yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-1790: GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands.
Key phrases: inject certain commands, command injection
CVE-2020-17901: Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.
Key phrases: change the password of a user, cross-site request forgery (csrf), cross site request forgery
CVE-2020-1791: HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode.
Key phrases: switch to third desktop after a series of, improper authorization, logic judging error
CVE-2020-1792: Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) have an out of bounds write vulnerability. The software writes data past the end of the intended buffer because of insufficient validation of certain parameter when initializing certain driver program. An attacker could trick the user into installing a malicious application, successful exploit could cause the device to reboot.
Key phrases: out of bounds write, reboot
CVE-2020-1793: There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, successful exploit could allow the attacker to gain certain data of the application which is locked. Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
Key phrases: gain certain data of the application which is locked, authentication, improper authentication
CVE-2020-1794: There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, successful exploit could allow the attacker to gain certain data of the application which is locked. Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
Key phrases: gain certain data of the application which is locked, authentication, improper authentication
CVE-2020-1795: There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations.Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
Key phrases: bypass the Digital Balance limit after a series, logic error
CVE-2020-17952: A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
Key phrases: execute arbitrary PHP code, remote code execution (rce)
CVE-2020-1796: There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorization to certain user, successful exploit could allow a low privilege user to do certain operation which the user are supposed not to do.Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
Key phrases: do certain operation which the user are supposed, improper authorization
CVE-2020-1797: HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function.
Key phrases: certain user break the limit of digital balance, authorization, improper authorization
CVE-2020-1798: HUAWEI P30 smartphones with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. A logic error occurs when handling NFC work, an attacker should establish a NFC connection to the target phone, and then do a series of operations on the target phone. Successful exploit could allow a guest user do certain operation which is beyond the guest user's privilege.
Key phrases: a guest user do certain operation which is, authentication, improper authentication
CVE-2020-1799: E6878-370 with versions of 10.0.3.1(H557SP27C233), 10.0.3.1(H563SP1C00), 10.0.3.1(H563SP1C233) has a use after free vulnerability. The software references memory after it has been freed in certain scenario, the attacker does a series of crafted operations through web portal, successful exploit could cause a use after free condition which may lead to malicious code execution.
Key phrases: use after free, use after free condition, malicious code execution
CVE-2020-17999: Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
Key phrases: execute arbitrary code, execute arbitrary code by injecting commands via a, cross site scripting (xss)
CVE-2020-1800: HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability. The software incorrectly restricts access to a function interface from an unauthorized actor, the attacker tricks the user into installing a crafted application, successful exploit could allow the attacker do certain unauthenticated operations.
Key phrases: the attacker do certain unauthenticated operations, access control, improper access control
CVE-2020-1801: There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2).
Key phrases: improper authentication, information disclosure
CVE-2020-18013: SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm.
Key phrases: sql injextion
CVE-2020-18019: SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component.
Key phrases: injecting arbitrary commands, obtain sensitive information, obtain sensitive information by injecting arbitrary commands into, sql injection
CVE-2020-1802: There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product versions include:OSCA-550 versions 1.0.1.23(SP2);OSCA-550A versions 1.0.1.23(SP2);OSCA-550AX versions 1.0.1.23(SP2);OSCA-550X versions 1.0.1.23(SP2).
Key phrases: load a crafted file to the device through, insufficient integrity validation
CVE-2020-18020: SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to the "admin.php" component.
Key phrases: execute arbitrary code, execute arbitrary code by injecting SQL commands into, sql injection
CVE-2020-18022: Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\\\\3.1.1\\\\kindeditor.js" component.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code or obtain sensitive information by, cross site scripting (xss), arbitrary commands
CVE-2020-1803: Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C432E10R3P4) have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, successful exploit could cause information disclosure.
Key phrases: gain certain information, information disclosure
CVE-2020-18032: Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.
Key phrases: execute arbitrary code, denial of service (application crash), execute arbitrary code or cause a denial of, buffer overflow
CVE-2020-18035: Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java".
Key phrases: execute arbitrary code, execute arbitrary code by injecting commands into the, cross site scripting (xss)
CVE-2020-1804: Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 1 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1805 and CVE-2020-1806.
Key phrases: out of bounds, bytes out of bound read, information disclosure, service abnormal
CVE-2020-18048: An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted input entered
CVE-2020-1805: Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 2 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1804 and CVE-2020-1806.
Key phrases: out of bounds, bytes out of bound read, information disclosure, service abnormal
CVE-2020-1806: Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 3 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1804 and CVE-2020-1805.
Key phrases: out of bounds, bytes out of bound read, information disclosure, service abnormal
CVE-2020-18065: Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
Key phrases: cross site scripting (xss)
CVE-2020-18066: Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
Key phrases: cross site scripting
CVE-2020-1807: HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper authorization vulnerability. The software does not properly restrict certain user's modification of certain configuration file, successful exploit could allow the attacker to bypass app lock after a series of operation in ADB mode.
Key phrases: bypass app lock after a series of operation, authorization, improper authorization
CVE-2020-18070: Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php".
Key phrases: delete folders by injecting commands into a crafted, path traversal
CVE-2020-18077: A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS).
Key phrases: denial of service (DoS), cause a denial of service (DoS), buffer overflow, denial of service (dos)
CVE-2020-18078: A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password.
Key phrases: reset the Administrator account's password
CVE-2020-1808: Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.176(C00E60R2P11);9.1.0.135(C00E133R2P1); versions earlier than 10.1.0.123(C431E22R3P5), versions earlier than 10.1.0.126(C636E5R3P4), versions earlier than 10.1.0.160(C00E160R2P11); versions earlier than 10.1.0.126(C185E8R5P1), versions earlier than 10.1.0.126(C636E9R2P4), versions earlier than 10.1.0.160(C00E160R2P8); versions earlier than 10.0.0.179(C636E3R4P3), versions earlier than 10.0.0.180(C185E3R3P3), versions earlier than 10.0.0.180(C432E10R3P4), versions earlier than 10.0.0.181(C675E5R1P2) have an out of bound read vulnerability. The software reads data past the end of the intended buffer. The attacker tricks the user into installing a crafted application, successful exploit may cause information disclosure or service abnormal.
Key phrases: out of bound read, information disclosure, service abnormal
CVE-2020-18081: The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query.
Key phrases: obtain the password, obtain the password in plaintext through a SQL
CVE-2020-18084: Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.
Key phrases: execute arbitrary code, execute arbitrary code by injecting commands into the, cross site scripting (xss)
CVE-2020-1809: HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone leading to information disclosure.
Key phrases: information disclosure
CVE-2020-1810: There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorithm which have been considered as a weak algorithm. Attackers may exploit this vulnerability to leak some information.
Key phrases: weak algorithm, leak, leak information
CVE-2020-18102: Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php".
Key phrases: execute arbitrary code, execute arbitrary code by injecting crafted commands the, cross site scripting (xss)
CVE-2020-18106: The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.
Key phrases: perform SQL injection, sql injection
CVE-2020-1811: GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exploit this vulnerability by sending crafted commands to the affected device. Successful exploit could allow an attacker to execute commands.
Key phrases: execute commands, command injection, successful exploit, insufficient input validation
CVE-2020-18114: An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.
Key phrases: upload a webshell in HTM format, file upload, arbitrary file, arbitrary file upload
CVE-2020-18116: A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.
Key phrases: perform SQL injection, sql injection
CVE-2020-1812: HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to perform unauthorized operations.
Key phrases: bypass the authentication, bypass the authentication to perform unauthorized operations, improper authentication, bypass authentication
CVE-2020-18121: A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.
Key phrases: modify .php files, configuration issue, getshell
CVE-2020-18123: A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts.
Key phrases: arbitrarily delete admin accounts, cross-site request forgery (csrf), cross site request forgery
CVE-2020-18124: A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords.
Key phrases: arbitrarily reset account passwords, cross-site request forgery (csrf), cross site request forgery
CVE-2020-18125: A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, reflected cross-site scripting (xss)
CVE-2020-18126: Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, stored cross-site scripting (xss)
CVE-2020-18127: An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
Key phrases: arbitrarily view files
CVE-2020-18129: A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.
Key phrases: add an admin account via login.php, csrf
CVE-2020-1813: HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper authentication of specific interface, in specific scenario attackers could access specific interface without authentication. Successful exploit could allow the attacker to perform unauthorized operations.
Key phrases: perform unauthorized operations, improper authentication
CVE-2020-18131: Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary account via a crafted request to /members/console.php?cID=5.
Key phrases: escilate privledges to an arbitrary account via a, cross site request forgery (csrf)
CVE-2020-18132: Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryEdit.
Key phrases: execute arbitrary code, execute arbitrary code via the category name field, cross site scripting (xss)
CVE-2020-1814: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in the affected products in some special scenarios to exploit the vulnerability. Due to improper race conditions of different operations, successful exploit will lead to Dangling pointer dereference, causing some service abnormal.
Key phrases: dangling pointer dereference, special scenarios, service abnormal, race condition
CVE-2020-18144: SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.
Key phrases: sql injection
CVE-2020-18145: Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.
Key phrases: cross site scripting (xss)
CVE-2020-1815: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a memory leak vulnerability. The software does not sufficiently track and release allocated memory while parse certain message, the attacker sends the message continuously that could consume remaining memory. Successful exploit could cause memory exhaust.
Key phrases: memory leak, memory exhaust
CVE-2020-18151: Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.
Key phrases: cross site request forgery (csrf)
CVE-2020-18155: SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
Key phrases: sql injection
CVE-2020-18157: Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.
Key phrases: cross site request forgery (csrf)
CVE-2020-18158: Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.
Key phrases: cross site scripting (xss)
CVE-2020-1816: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Denial of Service (DoS) vulnerability. Due to improper processing of specific IPSEC packets, remote attackers can send constructed IPSEC packets to affected devices to exploit this vulnerability. Successful exploit could cause the IPSec function of the affected device abnormal.
Key phrases: Denial of Service (DoS), denial of service (dos)
CVE-2020-18164: SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.
Key phrases: sql injection
CVE-2020-18165: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
Key phrases: execute arbitrary code, execute arbitrary code by injecting commands into the, cross site scripting (xss)
CVE-2020-18166: Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc".
Key phrases: upload arbitrary files, upload arbitrary files by attaching a file with, unrestricted file upload
CVE-2020-18167: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu".
Key phrases: execute arbitrary code, execute arbitrary code by injecting commands into the, cross site scripting (xss)
CVE-2020-18169: A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS. See reference document for more details
Key phrases: escalate privileges
CVE-2020-1817: Huawei PCManager with versions earlier than 10.0.1.36 has a privilege escalation vulnerability. Due to improper permission management of specific files, local attackers with low permissions can inject commands to exploit this vulnerability. Successful exploit may cause privilege escalation.
Key phrases: privilege escalation, improper permissions
CVE-2020-18170: An issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows attackers to escalate privileges via a change in permissions.
Key phrases: escalate privileges via a change in permissions
CVE-2020-18171: TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details
Key phrases: obfuscate and embed crafted files used to escalate, escalate privileges
CVE-2020-18172: A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges.
Key phrases: escalate privileges, code injection
CVE-2020-18173: A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, dll injection
CVE-2020-18174: A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges.
Key phrases: escalate privileges, process injection
CVE-2020-18175: SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
Key phrases: sql injection
CVE-2020-18178: Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
Key phrases: delete arbitrary files, view, path traversal
CVE-2020-18184: In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametres_edittpl.php allows remote attackers to execute arbitrary PHP code by placing this code into a template.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by placing this code
CVE-2020-18185: class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modify the configuration
CVE-2020-18190: Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture.
Key phrases: delete arbitrary files, directory traversal
CVE-2020-18191: GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php
Key phrases: delete arbitrary files, directory traversal
CVE-2020-18194: Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.
Key phrases: execute arbitrary code, execute arbitrary code by adding a crafted script, cross site scripting (xss)
CVE-2020-18195: Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."
Key phrases: execute arbitrary code, execute arbitrary code and delete a specific article, cross site request forgery (csrf)
CVE-2020-18198: Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."
Key phrases: execute arbitrary code, execute arbitrary code and delete specific images via, cross site request forgery (csrf)
CVE-2020-18215: Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad_id, (2) menu_id, and (3) cashout_id parameters, which could let a remote malicious user execute arbitrary code.
Key phrases: execute arbitrary code, sql injection
CVE-2020-18220: Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.
Key phrases: obtain sensitive information, obtain sensitive information as it does not use, dictionary
CVE-2020-18221: Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a mathematical formula.
Key phrases: execute arbitrary code, execute arbitrary code by injecting commands during block, cross site scripting (xss)
CVE-2020-18229: Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of component " /admin/web_config.php".
Key phrases: execute arbitrary code, execute arbitrary code by injecting scripts into the, cross site scripting (xss)
CVE-2020-18230: Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php".
Key phrases: execute arbitrary code, execute arbitrary code by injecting scripts into the, cross site scripting (xss)
CVE-2020-18232: Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote attackers to run arbitrary code via creation of crafted file.
Key phrases: run arbitrary code, run arbitrary code via creation of crafted file, buffer overflow
CVE-2020-1825: FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attackers can exploit this vulnerability by sending constructed messages to the affected device through another device on the same network. Successful exploit could cause affected devices to be abnormal.
Key phrases: Denial of Service (DoS), denial of service (dos), abnormal
CVE-2020-18259: ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, reflective cross-site scripting (xss)
CVE-2020-1826: Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encryption tool, an attacker with the root permission may exploit the vulnerability to obtain some information.
Key phrases: obtain some information, information leak, weak encryption
CVE-2020-18261: An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, arbitrary file upload
CVE-2020-18262: ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter.
Key phrases: sql injection
CVE-2020-18263: PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. This vulnerability allows attackers to access sensitive database information.
Key phrases: access sensitive database information, sql injection
CVE-2020-18264: Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_edit_member".
Key phrases: execute arbitrary code, gain privilege, gain privilege and execute arbitrary code via the, cross site request forgery (csrf), gain privileges
CVE-2020-18265: Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member".
Key phrases: execute arbitrary code, gain privilege, gain privilege and execute arbitrary code via the, cross site request forgery (csrf), gain privileges
CVE-2020-18268: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."
Key phrases: obtain sensitive information, obtain sensitive information via the "redirect", open redirect
CVE-2020-1827: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. An attacker can exploit this vulnerability by sending specific request packets to affected devices. Successful exploit may lead to information leakage.
Key phrases: information leakage
CVE-2020-1828: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. Attackers can send specific message to cause out-of-bound read, compromising normal service.
Key phrases: input validation, out-of-bound read, normal service, out of bound read
CVE-2020-18280: Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.
Key phrases: execute arbitrary code, execute arbitrary code via the EMBED SRC function, cross site scripting
CVE-2020-18282: Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback feature.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via feedback, cross-site scripting (xss)
CVE-2020-1829: Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, and V500R001C60SPC500 have a vulnerability that the IPSec module handles a message improperly. Attackers can send specific message to cause double free memory. This may compromise normal service.
Key phrases: double free memory, compromise normal service
CVE-2020-1830: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a vulnerability that a memory management error exists when IPSec Module handing a specific message. This causes 1 byte out-of-bound read, compromising normal service.
Key phrases: memory management error, byte out-of-bound read, compromising normal service, out of bound read
CVE-2020-1831: HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC.
Key phrases: the user break the limit of digital balance, improper authorization
CVE-2020-1832: E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnerability. The program copies an input buffer to an output buffer without verification. An attacker in the adjacent network could send a crafted message, successful exploit could lead to stack buffer overflow which may cause malicious code execution.
Key phrases: stack buffer overflow, malicious code execution
CVE-2020-18324: Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.
Key phrases: cross site scripting (xss)
CVE-2020-18325: Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
Key phrases: cross site scripting (xss)
CVE-2020-18326: Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.
Key phrases: cross site request forgery (csrf)
CVE-2020-18327: Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2
Key phrases: cross site scripting (xss)
CVE-2020-18329: An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface.
Key phrases: gain full unauthenticated access, gain full unauthenticated access to the configuration and
CVE-2020-1833: Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock function, an attacker should do a series of crafted operations quickly before the phone is unlocked, successful exploit could allow the attacker to access clock information without unlock the phone.
Key phrases: access clock information without unlock the phone, authentication, improper authentication
CVE-2020-18330: An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), allows attackers to gain access to the configuration interface.
Key phrases: gain access, gain access to the configuration interface
CVE-2020-18331: Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), via the getpage parameter to /cgi-bin/webproc.
Key phrases: directory traversal
CVE-2020-18336: Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file exporting function.
Key phrases: obtain sensitive information, obtain sensitive information via the PDF file exporting, cross site scripting (xss)
CVE-2020-1834: HUAWEI P30 and HUAWEI P30 Pro with versions earlier than 10.1.0.135(C00E135R2P11) and versions earlier than 10.1.0.135(C00E135R2P8) have an insufficient integrity check vulnerability. The system does not check certain software package's integrity sufficiently. Successful exploit could allow an attacker to load a crafted software package to the device.
Key phrases: load a crafted software package to the device, insufficient integrity check
CVE-2020-1835: HUAWEI Mate 30 with versions earlier than 10.1.0.126(C00E125R5P3) have an information disclosure vulnerability. A logic judgment error occurs when the system handling Bluetooth connections, an attacker could craft as an authenticated Bluetooth peer to launch the attack. Successful exploit could cause information disclosure.
Key phrases: information disclosure, logic judgment error
CVE-2020-1836: HUAWEI P30 with versions earlier than 10.1.0.160(C00E160R2P11) and HUAWEI P30 Pro with versions earlier than 10.1.0.160(C00E160R2P8) have an information disclosure vulnerability. Certain function's default configuration in the system seems insecure, an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure.
Key phrases: information disclosure
CVE-2020-1837: ChangXiang 8 Plus with versions earlier than 9.1.0.136(C00E121R1P6T8) have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal service condition.
Key phrases: denial of service, denial of signal service condition
CVE-2020-18378: A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
Key phrases: null pointer dereference, segmentation fault, denial-of-service, denial of service
CVE-2020-1838: HUAWEI Mate 30 Pro with versions earlier than 10.1.0.150(C00E136R5P3) have is an improper authentication vulnerability. The device does not sufficiently validate certain credential of user's face, an attacker could craft the credential of the user, successful exploit could allow the attacker to pass the authentication with the crafted credential.
Key phrases: pass the authentication with the crafted credential, improper authentication
CVE-2020-18382: Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt.
Key phrases: heap-buffer-overflow, segmentation fault, denial-of-service, heap buffer overflow, denial of service
CVE-2020-1839: HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a race condition vulnerability. There is a timing window exists in which certain pointer members can be modified by another process that is operating concurrently, an attacker should trick the user into running a crafted application with high privilege, successful exploit could cause code execution.
Key phrases: race condition, code execution
CVE-2020-18392: Stack overflow vulnerability in parse_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2020-18395: A NULL-pointer deference issue was discovered in GNU_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial of service (DOS) via segment faults caused by crafted inputs.
Key phrases: denial of service (DOS), null-pointer deference issue, segment faults
CVE-2020-1840: HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high privilege can execute a specific command to exploit this vulnerability. Successful exploitation may cause information leak and compromise the availability of the smart phones.Affected product versions include: HUAWEI Mate 20 versions Versions earlier than 10.0.0.175(C00E70R3P8)
Key phrases: insufficient authentication, information leak, availability
CVE-2020-18404: An issue was discovered in espcms version P8.18101601. There is a cross site scripting (XSS) vulnerability that allows arbitrary code to be executed via the title parameter.
Key phrases: allows arbitrary code, be executed via the title parameter, cross site scripting (xss)
CVE-2020-18406: An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.
Key phrases: be sent in clear text due to no
CVE-2020-18409: Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html.
Key phrases: obtain administrator permissions, obtain administrator permissions via /index.php/admin/, cross site request forgery (csrf)
CVE-2020-1841: Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C10, V600R019C00, and V600R019C00SPC100 have an information leak vulnerability. An unauthenticated, remote attacker can make a large number of attempts to guess information. Successful exploitation may cause information leak.
Key phrases: information leak
CVE-2020-18410: A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtain administrator privileges.
Key phrases: obtain administrator privileges, stored cross site scripting (xss)
CVE-2020-18413: Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, stored cross site scripting (xss)
CVE-2020-18414: Stored cross site scripting (XSS) vulnerability in Chaoji CMS v2.18 that allows attackers to execute arbitrary code via /index.php?admin-master-webset.
Key phrases: execute arbitrary code, execute arbitrary code via /index.php?admin-master-, stored cross site scripting (xss)
CVE-2020-18416: An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/config.html&id=6 to modify payment information.
Key phrases: execute arbitrary code, execute arbitrary code via /admin.php?s=/addons/config.html&id=6 to, cross site request forgery (csrf)
CVE-2020-18418: A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert.
Key phrases: create administrator accounts via /index.php?s=Admin-, cross site request forgery (csrf)
CVE-2020-1842: Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker obtain high privilege.
Key phrases: obtain high privilege, authentication
CVE-2020-18428: tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service (DOS).
Key phrases: denial of service (DOS), array index error, denial of service (dos)
CVE-2020-1843: Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), and OSCA-550X version 1.0.0.71(SP2) have an insufficient verification vulnerability. An attacker can perform specific operations to exploit this vulnerability by physical access methods. Successful exploitation may cause the attacker perform an illegal operation.
Key phrases: insufficient verification, physical access methods, illegal operation
CVE-2020-18430: tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service (DOS).
Key phrases: denial of service (DOS), array index error, denial of service (dos)
CVE-2020-18432: File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.
Key phrases: upload arbitrary files, gain escalated privileges, upload arbitrary files and gain escalated privileges, file upload, escalate privilege
CVE-2020-18438: Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.
Key phrases: disclose sensitive information, directory traversal
CVE-2020-18439: An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get a shell.
Key phrases: write arbitrary files, write arbitrary files or get a shell
CVE-2020-1844: PCManager with versions earlier than 10.0.5.51 have a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.
Key phrases: obtain a higher privilege, privilege escalation
CVE-2020-18440: Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2020-18442: Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
Key phrases: cause a denial of service via the return, infinite loop
CVE-2020-18445: Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php.
Key phrases: cross site scripting (xss)