alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-1189 (published 2020-05-21)
An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1124, CVE-2020-1131, CVE-2020-1134, CVE-2020-1144, CVE-2020-1184, CVE-2020-1185, CVE-2020-1186, CVE-2020-1187, CVE-2020-1188, CVE-2020-1190, CVE-2020-1191.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-11890 (published 2020-04-21)
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: joomla
Affected products: joomla\!
CVE-2020-11891 (published 2020-04-21)
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: joomla
Affected products: joomla\!
CVE-2020-11894 (published 2020-04-19)
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: libming
Affected products: libming
CVE-2020-11895 (published 2020-04-19)
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: libming
Affected products: libming
CVE-2020-11896 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11897 (published 2020-06-17)
The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11898 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-119
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11899 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-125
Affected vendors: dell, treck
Affected products: tcp\/ip, wyse_5030, wyse_5030_firmware, wyse_5050_all-in-one, wyse_5050_all-in-one_firmware, wyse_7030, wyse_7030_firmware
Added to CISA KEV catalog: 2022-03-03
KEV required action: Apply updates per vendor instructions.
CVE-2020-1190 (published 2020-05-21)
An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1124, CVE-2020-1131, CVE-2020-1134, CVE-2020-1144, CVE-2020-1184, CVE-2020-1185, CVE-2020-1186, CVE-2020-1187, CVE-2020-1188, CVE-2020-1189, CVE-2020-1191.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-11900 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Weakness: CWE-415
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11901 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11902 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11903 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11904 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-190
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11905 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11906 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-191
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11907 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11908 (published 2020-06-17)
The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11909 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-191
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-1191 (published 2020-05-21)
An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1124, CVE-2020-1131, CVE-2020-1134, CVE-2020-1144, CVE-2020-1184, CVE-2020-1185, CVE-2020-1186, CVE-2020-1187, CVE-2020-1188, CVE-2020-1189, CVE-2020-1190.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-11910 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11911 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-732
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11912 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11913 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11914 (published 2020-06-17)
The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: treck
Affected products: tcp\/ip
CVE-2020-11915 (published 2021-02-08)
An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&reboot=1 request to the webserver, it is possible to enable the telnet interface on the device. The telnet interface can then be used to obtain access to the device with root privileges via a reecam4debug default password. This default telnet password is the same across all Siime Eye devices. In order for the attack to be exploited, an attacker must be physically close in order to connect to the device's Wi-Fi access point.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1188
Affected vendors: svakom
Affected products: siime_eye, siime_eye_firmware
CVE-2020-11916 (published 2024-11-07)
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashing technique. Because of this deprecated hashing, the success probability of an attacker in an offline cracking attack is greatly increased.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-327
Affected vendors: svakom
Affected products: svakom_siime_eye, svakom_siime_eye_firmware
CVE-2020-11917 (published 2024-11-07)
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. It uses a default SSID value, which makes it easier for remote attackers to discover the physical locations of many Siime Eye devices, violating the privacy of users who do not wish to disclose their ownership of this type of device. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-1188
Affected vendors: svakom
Affected products: svakom_siime_eye, svakom_siime_eye_firmware
CVE-2020-11918 (published 2024-11-07)
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including passwords, can be found in cleartext in the backup file. An attacker capable of accessing the web interface can create the backup file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-312
Affected vendors: svakom
Affected products: svakom_siime_eye, svakom_siime_eye_firmware
CVE-2020-11919 (published 2024-11-07)
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. There is no CSRF protection.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: svakom
Affected products: svakom_siime_eye, svakom_siime_eye_firmware
CVE-2020-1192 (published 2020-05-21)
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1171.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: python
CVE-2020-11920 (published 2021-02-08)
An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code with root privileges (all of the device's services are running as root).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: svakom
Affected products: siime_eye, siime_eye_firmware
CVE-2020-11921 (published 2024-11-07)
An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection between the Lush 2 and a mobile phone. This allows an attacker to gain full control over the device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
CVE-2020-11922 (published 2021-04-02)
An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: wizconnected
Affected products: a60_colors, a60_colors_firmware
CVE-2020-11923 (published 2021-04-02)
An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: wizconnected
Affected products: wiz
CVE-2020-11924 (published 2021-04-02)
An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-disclosure risk for a discarded or resold device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: wizconnected
Affected products: colors_a60, colors_a60_firmware
CVE-2020-11925 (published 2021-04-02)
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: luvion
Affected products: grand_elite_3_connect, grand_elite_3_connect_firmware
CVE-2020-11926 (published 2024-11-07)
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a username and password. These credentials can be obtained through an unauthenticated web request, e.g., for a JavaScript file. Also, the disclosed information includes the SSID and WPA2 key for the Wi-Fi network the device is connected to.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-79
CVE-2020-11928 (published 2020-04-20)
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: davidlingren
Affected products: media_library_assistant
CVE-2020-1193 (published 2020-09-11)
<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Excel handles objects in memory.</p>
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office
CVE-2020-11930 (published 2020-04-20)
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gtranslate
Affected products: translate_wordpress_with_gtranslate
CVE-2020-11931 (published 2020-05-15)
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: canonical, pulseaudio
Affected products: pulseaudio, ubuntu_linux
CVE-2020-11932 (published 2020-05-13)
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-532
Affected vendors: canonical
Affected products: subiquity
CVE-2020-11933 (published 2020-07-29)
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: canonical
Affected products: snapd, ubuntu_linux
CVE-2020-11934 (published 2020-07-29)
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N)
Weakness: CWE-668
Affected vendors: canonical
Affected products: ubuntu_linux
CVE-2020-11935 (published 2023-04-07)
It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-911
Affected vendors: canonical, debian
Affected products: debian_linux, ubuntu_linux
CVE-2020-11937 (published 2020-08-06)
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: canonical
Affected products: ubuntu_linux, whoopsie
CVE-2020-11938 (published 2020-04-22)
In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: jetbrains
Affected products: teamcity
CVE-2020-11939 (published 2020-04-23)
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: ntop
Affected products: ndpi
CVE-2020-1194 (published 2020-06-09)
A denial of service vulnerability exists when Windows Registry improperly handles filesystem operations, aka 'Windows Registry Denial of Service Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-11940 (published 2020-04-23)
In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: ntop
Affected products: ndpi
CVE-2020-11941 (published 2020-04-27)
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: opmantek
Affected products: open-audit
CVE-2020-11942 (published 2020-04-29)
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: opmantek
Affected products: open-audit
CVE-2020-11943 (published 2020-04-29)
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: opmantek
Affected products: open-audit
CVE-2020-11944 (published 2020-04-20)
Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled during a PageNotFound exception.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bitcoin-abe_project
Affected products: bitcoin-abe
CVE-2020-11945 (published 2020-04-23)
An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: canonical, debian, fedoraproject, opensuse, squid-cache
Affected products: debian_linux, fedora, leap, squid, ubuntu_linux
CVE-2020-11946 (published 2020-04-20)
Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: zohocorp
Affected products: manageengine_opmanager
CVE-2020-11947 (published 2020-12-31)
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: qemu
Affected products: qemu
CVE-2020-11949 (published 2020-05-28)
testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: vivotek
Affected products: cc8160, cc8160\(hs\), cc8160\(hs\)_firmware, cc8160_firmware, cc8370-hv, cc8370-hv_firmware, cc8371-hv, cc8371-hv_firmware, cc9381-hv, cc9381-hv_firmware, cd8371-hntv, cd8371-hntv_firmware, cd8371-hnvf2, cd8371-hnvf2_firmware, fd8166a, fd8166a-n, fd8166a-n_firmware, fd8166a_firmware, fd8167a, fd8167a_firmware, fd8169a, fd8169a_firmware, fd816b-hf2, fd816b-hf2_firmware, fd816b-ht
CVE-2020-1195 (published 2020-05-21)
An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input, aka 'Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: edge
CVE-2020-11950 (published 2020-05-28)
VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: vivotek
Affected products: cc8160, cc8160\(hs\), cc8160\(hs\)_firmware, cc8160_firmware, cc8370-hv, cc8370-hv_firmware, cc8371-hv, cc8371-hv_firmware, cc9381-hv, cc9381-hv_firmware, cd8371-hntv, cd8371-hntv_firmware, cd8371-hnvf2, cd8371-hnvf2_firmware, fd8166a, fd8166a-n, fd8166a-n_firmware, fd8166a_firmware, fd8167a, fd8167a-s, fd8167a-s_firmware, fd8167a_firmware, fd8169a, fd8169a-s, fd8169a-s_firmware
CVE-2020-11951 (published 2020-07-14)
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: rittal
Affected products: cmc_iii_pu_7030.000, cmc_iii_pu_7030.000_firmware, cmciii-pu-9333e0fb, cmciii-pu-9333e0fb_firmware, iot_interface_3124.300, lcp-cw, lcp-cw_firmware, pdu-3c002dec, pdu-3c002dec_firmware
CVE-2020-11952 (published 2020-07-14)
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI menu.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: rittal
Affected products: cmc_iii_pu_7030.000, cmc_iii_pu_7030.000_firmware, cmciii-pu-9333e0fb, cmciii-pu-9333e0fb_firmware, iot_interface_3124.300, lcp-cw, lcp-cw_firmware, pdu-3c002dec, pdu-3c002dec_firmware
CVE-2020-11953 (published 2020-07-14)
An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: rittal
Affected products: cmc_iii_pu_7030.000, cmc_iii_pu_7030.000_firmware, cmciii-pu-9333e0fb, cmciii-pu-9333e0fb_firmware, iot_interface_3124.300, lcp-cw, lcp-cw_firmware, pdu-3c002dec, pdu-3c002dec_firmware
CVE-2020-11955 (published 2020-07-14)
An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: rittal
Affected products: cmc_iii_pu_7030.000, cmc_iii_pu_7030.000_firmware, cmciii-pu-9333e0fb, cmciii-pu-9333e0fb_firmware, iot_interface_3124.300, lcp-cw, lcp-cw_firmware, pdu-3c002dec, pdu-3c002dec_firmware
CVE-2020-11956 (published 2020-07-14)
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: rittal
Affected products: cmc_iii_pu_7030.000, cmc_iii_pu_7030.000_firmware, cmciii-pu-9333e0fb, cmciii-pu-9333e0fb_firmware, iot_interface_3124.300, lcp-cw, lcp-cw_firmware, pdu-3c002dec, pdu-3c002dec_firmware
CVE-2020-11957 (published 2020-06-09)
The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with both LE Secure Connections as well as LE Legacy Pairing. A predictable or brute-forceable random number allows an attacker (in radio range) to perform a MITM attack during BLE pairing.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-331
Affected vendors: cypress
Affected products: psoc_4.2_ble
CVE-2020-11958 (published 2020-04-21)
re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: canonical, re2c
Affected products: re2c, ubuntu_linux
CVE-2020-11959 (published 2020-06-24)
An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: mi
Affected products: xiaomi_r3600, xiaomi_r3600_firmware
CVE-2020-1196 (published 2020-06-09)
An elevation of privilege vulnerability exists in the way that the printconfig.dll handles objects in memory, aka 'Windows Print Configuration Elevation of Privilege Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-11960 (published 2020-06-24)
Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in c_upload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: mi
Affected products: xiaomi_r3600, xiaomi_r3600_firmware
CVE-2020-11961 (published 2020-06-24)
Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: mi
Affected products: xiaomi_r3600, xiaomi_r3600_firmware
CVE-2020-11963 (published 2020-04-21)
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: evenroute
Affected products: iqrouter, iqrouter_firmware
CVE-2020-11964 (published 2020-04-21)
In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-287
Affected vendors: evenroute
Affected products: iqrouter, iqrouter_firmware
CVE-2020-11965 (published 2020-04-21)
In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: evenroute
Affected products: iqrouter, iqrouter_firmware
CVE-2020-11966 (published 2020-04-21)
In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-521
Affected vendors: evenroute
Affected products: iqrouter, iqrouter_firmware
CVE-2020-11967 (published 2020-04-21)
In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: evenroute
Affected products: iqrouter, iqrouter_firmware
CVE-2020-11968 (published 2020-04-21)
In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-532
Affected vendors: evenroute
Affected products: iqrouter, iqrouter_firmware
CVE-2020-11969 (published 2020-06-15)
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: apache
Affected products: tomee
CVE-2020-1197 (published 2020-06-09)
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-11971 (published 2020-05-14)
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: apache, oracle
Affected products: camel, communications_diameter_intelligence_hub, communications_diameter_signaling_router, enterprise_manager_base_platform, flexcube_private_banking
CVE-2020-11972 (published 2020-05-14)
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: apache, oracle
Affected products: camel, communications_diameter_signaling_router, enterprise_manager_base_platform, flexcube_private_banking
CVE-2020-11973 (published 2020-05-14)
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: apache, oracle
Affected products: camel, communications_diameter_signaling_router, enterprise_manager_base_platform, flexcube_private_banking
CVE-2020-11974 (published 2020-12-18)
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apache
Affected products: dolphinscheduler
CVE-2020-11975 (published 2020-06-05)
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apache
Affected products: unomi
CVE-2020-11976 (published 2020-08-11)
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: apache
Affected products: fortress, wicket
CVE-2020-11977 (published 2020-09-15)
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apache
Affected products: syncope
CVE-2020-11978 (published 2020-07-17)
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: apache
Affected products: airflow
Added to CISA KEV catalog: 2022-01-18
KEV required action: Apply updates per vendor instructions.
CVE-2020-11979 (published 2020-10-01)
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-379
Affected vendors: apache, fedoraproject, gradle, oracle
Affected products: agile_engineering_data_management, ant, api_gateway, banking_platform, banking_treasury_management, communications_unified_inventory_management, data_integrator, endeca_information_discovery_studio, enterprise_repository, fedora, financial_services_analytical_applications_infrastructure, flexcube_private_banking, gradle, primavera_gateway, primavera_unifier, real-time_decision_server, retail_advanced_inventory_planning, retail_assortment_planning, retail_category_management_planning_\&_optimization, retail_eftlink, retail_financial_integration, retail_integration_bus, retail_item_planning, retail_macro_space_optimization, retail_merchandise_financial_planning
CVE-2020-1198 (published 2020-09-11)
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p>
<p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p>
<p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
Weakness: CWE-79
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2020-11980 (published 2020-06-12)
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role can call get*. It's possible to authenticate as a viewer role + invokes on the MLet getMBeansFromURL method, which goes off to a remote server to fetch the desired MBean, which is then registered in Karaf. At this point the attack fails as "viewer" doesn't have the permission to invoke on the MBean. Still, it could act as a SSRF style attack and also it essentially allows a "viewer" role to pollute the MBean registry, which is a kind of privilege escalation. The vulnerability is low as it's possible to add a ACL to limit access. Users should update to Apache Karaf 4.2.9 or newer.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-918
Affected vendors: apache
Affected products: karaf
CVE-2020-11981 (published 2020-07-17)
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: apache
Affected products: airflow
CVE-2020-11982 (published 2020-07-17)
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: apache
Affected products: airflow
CVE-2020-11983 (published 2020-07-17)
An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: apache
Affected products: airflow
CVE-2020-11984 (published 2020-08-07)
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: apache, canonical, debian, fedoraproject, netapp, opensuse, oracle
Affected products: clustered_data_ontap, communications_element_manager, communications_session_report_manager, communications_session_route_manager, debian_linux, enterprise_manager_ops_center, fedora, http_server, hyperion_infrastructure_technology, instantis_enterprisetrack, leap, ubuntu_linux, zfs_storage_appliance_kit
CVE-2020-11985 (published 2020-08-07)
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-345
Affected vendors: apache
Affected products: http_server
CVE-2020-11986 (published 2020-09-09)
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apache
Affected products: netbeans