yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-7682: This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
Key phrases: path sanitization
CVE-2020-7683: This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
Key phrases: path sanitization
CVE-2020-7684: This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.
Key phrases: path sanitization
CVE-2020-7685: This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Key phrases: upload arbitrary file types
CVE-2020-7686: This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
Key phrases: path sanitization
CVE-2020-7687: This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
Key phrases: path sanitization
CVE-2020-7688: The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
CVE-2020-7689: Data is truncated wrong when its length is greater than 255 bytes.
CVE-2020-7690: All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.
Key phrases: cross-site scripting (xss)
CVE-2020-7691: In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
CVE-2020-7692: PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Key phrases: obtain the authorization code using a malicious app, gain authorization to the protected resource. This affects
CVE-2020-7693: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Key phrases: crashing
CVE-2020-7694: This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).
Key phrases: asni escape sequence injection, integrity
CVE-2020-7695: Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Key phrases: add arbitrary headers, http response splitting
CVE-2020-7696: This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
Key phrases: leaked
CVE-2020-7697: This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType);
CVE-2020-7698: This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
CVE-2020-7699: This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Key phrases: corrupt http request, denial of service, arbitrary code execution
CVE-2020-7700: All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
Key phrases: prototype pollution
CVE-2020-7701: madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
Key phrases: prototype pollution
CVE-2020-7702: All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
Key phrases: prototype pollution
CVE-2020-7703: All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
Key phrases: prototype pollution
CVE-2020-7704: The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
Key phrases: prototype pollution
CVE-2020-7705: This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.
Key phrases: advertisement attribution fraud
CVE-2020-7706: The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
Key phrases: prototype pollution
CVE-2020-7707: The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Key phrases: prototype pollution
CVE-2020-7708: The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
Key phrases: prototype pollution
CVE-2020-7709: This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
CVE-2020-7710: This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
Key phrases: arbitrary commands
CVE-2020-7711: This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Key phrases: nil-pointer dereference, malformed xml signatures, crash
CVE-2020-7712: This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
CVE-2020-7713: All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
Key phrases: prototype pollution
CVE-2020-7714: All versions of package confucious are vulnerable to Prototype Pollution via the set function.
Key phrases: prototype pollution
CVE-2020-7715: All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.
Key phrases: prototype pollution
CVE-2020-7716: All versions of package deeps are vulnerable to Prototype Pollution via the set function.
Key phrases: prototype pollution
CVE-2020-7717: All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.
Key phrases: prototype pollution
CVE-2020-7718: All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
Key phrases: prototype pollution
CVE-2020-7719: Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
Key phrases: prototype pollution
CVE-2020-7720: The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Key phrases: prototype pollution, breaking change
CVE-2020-7721: All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.
Key phrases: prototype pollution
CVE-2020-7722: All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.
Key phrases: prototype pollution
CVE-2020-7723: All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.
Key phrases: prototype pollution
CVE-2020-7724: All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.
Key phrases: prototype pollution
CVE-2020-7725: All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.
Key phrases: prototype pollution
CVE-2020-7726: All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
Key phrases: prototype pollution
CVE-2020-7727: All versions of package gedi are vulnerable to Prototype Pollution via the set function.
Key phrases: prototype pollution
CVE-2020-7729: The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Key phrases: arbitrary code execution
CVE-2020-7730: The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Key phrases: command injection
CVE-2020-7731: This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Key phrases: nil-pointer dereference, malformed xml signatures, crash
CVE-2020-7733: The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2020-7734: All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
Key phrases: cross-site scripting (xss)
CVE-2020-7735: The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
Key phrases: command injection
CVE-2020-7736: The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
Key phrases: prototype pollution
CVE-2020-7737: All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
Key phrases: prototype pollution
CVE-2020-7738: All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().
Key phrases: arbitrary code execution
CVE-2020-7739: This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
Key phrases: for an SSRF attack, ssrf
CVE-2020-7740: This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
Key phrases: an SSRF attack, ssrf
CVE-2020-7741: This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Key phrases: xss payloads
CVE-2020-7742: This affects the package simpl-schema before 1.10.2.
CVE-2020-7743: The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Key phrases: prototype pollution
CVE-2020-7744: This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background).
CVE-2020-7745: This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device.
Key phrases: execute arbitrary code, backdoor
CVE-2020-7746: This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Key phrases: prototype pollution
CVE-2020-7747: This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Key phrases: malicious javascript code
CVE-2020-7748: This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Key phrases: pollute
CVE-2020-7749: This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
Key phrases: inject arbitrary HTML, xss, ssrf, local file read
CVE-2020-7750: This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Key phrases: inject arbitrary elements
CVE-2020-7751: pathval before version 1.1.1 is vulnerable to prototype pollution.
Key phrases: prototype pollution
CVE-2020-7752: This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Key phrases: command injection
CVE-2020-7753: All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2020-7754: This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Key phrases: exponentially longer
CVE-2020-7755: All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2020-7757: This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.
CVE-2020-7758: This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Key phrases: fetch arbitrary files
CVE-2020-7759: The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]
Key phrases: sql injection
CVE-2020-7760: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Key phrases: redos
CVE-2020-7761: This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
Key phrases: cause a denial of service when validating crafted
CVE-2020-7762: This affects the package jsreport-chrome-pdf before 1.10.0.
CVE-2020-7763: This affects the package phantom-html-to-pdf before 0.6.1.
CVE-2020-7764: This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
Key phrases: denial of service, unkeyed header, cache poisoning
CVE-2020-7765: This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Key phrases: pollute
CVE-2020-7766: This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Key phrases: prototype pollution
CVE-2020-7767: All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2020-7768: The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
Key phrases: prototype pollution
CVE-2020-7769: This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Key phrases: arbitrary command flag injection, arbitrary commands
CVE-2020-7770: This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Key phrases: prototype pollution
CVE-2020-7771: The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
Key phrases: prototype pollution
CVE-2020-7772: This affects the package doc-path before 2.1.2.
CVE-2020-7773: This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);
Key phrases: malicious javascript
CVE-2020-7774: The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Key phrases: prototype pollution
CVE-2020-7775: This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js.
CVE-2020-7776: This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
Key phrases: xss
CVE-2020-7777: This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.
Key phrases: run arbitrary JavaScript code, victim machine, untrusted schema files, arbitrary code execution
CVE-2020-7778: This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
CVE-2020-7779: All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2020-7780: This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Key phrases: empty x-xsrf-token header, empty xsrf-token cookie
CVE-2020-7781: This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:
Key phrases: injection point
CVE-2020-7782: This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.
Key phrases: vulnerable package platform-command, injection point, command injection
CVE-2020-7784: This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:
Key phrases: injection point
CVE-2020-7785: This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.
Key phrases: injection point
CVE-2020-7786: This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.
Key phrases: injection point
CVE-2020-7787: This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic.
Key phrases: logical defect
CVE-2020-7788: This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Key phrases: exploited
CVE-2020-7789: This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
Key phrases: run arbitrary commands, run arbitrary commands on Linux machines due to, options params
CVE-2020-7790: This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.
Key phrases: include arbitrary files
CVE-2020-7791: This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.
CVE-2020-7792: This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.
Key phrases: prototype pollution
CVE-2020-7793: The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2020-7794: This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
Key phrases: injection point
CVE-2020-7795: The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.
Key phrases: command injection
CVE-2020-7796: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
Key phrases: SSRF when WebEx zimlet is installed and zimlet, ssrf
CVE-2020-7799: An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.
Key phrases: execute commands
CVE-2020-7800: The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability. The affected product is vulnerable to specially crafted TCP packets, which can cause the device to shut down or reboot and lose configuration settings. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7801, and CVE-2020-7802.
Key phrases: improper check for unusual or exceptional conditions, reboot
CVE-2020-7801: The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. The affected product is vulnerable to information exposure over the SNMP protocol. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7800, and CVE-2020-7802.
Key phrases: exposure of sensitive information, information exposure
CVE-2020-7802: The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-276) vulnerability. The affected product is vulnerable to insufficient default permissions, which could allow an attacker to view network configurations through SNMP communication. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7800, and CVE-2020-7801.
Key phrases: view network configurations through SNMP communication, incorrect default permissions, insufficient default permissions
CVE-2020-7803: IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution.
Key phrases: cause arbitrary code execution, file donwload
CVE-2020-7804: ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method.
Key phrases: execute arbitrary command, execute arbitrary command via the ShellExec method, arbitrary commands
CVE-2020-7805: An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands.
Key phrases: execute arbitrary OS commands, command injection, arbitrary os command
CVE-2020-7806: Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allows attacker to cause remote code execution.
Key phrases: cause remote code execution, arbitrary code execution
CVE-2020-7807: A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT____ of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: LG Electronics; LGPCSuite_Setup : 1.0.0.3 on Windows(x86, x64); IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup : 1.0.0.9 on Windows(x86, x64).
Key phrases: cause ____IMPACT__, integrity check, ____impact____, hijack
CVE-2020-7808: In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
Key phrases: modify arguments which causes downloading a random DLL, integrity check, injection
CVE-2020-7809: ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Album(sab) file.
Key phrases: document object model (dom), cross-site scripting
CVE-2020-7810: hslogin2.dll ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. This is due to a lack of integrity verification of the policy files referenced in the update process, and a remote attacker could induce a user to crafted web page, causing damage such as malicious code infection.
Key phrases: be downloaded and executed by setting the arguments, damage, integrity
CVE-2020-7811: Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializes the data received during inter-process communication
Key phrases: privilege escalation as commands crafted by attacker are
CVE-2020-7812: Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victims PC.
Key phrases: download arbitrary file, download arbitrary file by setting the arguments to, code execution, reboot
CVE-2020-7813: Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
Key phrases: execute arbitrary file, download and execute arbitrary file by setting the, code execution
CVE-2020-7814: RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file extension, witch can used as remote-code-excution attacks by hackers File download & execution vulnerability in ____COMPONENT____ of RAONWIZ RAON KUpload allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions prior to 2018.0.2.51 on Windows.
Key phrases: be downloaded and excuted by lack of validation, cause ____IMPACT__, remote files, remote-code-excution, file download & execution, ____impact____
CVE-2020-7815: XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable method. this can be leveraged for code execution. File download vulnerability in ____COMPONENT____ of TOBESOFT XPLATFORM allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: TOBESOFT XPLATFORM 9.2.250 versions prior to 9.2.260 on Windows.
Key phrases: be downloaded by setting the arguments to the, cause ____IMPACT__, remote files, file download, ____impact____, code execution
CVE-2020-7816: A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could allow an unauthenticated, remote attacker to cause an arbitrary code execution on an affected device.nThe vulnerability is due to a stack overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device.
Key phrases: cause an arbitrary code execution on an affected, stack overflow
CVE-2020-7817: MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files.
Key phrases: downloading arbitrary files, integrity
CVE-2020-7818: DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: heap-based overflow, arbitrary code execution
CVE-2020-7819: A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information.
Key phrases: perform SQL query to access username password and, sql-injection
CVE-2020-7820: Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the arguments to the vulnerable API. This can be leveraged for code execution by rebooting the victims PC
Key phrases: execute arbitrary code, execute arbitrary code by setting the arguments to, code execution, reboot
CVE-2020-7821: Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the value of registry path. This can be leveraged for code execution by rebooting the victims PC
Key phrases: execute arbitrary code, execute arbitrary code by modifying the value of, code execution, reboot
CVE-2020-7822: DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: heap-based overflow, arbitrary code execution
CVE-2020-7823: DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: memory corruption, arbitrary code, arbitrary code execution
CVE-2020-7824: A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnerability by modification the cookie value to an affected device. A successful exploit could allow the attacker access to sensitive device information, which includes configuration files.
Key phrases: get administrator permission, sensitive device information
CVE-2020-7825: A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could execute arbitrary remote command by sending parameters to WinExec function in ExtCommandApi.dll module of MiPlatform.
Key phrases: WinExec function in ExtCommandApi.dll module of MiPlatform, execute arbitrary
CVE-2020-7826: EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to the vulnerable method. This can be leveraged for code execution. When the vulnerable method is called, they fail to properly check the parameters that are passed to it.
Key phrases: be download by setting the arguments to the, remote files, vulnerable method, code execution
CVE-2020-7827: DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: use-after-free, arbitrary code execution
CVE-2020-7828: DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: heap-based overflow, arbitrary code execution
CVE-2020-7829: DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: heap-based overflow, arbitrary code execution
CVE-2020-7830: RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vulnerabilities in downloading with Kupload agent allow files to be downloaded to arbitrary paths due to insufficient verification of extensions and download paths. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions and earlier.
Key phrases: be downloaded by lack of validation, be downloaded to arbitrary paths due to insufficient, remote files
CVE-2020-7831: A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu directory via directory traversal for automatic execution. The victim user need to reboot, however.
Key phrases: download any file, reboot, directory traversal
CVE-2020-7832: A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUploadFile, SetSelectItem, DoOpenFile function.(CVE-2020-7832)
Key phrases: download and execute an arbitrary file via AddUploadFile, improper input validation, execute arbitrary
CVE-2020-7836: VOICEYE WSActiveBridgeES versions prior to 2.1.0.3 contains a stack-based buffer overflow vulnerability caused by improper bound checking parameter given by attack. It finally leads to a stack-based buffer overflow via access to crafted web page.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2020-7837: An issue was discovered in ML Report Program. There is a stack-based buffer overflow in function sub_41EAF0 at MLReportDeamon.exe. The function will call vsprintf without checking the length of strings in parameters given by attacker. And it finally leads to a stack-based buffer overflow via access to crafted web page. This issue affects: Infraware ML Report 2.19.312.0000.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2020-7838: A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.
Key phrases: execute arbitrary code, arbitrary code execution
CVE-2020-7839: In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand parameter.
Key phrases: command injection, improper input validation
CVE-2020-7841: Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto://
Key phrases: improper input validation, arbitrary .hta file execution
CVE-2020-7842: Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users. This affects D'live set-top box AP(WF2429TB) v1.1.10.
Key phrases: cause arbitrary command injection, improper input validation, arbitrary commands
CVE-2020-7845: Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command. It leads remote attacker to execute arbitrary code via crafted packet.
Key phrases: execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2020-7846: Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download and execution via access to crafted web page.
Key phrases: file download, execution, hardcoded
CVE-2020-7847: The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.
Key phrases: gain remote code execution, arbitrary file upload
CVE-2020-7848: The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value.
Key phrases: executes arbitrary OS commands, command injection, execute arbitrary, arbitrary os command
CVE-2020-7849: A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient input(server domain) validation. An attacker could exploit this vulnerability through crafted URL.
Key phrases: execute arbitrary code, uprism.io curix
CVE-2020-7850: NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
Key phrases: be downloaded and executed by setting the arguments, damage
CVE-2020-7851: Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the internal method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
Key phrases: be downloaded and executed by setting the arguments, damage
CVE-2020-7852: DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed ex.j2c format file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
Key phrases: heap-based overflow, arbitrary code execution
CVE-2020-7853: An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read. An attacker can exploit arbitrary code execution.
Key phrases: exploit arbitrary code execution, be read, outbound read write
CVE-2020-7856: A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
Key phrases: execute arbitrary command, helpcom, arbitrary commands
CVE-2020-7857: A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior to 9.2.2.280.
Key phrases: execute arbitrary command, arbitrary commands
CVE-2020-7858: There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost and an attacker can traverse directories using "dot dot" sequences(../../) to view host file on the system. This vulnerability can cause information leakage.
Key phrases: directory traversing, information leakage
CVE-2020-7860: UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by UnEGG. Attackers could exploit this and arbitrary code execution. This issue affects: Estsoft UnEGG 0.5 versions prior to 1.0 on linux.
Key phrases: integer overflow, arbitrary code execution
CVE-2020-7861: AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a management PC to a client PC. This can be lead to arbitrary file execution.
Key phrases: copy file from a management PC to a, arbitrary file execution
CVE-2020-7862: A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability is due to insufficient input santization when communicating customer process.
Key phrases: execute arbitrary commands, execute arbitrary commands This vulnerability is due to