yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-23181: A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, reflected cross site scripting (xss)
CVE-2020-23182: The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel.
Key phrases: redirect victim users to malicious websites via a
CVE-2020-23184: A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration" field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23185: A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-2319: Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2020-23190: A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23192: A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23194: A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-2320: Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
CVE-2020-23205: A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via crafted, stored cross site scripting (xss)
CVE-2020-23207: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values" field under the "Configure Attributes" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23208: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23209: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-2321: A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project.
Key phrases: shelve, cross-site request forgery (csrf), cross site request forgery
CVE-2020-23214: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23217: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross site scripting (xss)
CVE-2020-23219: Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload entered
CVE-2020-2322: Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks.
Key phrases: generate load and to generate memory leaks
CVE-2020-23226: Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.
Key phrases: cross site scripting (xss)
CVE-2020-2323: Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.
Key phrases: access the Chaos Monkey page and to see
CVE-2020-23234: Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
Key phrases: cross site scripting (xss), feature bypass,
CVE-2020-23238: Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.
Key phrases: cross site scripting (xss)
CVE-2020-23239: Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
Key phrases: cross site scripting (xss)
CVE-2020-2324: Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Key phrases: xml external entity (xxe)
CVE-2020-23240: Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
Key phrases: cross site scripting (xss)
CVE-2020-23241: Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
Key phrases: cross site scripting (xss)
CVE-2020-23242: Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.
Key phrases: cross site scripting (xss)
CVE-2020-23243: Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.
Key phrases: cross site scripting (xss)
CVE-2020-23249: GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.
Key phrases: plaintext
CVE-2020-23250: GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.
Key phrases: weak algorithm
CVE-2020-23256: An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.
Key phrases: execute arbitrary code, execute arbitrary code via unverified request to electerms
CVE-2020-23257: Buffer Overflow vulnerability found in Espruino 2v05.41 allows an attacker to cause a denial of service via the function jsvGarbageCollectMarkUsed in file src/jsvar.c.
Key phrases: cause a denial of service via the function, buffer overflow
CVE-2020-23258: An issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi_ValueIsNumber function in ./src/jsiValue.c file.
Key phrases: cause a denial of service via the Jsi_ValueIsNumber
CVE-2020-23259: An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the Jsi_Strlen function in the src/jsiChar.c file.
Key phrases: cause a denial of service via the Jsi_Strlen
CVE-2020-23260: An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsiChar.c file.
Key phrases: cause a denial of service via the StringReplaceCmd
CVE-2020-23262: An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.
Key phrases: sql injection
CVE-2020-23263: Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
Key phrases: inject arbitrary Javascript code, inject arbitrary Javascript code via the "navigation_title, cross-site scripting
CVE-2020-23264: Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
Key phrases: hijack the authentication of logged administrators, cross-site request forgery (csrf), cross site request forgery
CVE-2020-23266: An issue was discovered in gpac 0.8.0. The OD_ReadUTF8String function in odf_code.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted media file.
Key phrases: denial of service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23267: An issue was discovered in gpac 0.8.0. The gf_hinter_track_process function in isom_hinter_track_process.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted media file
Key phrases: denial of service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23269: An issue was discovered in gpac 0.8.0. The stbl_GetSampleSize function in isomedia/stbl_read.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted media file.
Key phrases: denial of service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23273: Heap-buffer overflow in the randomize_iparp function in edit_packet.c. of Tcpreplay v4.3.2 allows attackers to cause a denial of service (DOS) via a crafted pcap.
Key phrases: denial of service (DOS), cause a denial of service (DOS), heap-buffer overflow, denial of service (dos), heap buffer overflow
CVE-2020-23282: SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password to connect to the application and get access to unauthorized information.
Key phrases: use a non existing user with a generic, sql injection, unauthorized information
CVE-2020-23283: Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force.
Key phrases: know valid users from the application's database, information disclosure
CVE-2020-23284: Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that connect into the database which reveals internal and sensitive information without logging into the web application.
Key phrases: copy and paste aspx pages in the end, information disclosure, sensitive information
CVE-2020-23302: There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0
Key phrases: heap-use-after-free, use after free
CVE-2020-23303: There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2020-23306: There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0.
Key phrases: stack-overflow, stack overflow
CVE-2020-23308: There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0.
CVE-2020-23309: There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0.
CVE-2020-23310: There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0.
CVE-2020-23311: There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0.
CVE-2020-23312: There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2.2.0.
CVE-2020-23313: There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0
CVE-2020-23314: There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0.
CVE-2020-23315: There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta.
CVE-2020-23319: There is an Assertion in '(flags >> CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags >> CBC_STACK_ADJUST_SHIFT)) <= context_p->stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0.
Key phrases: assertion
CVE-2020-23320: There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0.
CVE-2020-23321: There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2020-23322: There is an Assertion in 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0.
Key phrases: assertion
CVE-2020-23323: There is a heap-buffer-overflow at re-parser.c in re_parse_char_escape in JerryScript 2.2.0.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2020-23327: Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload in, cross site scripting
CVE-2020-23330: An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom.cpp. It allows an attacker to cause a denial of service (DOS).
Key phrases: denial of service (DOS), cause a denial of service (DOS), null pointer dereference, denial of service (dos)
CVE-2020-23331: An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_DescriptorListWriter::Action component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).
Key phrases: denial of service (DOS), cause a denial of service (DOS), null pointer dereference, denial of service (dos)
CVE-2020-23332: A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9. This issue can lead to a denial of service (DOS).
Key phrases: denial of service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23333: A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS).
Key phrases: denial of service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23334: A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault.
Key phrases: write memory access, segmentation fault
CVE-2020-23341: A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, reflected cross site scripting (xss)
CVE-2020-23342: A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
Key phrases: csrf
CVE-2020-23349: An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be started by the com.sina.weibo.sdk.share.WbShareTransActivity.
Key phrases: intent redirection issue, unexported activities
CVE-2020-23352: Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values.
Key phrases: bypass authentication, incorrect access control, php loose comparison, magic hash, magic hash values
CVE-2020-23355: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully authenticate.
Key phrases: authentication bypass, magic hash authentication bypass
CVE-2020-23356: dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Key phrases: bypass because == is used instead of ===, login bypass, type juggling for login bypass because ==
CVE-2020-23359: WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check.
Key phrases: bypass the check, non-identical passwords
CVE-2020-23360: oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php
Key phrases: bypass the checks, non-identical password
CVE-2020-23361: phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Key phrases: bypass because == is used instead of ===, login bypass, type juggling for login bypass because ==
CVE-2020-23362: Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter.
Key phrases: escalate privileges via the cover_id parameter, insecure permissons
CVE-2020-23363: Cross Site Request Forgery (CSRF) vulnerability found in Verytops Verydows all versions that allows an attacker to execute arbitrary code via a crafted script.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted script, cross site request forgery (csrf)
CVE-2020-23369: In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
Key phrases: xss
CVE-2020-23370: In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML.
Key phrases: upload a swf file, xss, arbitrary web script
CVE-2020-23371: Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2020-23373: Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2020-23374: Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2020-23376: NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack.
Key phrases: csrf, stored xss, arbitrary web script
CVE-2020-23426: zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.
Key phrases: modify data for further attacks such as CSRF, zzcms, access control, escalation of privileges, escalation privilege
CVE-2020-23446: Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API
Key phrases: unauthenticated information disclosure
CVE-2020-23447: newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle. Users only need to write xss payload in their address information when buying goods, which is triggered when viewing the "View Recipient Information" of this order in "Order Management Office".
Key phrases: cross-site scripting
CVE-2020-23448: newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system's background /admin is in code AdminLoginInterceptor, which can be bypassed.
Key phrases: gain privileges, incorrect access control
CVE-2020-23449: newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID.
Key phrases: gain privileges, incorrect access control, unauthorized changes
CVE-2020-23450: Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization.
Key phrases: xss, stored xss
CVE-2020-23451: Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.
Key phrases: csrf, privilege escalation
CVE-2020-23452: A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2020-23466: Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field.
Key phrases: run arbitrary code, run arbitrary code via the wzipcode field, cross site scripting (xss)
CVE-2020-23469: gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin.
Key phrases: denial of service (ReDoS), regular expression denial of service (redos)
CVE-2020-23478: Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
Key phrases: denial of service (ReDoS), regular expression denial of service (redos)
CVE-2020-23481: CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2020-23489: The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
Key phrases: certain privilege checks not being in place, file deletion, escalate privilege
CVE-2020-23490: There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.
Key phrases: local file disclosure, arbitrary file, sensitive information
CVE-2020-23512: VR CAM P1 Model P1 v1 has an incorrect access control vulnerability where an attacker can obtain complete access of the device from web (remote) without authentication.
Key phrases: obtain complete access, incorrect access control
CVE-2020-23517: Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm.
Key phrases: inject arbitrary web script or HTML, cross site scripting (xss)
CVE-2020-23518: Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML.
Key phrases: inject arbitrary web script or HTML, cross site scripting (xss)
CVE-2020-23520: imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality.
Key phrases: an authenticated file upload and consequently remote code, remote code execution
CVE-2020-23522: Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.
Key phrases: cross-site request forgery, cross site request forgery
CVE-2020-23533: Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
Key phrases: shop for free in merchants' websites and, cwe-347
CVE-2020-23534: A server-side request forgery (SSRF) vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter.
Key phrases: server-side request forgery (ssrf), server side request forgery
CVE-2020-23539: An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_REQ message.
Key phrases: cause a Denial of Service via the interval, denial of service
CVE-2020-23545: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM_W+0x0000000000000531.
Key phrases: a user-mode write access violation starting
CVE-2020-23546: IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM file, related to a "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at FORMATS!ReadMosaic+0x0000000000000981.
Key phrases: cause a denial of service or possibly other, unspecified impacts, data from faulting address
CVE-2020-23549: IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted .cr2 file, related to a "Data from Faulting Address controls Branch Selection starting at FORMATS!GetPlugInInfo+0x00000000000047f6".
Key phrases: cause a denial of service or possibly other, unspecified impacts, data from faulting address
CVE-2020-23550: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e82.
Key phrases: a user-mode write access violation starting
CVE-2020-23551: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e30.
Key phrases: a user-mode write access violation starting
CVE-2020-23552: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e62.
Key phrases: a user-mode write access violation starting
CVE-2020-23553: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007d33.
Key phrases: a user-mode write access violation starting
CVE-2020-23554: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e20.
Key phrases: a user-mode write access violation starting
CVE-2020-23555: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e6e.
Key phrases: a user-mode write access violation starting
CVE-2020-23556: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000007e28.
Key phrases: a user-mode write access violation starting
CVE-2020-23557: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000755d.
Key phrases: a user-mode write access violation starting
CVE-2020-23558: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000007f4b.
Key phrases: a user-mode write access violation starting
CVE-2020-23559: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000007d7f.
Key phrases: a user-mode write access violation starting
CVE-2020-23560: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000001bcab.
Key phrases: a user-mode write access violation starting
CVE-2020-23561: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000005722.
Key phrases: a user-mode write access violation starting
CVE-2020-23562: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000aefe.
Key phrases: a user-mode write access violation starting
CVE-2020-23563: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000002cba.
Key phrases: a user-mode write access violation starting
CVE-2020-23564: File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.
Key phrases: run arbitrary code, run arbitrary code via SEMCMS_Upfile.php, file upload
CVE-2020-23565: Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a "Data from Faulting Address controls Branch Selection starting at JPEG2000!ShowPlugInSaveOptions_W+0x0000000000032850".
Key phrases: execute arbitrary code, execute arbitrary code via a crafted JPEG 2000, data from faulting address
CVE-2020-23566: Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.
Key phrases: infinity loop
CVE-2020-23567: Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to "Integer Divide By Zero starting at JPEG2000!ShowPlugInSaveOptions_W+0x00000000000082ea"
Key phrases: denial of service (DoS), to cause a denial of service (DoS, denial of service (dos), integer divide by zero
CVE-2020-23572: BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image file, arbitrary file upload
CVE-2020-23574: When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uploadfile_name1.htm form to a length of 368 or more bytes. This will create a buffer overflow condition, causing the application to crash.
Key phrases: buffer overflow condition, crash, application crash
CVE-2020-23575: A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.
Key phrases: view arbitrary files, retrieve or view arbitrary files from the affected, directory traversal
CVE-2020-23576: Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
Key phrases: stored cross site scripting (xss)
CVE-2020-23580: Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.
Key phrases: remote code execution
CVE-2020-23582: A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID.
Key phrases: conduct a cross-site request forgery (, admin wlmultipleap.asp, cross-site request forgery (csrf), cross site request forgery
CVE-2020-23583: OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.
Key phrases: remote code execution, command execution, compromise, arbitrary code
CVE-2020-23584: Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.
Key phrases: passes arbitrary commands, unauthenticated remote code execution, command execution, execute commands
CVE-2020-23585: A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network".
Key phrases: gain full privileges, "gain full privileges" and to ", cross-site request forgery (csrf), fully compromise of router & network, cross site request forgery, gain privileges
CVE-2020-23586: A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule.
Key phrases: conduct a cross-site request forgery (, cross site request forgery
CVE-2020-23587: A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ".
Key phrases: conduct a cross-site request forgery (, cross-site request forgery (csrf), men in the middle, cross site request forgery, man in the middle
CVE-2020-23588: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp ".
Key phrases: conduct a cross-site request forgery (, cross-site request forgery (csrf), cross site request forgery
CVE-2020-23589: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to cause a Denial of Service by Rebooting the router through " /mgm_dev_reboot.asp."
Key phrases: conduct a cross-site request forgery (, cross-site request forgery (csrf), denial of service, cross site request forgery, reboot
CVE-2020-23590: A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack to change the Password for "WLAN SSID" through "wlwpa.asp".
Key phrases: conduct a cross-site request forgery (, cross site request forgery
CVE-2020-23591: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor.
Key phrases: upload arbitrary files, Denial of Service (using 'rm -rf *.*' in the code), upload arbitrary files through " /mgm_dev_upgrade.asp " which, denial of service, reverse connection, backdoor
CVE-2020-23592: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.
Key phrases: conduct a cross-site request forgery (, cross-site request forgery (csrf), escalation of privileges, cross site request forgery, default credentials,
CVE-2020-23593: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through ' /mgm_log_cfg.asp.' The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.
Key phrases: conduct a cross site request forgery (CSRF, cross site request forgery (csrf)
CVE-2020-23595: Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
Key phrases: gain sensitive information, escalate privileges and gain sensitive information sitemodel/, cross site request forgery (csrf)
CVE-2020-23617: A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary web scripts or HTML via SCRIPT element.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via SCRIPT, cross site scripting (xss)
CVE-2020-23618: A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page.
Key phrases: execute arbitrary web scripts or HTML, reflected cross site scripting (xss)
CVE-2020-23620: The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted serialized Java, insecure deserialization
CVE-2020-23621: The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted serialized Java, insecure deserialization
CVE-2020-23622: An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header
Key phrases: cause a denial of service via an unchecked, unchecked callback parameter
CVE-2020-23630: A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
Key phrases: sql injection, cookie injection
CVE-2020-23631: Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via the tongji parameter.
Key phrases: conduct cross-site scripting (XSS), cross-site request forgery (csrf), cross-site scripting (xss), cross site request forgery
CVE-2020-23639: A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commands in Moxa's VPort 461 Series Industrial Video Servers.
Key phrases: execute arbitrary commands, execute arbitrary commands in Moxa's VPort 461, command injection
CVE-2020-23643: XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
Key phrases: xss
CVE-2020-23644: XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
Key phrases: xss
CVE-2020-23647: Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form.
Key phrases: run arbitrary code, run arbitrary code via the message field on, cross site scripting (xss)
CVE-2020-23648: Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator password without any authentication.
Key phrases: access control, incorrect access control
CVE-2020-23653: An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.
Key phrases: insecure unserialize, remote code execution
CVE-2020-23654: NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."
Key phrases: cross site scripting (xss)
CVE-2020-23655: NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
Key phrases: cross site scripting (xss)
CVE-2020-23656: NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
Key phrases: cross site scripting (xss)
CVE-2020-23657: NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
Key phrases: cross site scripting (xss)
CVE-2020-23658: PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.
Key phrases: cross site scripting (xss)
CVE-2020-23659: WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.
Key phrases: cross site scripting (xss)
CVE-2020-23660: webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."
Key phrases: cross site scripting (xss)
CVE-2020-23679: Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field.
Key phrases: execute arbitrary code, buffer overflow
CVE-2020-23680: An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibly other undisclosed impacts.
Key phrases: cause denial of service or possibly other undisclosed, undisclosed impacts
CVE-2020-23685: SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to login.php.
Key phrases: execute arbitrary code, gain escalated privileges, execute arbitrary code and gain escalated privileges, sql injection, escalate privilege
CVE-2020-23686: Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts.
Key phrases: change an administrators password or other unspecified impacts, cross site request forgery (csrf)
CVE-2020-23689: In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.
Key phrases: xss
CVE-2020-23691: YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.
Key phrases: remote command execution (rce)
CVE-2020-23697: Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
Key phrases: cross site scripting
CVE-2020-23700: Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
Key phrases: cross site scripting (xss)
CVE-2020-23702: Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.
Key phrases: cross site scripting (xss)
CVE-2020-23705: A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
Key phrases: Denial of Service (DOS), cause a Denial of Service (DOS), global buffer overflow, denial of service (dos)
CVE-2020-23706: A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
Key phrases: Denial of Service (DOS), cause a Denial of Service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23707: A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
Key phrases: Denial of Service (DOS), cause a Denial of Service (DOS), heap-based buffer overflow, denial of service (dos), heap based buffer overflow
CVE-2020-23710: Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.
Key phrases: cross site scripting (xss)
CVE-2020-23711: SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php.
Key phrases: sql injection
CVE-2020-23715: Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download.
Key phrases: directory traversal
CVE-2020-23718: Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.
Key phrases: execute arbitrary code, execute arbitrary code via the route parameter to, cross site scripting (xss)
CVE-2020-23719: Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the bbsmeta parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the bbsmeta parameter, cross site scripting (xss)