2111: Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-21119: SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin_update_module_widgets.php in recordIDValue parameter, allows attackers to gain escalated privileges and execute arbitrary code.
Key phrases: execute arbitrary code, gain escalated privileges, gain escalated privileges and execute arbitrary code, sql injection, escalate privilege
CVE-2020-2112: Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
Key phrases: cross-site scripting
CVE-2020-21120: SQL Injection vulnerability in file home\\controls\\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_cart parameter to /index.php/cart/num.
Key phrases: execute arbitrary commands, /index.php/cart/num, sql injection
CVE-2020-21121: Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_module_widgets.php file.
Key phrases: time-based sql injection
CVE-2020-21122: UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
Key phrases: detect intranet device ports, server-side request forgery (ssrf)
CVE-2020-21124: UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
Key phrases: execute arbitrary code, execute arbitrary code due to a lack of, lack of access control
CVE-2020-21125: An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, arbitrary file creation
CVE-2020-21126: MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
Key phrases: cross-site request forgery (csrf)
CVE-2020-21127: MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
Key phrases: sql injection
CVE-2020-2113: Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
Key phrases: cross-site scripting
CVE-2020-21130: Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html.
Key phrases: cross site scripting (xss)
CVE-2020-21131: SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.
Key phrases: sql injection
CVE-2020-21132: SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.
Key phrases: sql injection
CVE-2020-21133: SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
Key phrases: sql injection
CVE-2020-21139: EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admin.html?do=user&act=add.
Key phrases: arbitrarily add admin accounts via /admin.html?do=user&act, cross-site request forgery (csrf)
CVE-2020-2114: Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21141: iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
Key phrases: cross-site request forgery (csrf)
CVE-2020-21142: Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.
Key phrases: cross site scripting (xss)
CVE-2020-21146: Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.
Key phrases: cross-site scripting (xss)
CVE-2020-21147: RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administrator and execute JavaScript code, because webmain/flow/input/mode_emailmAction.php does not perform strict filtering.
Key phrases: send malicious code to the administrator and execute, cross-site scripting (xss)
CVE-2020-2115: Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-21152: SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction.
Key phrases: execute arbitrary commands, execute arbitrary commands via the functionIds parameter to, sql injection
CVE-2020-2116: A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using, cross-site request forgery, cross site request forgery
CVE-2020-21161: Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.
Key phrases: cross site scripting (xss)
CVE-2020-2117: A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Key phrases: connect to an attacker-specified URL using
CVE-2020-21174: File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
Key phrases: execute arbitrary code, execute arbitrary code via the image suffix function, file upload
CVE-2020-21176: SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the step parameter, sql injection
CVE-2020-21179: Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.
Key phrases: Injecting a malicious SQL statement via the name, sql injection
CVE-2020-2118: A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2020-21180: Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
Key phrases: Injecting a malicious SQL statement via the name, sql injection
CVE-2020-2119: Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-2120: Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-2121: Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21219: Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
Key phrases: run arbitrary code, to run arbitrary code via the RootFolder field, cross site scripting (xss)
CVE-2020-2122: Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakeman post-build step input data.
Key phrases: cross-site scripting
CVE-2020-21224: A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server
Key phrases: remote code execution
CVE-2020-21228: JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
Key phrases: arbitrarily add an administrator cookie, cross-site scripting (xss)
CVE-2020-2123: Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Key phrases: remote code execution
CVE-2020-21236: A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
Key phrases: compromise and impersonate user accounts via obtaining a
CVE-2020-21237: An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
Key phrases: hijack user accounts via brute force attacks
CVE-2020-21238: An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
Key phrases: hijack user accounts via brute force attacks
CVE-2020-2124: Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-21244: An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.
Key phrases: directory traversal, empty folder
CVE-2020-21246: Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.
Key phrases: execute arbitrary code, execute arbitrary code via the news function, cross site scripting
CVE-2020-2125: Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-21250: CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.
Key phrases: arbitrary file upload
CVE-2020-21252: Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
Key phrases: execute arbitrary code, execute arbitrary code and escalate privileges via the, cross site request forgery
CVE-2020-2126: Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-21266: Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability.
Key phrases: cross-site scripting (xss), http post
CVE-2020-21268: Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the lastComment parameter, cross site scripting
CVE-2020-2127: Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-2128: Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-2129: Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-2130: Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Key phrases: unencrypted
CVE-2020-2131: Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-21316: A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.
Key phrases: inject arbitrary web script, gain access, inject arbitrary web script and stolen administrator cookies, cross-site scripting (xss)
CVE-2020-2132: Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-21321: emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articles.
Key phrases: arbitrarily add articles, cross-site request forgery (csrf)
CVE-2020-21322: An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2020-21325: An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\\common.func.php file.
Key phrases: execute arbitrary code, execute arbitrary code via the set_chache method of
CVE-2020-2133: Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Key phrases: unencrypted
CVE-2020-21333: Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
Key phrases: cross site scripting (xss)
CVE-2020-2134: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
CVE-2020-21342: Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
Key phrases: insecure permissions
CVE-2020-21345: Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code.
Key phrases: execute arbitrary code, cross site scripting (xss)
CVE-2020-2135: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
CVE-2020-21353: A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via crafted, stored cross site scripting (xss)
CVE-2020-21356: An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file uploads.
Key phrases: information disclosure, physical path disclosure, file upload
CVE-2020-21357: A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-21358: A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users.
Key phrases: arbitrarily add users, cross site request forgery (csrf)
CVE-2020-21359: An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
Key phrases: execute arbitrary code, bypass the suffix whitelist verification, attackers bypass, execute arbitrary code via adding a character to, arbitrary file upload
CVE-2020-2136: Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
Key phrases: stored cross-site scripting
CVE-2020-21362: A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via the, cross site scripting (xss)
CVE-2020-21363: An arbitrary file deletion vulnerability exists within Maccms10.
Key phrases: file deletion, arbitrary file, arbitrary file deletion
CVE-2020-21365: Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
Key phrases: read local files and disclose sensitive information via, directory traversal
CVE-2020-21366: Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.
Key phrases: gain privileges, gain privileges via the adduser function of index.php, cross site request forgery
CVE-2020-2137: Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
Key phrases: stored xss
CVE-2020-21377: SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter.
Key phrases: sql injection
CVE-2020-21378: SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php.
Key phrases: sql injection
CVE-2020-2138: Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-21386: A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.
Key phrases: gain administrator privileges, cross-site request forgery (csrf)
CVE-2020-21387: A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload.
Key phrases: obtain the administrator cookie and escalate privileges, obtain the administrator cookie and escalate privileges via, cross-site scripting (xss)
CVE-2020-2139: An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.
Key phrases: control the coverage report file contents to overwrite, arbitrary file write
CVE-2020-21394: SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php.
Key phrases: sql injection
CVE-2020-2140: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
Key phrases: cross-site scripting
CVE-2020-21400: SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function.
Key phrases: execute arbitrary code, execute arbitrary code via the id variable, sql injection
CVE-2020-21405: An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk
Key phrases: corrupt files via calls to the saveDeepColorAttr service.unk
CVE-2020-21406: An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisplayInterface service.
Key phrases: cause a denial of service via the switchNextDisplayInterface
CVE-2020-2141: A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.
Key phrases: trigger builds or add a labels in Perforce, cross-site request forgery, cross site request forgery
CVE-2020-2142: A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.
Key phrases: trigger builds, permission check
CVE-2020-21426: Buffer Overflow vulnerability in function C_IStream::read in PluginEXR.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.
Key phrases: run arbitrary code, run arbitrary code and cause other impacts via, buffer overflow
CVE-2020-21427: Buffer Overflow vulnerability in function LoadPixelDataRLE8 in PluginBMP.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.
Key phrases: run arbitrary code, run arbitrary code and cause other impacts via, buffer overflow
CVE-2020-21428: Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.
Key phrases: run arbitrary code, run arbitrary code and cause other impacts via, buffer overflow
CVE-2020-2143: Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21431: HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
Key phrases: arbitrary file read and write
CVE-2020-21434: Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field.
Key phrases: cross-site scripting (xss)
CVE-2020-2144: Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-2145: Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system.
Key phrases: plain text
CVE-2020-21452: An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload
Key phrases: upload
CVE-2020-2146: Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
Key phrases: man in the middle
CVE-2020-21468: A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a released version, such as 5.0.7
Key phrases: denial of service (DOS), segmentation fault
CVE-2020-21469: An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account).
Key phrases: cause a denial of service via repeatedly sending
CVE-2020-2147: A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
Key phrases: connect to an attacker-specified SSH server, cross-site request forgery, cross site request forgery
CVE-2020-21474: File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the /nucleus/plugins, file upload
CVE-2020-2148: A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
Key phrases: connect to an attacker-specified SSH server, permission check
CVE-2020-21480: An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file write
CVE-2020-21481: An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file which is later changed to a PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .txt file, arbitrary file upload
CVE-2020-21482: A cross-site scripting (XSS) vulnerability in RGCMS v1.06 allows attackers to obtain the administrator's cookie via a crafted payload in the Name field under the Message Board module
Key phrases: obtain the administrator's cookie via a crafted payload, cross-site scripting (xss)
CVE-2020-21483: An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .jpg file, arbitrary file upload
CVE-2020-21485: Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.
Key phrases: executea arbitrary code, executea arbitrary code via the path parameter in, cross site scripting
CVE-2020-21486: SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the _userlist function in framerwork/phpok_call.php file.
Key phrases: obtain sensitive information, obtain sensitive information via the _userlist function, sql injection
CVE-2020-21487: Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.
Key phrases: execute arbitrary code, execute arbitrary code via the RootFolder field of, cross site scripting
CVE-2020-21489: File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.
Key phrases: execute arbitrary code, execute arbitrary code via the /admin/index.php?r, file upload
CVE-2020-2149: Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21490: An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled.
Key phrases: memory leak
CVE-2020-21493: An issue in the component route\\\\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.
Key phrases: enumerate usernames
CVE-2020-21494: A cross-site scripting (XSS) vulnerability in the component install\\\\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via changing the doctype value to 0.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via changing, cross-site scripting (xss)
CVE-2020-21495: A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitename parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via the, cross-site scripting (xss)
CVE-2020-21496: A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitebrief parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via the, cross-site scripting (xss)
CVE-2020-2150: Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21503: waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free.
Key phrases: modify a price, logic flaw, sold for free
CVE-2020-21504: waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.
Key phrases: cross-site scripting (xss)
CVE-2020-21505: waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave.
Key phrases: cross-site scripting (xss)
CVE-2020-21506: waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add.
Key phrases: cross-site scripting (xss)
CVE-2020-2151: Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21514: An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password.
Key phrases: execute arbitrary code, gain escalated privileges, gain escalated privileges and execute arbitrary code due, default password, escalate privilege
CVE-2020-21516: There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.
Key phrases: execute relevant PHP code, arbitrary file upload
CVE-2020-21517: Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
Key phrases: cross site scripting (xss)
CVE-2020-2152: Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
Key phrases: cross-site scripting
CVE-2020-21522: An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can overwrite some files, such as ftl files, .bashrc files in the user directory, and finally get the permissions of the operating system.
Key phrases: zip slip directory traversal
CVE-2020-21523: A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: <#assign test="freemarker.template.utility.Execute"?new()> ${test("touch /tmp/freemarkerPwned")}
Key phrases: cause arbitrary code execution, server-side freemarker template injection
CVE-2020-21524: There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
Key phrases: xml external entity (xxe), ddos
CVE-2020-21525: Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.
Key phrases: bypass it, arbitrary file reading, directory traversal
CVE-2020-21526: An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.
Key phrases: bypass it, arbitrary file writing, arbitrary file write, to write files, directory traversal
CVE-2020-21527: There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delete any files on the system through directory traversal.
Key phrases: delete any files on the system through directory, arbitrary file deletion, directory traversal
CVE-2020-21528: A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file.
Key phrases: cause a denial of service via crafted assembly, segmentation fault
CVE-2020-21529: fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.
Key phrases: stack buffer overflow
CVE-2020-2153: Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21530: fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c.
Key phrases: segmentation fault
CVE-2020-21531: fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c.
Key phrases: global buffer overflow
CVE-2020-21532: fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c.
Key phrases: global buffer overflow
CVE-2020-21533: fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c.
Key phrases: stack buffer overflow
CVE-2020-21534: fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c.
Key phrases: global buffer overflow
CVE-2020-21535: fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c.
Key phrases: segmentation fault
CVE-2020-2154: Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file system.
Key phrases: plain text
CVE-2020-21547: Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2020-21548: Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2020-2155: Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21554: A File Deletion vulnerability exists in TinyShop 3.1.1 in the back_list parameter in controllers\\admin.php, which could let a malicious user delete any file such as install.lock to reinstall cms.
Key phrases: file deletion
CVE-2020-2156: Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
Key phrases: plain text
CVE-2020-21564: An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files.
Key phrases: file upload, remote command execution
CVE-2020-2157: Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
Key phrases: plain text