alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-12459 (published 2020-04-29)
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-732
Affected vendors: fedoraproject, grafana
Affected products: fedora, grafana
CVE-2020-1246 (published 2020-06-09)
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12460 (published 2020-07-27)
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, trusteddomain
Affected products: debian_linux, fedora, opendmarc
CVE-2020-12461 (published 2020-04-29)
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the SQL query.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: php-fusion
Affected products: php-fusion
CVE-2020-12462 (published 2020-04-29)
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-352
Affected vendors: ninjaforms
Affected products: ninja_forms
CVE-2020-12463 (published 2020-05-05)
An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: avira
Affected products: software_updater
CVE-2020-12464 (published 2020-04-29)
usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: linux, netapp
Affected products: active_iq_unified_manager, aff_a700s, cloud_backup, hci_baseboard_management_controller, hci_compute_node, hci_storage_nodes, linux_kernel, solidfire_\&_hci_storage_node, solidfire_baseboard_management_controller, steelstore_cloud_integrated_storage
CVE-2020-12465 (published 2020-04-29)
An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: linux, netapp
Affected products: active_iq_unified_manager, aff_baseboard_management_controller, cloud_backup, hci_baseboard_management_controller, hci_compute_node, linux_kernel, solidfire_\&_hci_management_node, solidfire_baseboard_management_controller, steelstore_cloud_integrated_storage
CVE-2020-12467 (published 2020-04-29)
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-384
Affected vendors: intelliants
Affected products: subrion
CVE-2020-12468 (published 2020-04-29)
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: intelliants
Affected products: subrion
CVE-2020-12469 (published 2020-04-29)
admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-502
Affected vendors: intelliants
Affected products: subrion
CVE-2020-1247 (published 2020-06-09)
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1207, CVE-2020-1251, CVE-2020-1253, CVE-2020-1310.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12470 (published 2020-04-29)
MonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX template.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-552
Affected vendors: mono
Affected products: monox
CVE-2020-12471 (published 2020-04-29)
MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx because of deserialization in ModuleGallery.HTML5Upload, ModuleGallery.SilverLightUploadModule, HTML5Upload, and SilverLightUploadHandler.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: mono
Affected products: monox
CVE-2020-12472 (published 2020-04-29)
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mono
Affected products: monox
CVE-2020-12473 (published 2020-04-29)
MonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting from ffmpeg.exe to a different program.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: mono
Affected products: monox
CVE-2020-12474 (published 2020-05-01)
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: telegram
Affected products: telegram, telegram_desktop
CVE-2020-12475 (published 2020-05-04)
TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.portal.PortalController.getAdvertiseFile in /opt/tplink/EAPController/lib/eap-web-3.2.6.jar.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: tp-link
Affected products: omada_controller
CVE-2020-12477 (published 2020-04-29)
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-863
Affected vendors: teampass
Affected products: teampass
CVE-2020-12478 (published 2020-04-29)
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: teampass
Affected products: teampass
CVE-2020-12479 (published 2020-04-29)
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: teampass
Affected products: teampass
CVE-2020-1248 (published 2020-06-09)
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016
CVE-2020-12480 (published 2020-08-17)
In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: lightbend
Affected products: play_framework
CVE-2020-12483 (published 2021-03-23)
The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed parameters.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: vivo
Affected products: appstore
CVE-2020-12484 (published 2024-12-17)
When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead to man-in-the-middle attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-306
CVE-2020-12485 (published 2020-11-10)
The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the boundary when memory access.The vulnerability eventually leads to a local DOS on the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: vivo
Affected products: frame_touch_module
CVE-2020-12487 (published 2024-12-17)
Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands with root privilege.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
Weakness: CWE-20
CVE-2020-12488 (published 2021-11-10)
The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: vivo
Affected products: jovi_smart_scene
CVE-2020-1249 (published 2020-07-14)
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1353, CVE-2020-1370, CVE-2020-1399, CVE-2020-1404, CVE-2020-1413, CVE-2020-1414, CVE-2020-1415, CVE-2020-1422.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12491 (published 2024-11-25)
Improper control of framework service permissions with possibility of some sensitive device information leakage.
Severity: MEDIUM (CVSS 4.0 vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Weakness: CWE-306
CVE-2020-12492 (published 2024-11-25)
Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.
Severity: LOW (CVSS 4.0 vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Weakness: CWE-306
CVE-2020-12493 (published 2020-05-29)
An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: swarco
Affected products: cpu_ls4000_firmware
CVE-2020-12494 (published 2020-06-16)
Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-459
Affected vendors: beckhoff, intel
Affected products: 82540em, 82540ep, 82541ei, 82541er, 82541gi, 82541pi, 82544ei, 82544gc, 82545em, 82545gm, 82546eb, 82546gb, 82547ei, 82547ei_, 82547gi, 82557, 82558, 82559, twincat, twincat_driver
CVE-2020-12495 (published 2020-11-19)
Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The vulnerability is that user sessions are not closed correctly and a user with fewer rights is assigned the higher rights when he logs on.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: endress
Affected products: orsg35, orsg35_firmware, orsg45, orsg45_firmware, rsg35, rsg35_firmware, rsg45, rsg45_firmware
CVE-2020-12496 (published 2020-11-19)
Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side. It was found that a user with low rights can get information from endpoints that should not be available to this user.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: endress
Affected products: orsg35, orsg35_firmware, orsg45, orsg45_firmware, rsg35, rsg35_firmware, rsg45, rsg45_firmware
CVE-2020-12497 (published 2020-07-01)
PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: phoenixcontact
Affected products: pc_worx, pc_worx_express
CVE-2020-12498 (published 2020-07-01)
mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: phoenixcontact
Affected products: pc_worx, pc_worx_express
CVE-2020-12499 (published 2020-07-21)
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: phoenixcontact
Affected products: plcnext_engineer
CVE-2020-1250 (published 2020-09-11)
<p>An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p>
<p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting how win32k handles objects in memory.</p>
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12500 (published 2020-10-15)
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: pepperl-fuchs
Affected products: es7506, es7506_firmware, es7510, es7510-xt, es7510-xt_firmware, es7510_firmware, es7528, es7528_firmware, es8508, es8508_firmware, es8508f, es8508f_firmware, es8509-xt, es8509-xt_firmware, es8510, es8510-xt, es8510-xt_firmware, es8510-xte, es8510-xte_firmware, es8510_firmware, es9528, es9528-xt, es9528-xt_firmware, es9528-xtv2, es9528-xtv2_firmware
CVE-2020-12501 (published 2020-10-15)
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: korenix, pepperl-fuchs
Affected products: es7506, es7506_firmware, es7510, es7510-xt, es7510-xt_firmware, es7510_firmware, es7528, es7528_firmware, es8508, es8508_firmware, es8508f, es8508f_firmware, es8509-xt, es8509-xt_firmware, es8510, es8510-xt, es8510-xt_firmware, es8510-xte, es8510-xte_firmware, es8510_firmware, es9528, es9528-xt, es9528-xt_firmware, es9528-xtv2, es9528-xtv2_firmware
CVE-2020-12502 (published 2020-10-15)
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: korenix, pepperl-fuchs
Affected products: es7506, es7506_firmware, es7510, es7510-xt, es7510-xt_firmware, es7510_firmware, es7528, es7528_firmware, es8508, es8508_firmware, es8508f, es8508f_firmware, es8509-xt, es8509-xt_firmware, es8510, es8510-xt, es8510-xt_firmware, es8510-xte, es8510-xte_firmware, es8510_firmware, es9528, es9528-xt, es9528-xt_firmware, es9528-xtv2, es9528-xtv2_firmware
CVE-2020-12503 (published 2020-10-15)
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: korenix, pepperl-fuchs
Affected products: es7506, es7506_firmware, es7510, es7510-xt, es7510-xt_firmware, es7510_firmware, es7528, es7528_firmware, es8508, es8508_firmware, es8508f, es8508f_firmware, es8509-xt, es8509-xt_firmware, es8510, es8510-xt, es8510-xt_firmware, es8510-xte, es8510-xte_firmware, es8510_firmware, es9528, es9528-xt, es9528-xt_firmware, es9528-xtv2, es9528-xtv2_firmware
CVE-2020-12504 (published 2020-10-15)
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-912
Affected vendors: korenix, pepperl-fuchs, westermo
Affected products: es7506, es7506_firmware, es7510, es7510-xt, es7510-xt_firmware, es7510_firmware, es7528, es7528_firmware, es8508, es8508_firmware, es8508f, es8508f_firmware, es8509-xt, es8509-xt_firmware, es8510, es8510-xt, es8510-xt_firmware, es8510-xte, es8510-xte_firmware, es8510_firmware, es9528, es9528-xt, es9528-xt_firmware, es9528-xtv2, es9528-xtv2_firmware
CVE-2020-12505 (published 2020-09-30)
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852, WAGO 750-880/xxx-xxx, WAGO 750-881, WAGO 750-831/xxx-xxx, WAGO 750-882, WAGO 750-885/xxx-xxx, WAGO 750-889 in versions FW07 and below.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Weakness: CWE-306
Affected vendors: wago
Affected products: 750-831, 750-831_firmware, 750-852, 750-852_firmware, 750-880, 750-880_firmware, 750-881, 750-881_firmware, 750-882, 750-882_firmware, 750-885, 750-885_firmware, 750-889, 750-889_firmware
CVE-2020-12506 (published 2020-09-30)
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-306
Affected vendors: wago
Affected products: 750-362, 750-362_firmware, 750-363, 750-363_firmware, 750-823, 750-823_firmware, 750-832, 750-832_firmware, 750-862, 750-862_firmware, 750-890, 750-890_firmware, 750-891, 750-891_firmware
CVE-2020-12507 (published 2022-11-15)
In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL injection. This may result in loss of confidentiality, loss of integrity and DoS.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: badgermeter
Affected products: moni\
CVE-2020-12508 (published 2022-11-15)
In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the image-relocator module.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: badgermeter
Affected products: moni\
CVE-2020-12509 (published 2022-11-07)
In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the camera-file module.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: badgermeter
Affected products: moni\
CVE-2020-1251 (published 2020-06-09)
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1207, CVE-2020-1247, CVE-2020-1253, CVE-2020-1310.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12510 (published 2020-11-19)
The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for automatic execution upon log in of a user. If a less privileged user has a local account he or she can replace TcSysUI.exe. It will be executed automatically by another user during login. This is also true for users with administrative access. Consequently, a less privileged user can trick a higher privileged user into executing code he or she modified this way. By default Beckhoff’s IPCs are shipped with TwinCAT software installed this way and with just a single local user configured. Thus the vulnerability exists if further less privileged users have been added.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: beckhoff
Affected products: twincat_extended_automation_runtime
CVE-2020-12511 (published 2021-01-22)
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: pepperl-fuchs
Affected products: io-link_master_4-eip, io-link_master_4-eip_firmware, io-link_master_4-pnio, io-link_master_4-pnio_firmware, io-link_master_8-eip, io-link_master_8-eip-l, io-link_master_8-eip-l_firmware, io-link_master_8-eip_firmware, io-link_master_8-pnio, io-link_master_8-pnio-l, io-link_master_8-pnio-l_firmware, io-link_master_8-pnio_firmware, io-link_master_dr-8-eip, io-link_master_dr-8-eip-p, io-link_master_dr-8-eip-p_firmware, io-link_master_dr-8-eip-t, io-link_master_dr-8-eip-t_firmware, io-link_master_dr-8-eip_firmware, io-link_master_dr-8-pnio, io-link_master_dr-8-pnio-p, io-link_master_dr-8-pnio-p_firmware, io-link_master_dr-8-pnio-t, io-link_master_dr-8-pnio-t_firmware, io-link_master_dr-8-pnio_firmware
CVE-2020-12512 (published 2021-01-22)
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pepperl-fuchs
Affected products: io-link_master_4-eip, io-link_master_4-eip_firmware, io-link_master_4-pnio, io-link_master_4-pnio_firmware, io-link_master_8-eip, io-link_master_8-eip-l, io-link_master_8-eip-l_firmware, io-link_master_8-eip_firmware, io-link_master_8-pnio, io-link_master_8-pnio-l, io-link_master_8-pnio-l_firmware, io-link_master_8-pnio_firmware, io-link_master_dr-8-eip, io-link_master_dr-8-eip-p, io-link_master_dr-8-eip-p_firmware, io-link_master_dr-8-eip-t, io-link_master_dr-8-eip-t_firmware, io-link_master_dr-8-eip_firmware, io-link_master_dr-8-pnio, io-link_master_dr-8-pnio-p, io-link_master_dr-8-pnio-p_firmware, io-link_master_dr-8-pnio-t, io-link_master_dr-8-pnio-t_firmware, io-link_master_dr-8-pnio_firmware
CVE-2020-12513 (published 2021-01-22)
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: pepperl-fuchs
Affected products: io-link_master_4-eip, io-link_master_4-eip_firmware, io-link_master_4-pnio, io-link_master_4-pnio_firmware, io-link_master_8-eip, io-link_master_8-eip-l, io-link_master_8-eip-l_firmware, io-link_master_8-eip_firmware, io-link_master_8-pnio, io-link_master_8-pnio-l, io-link_master_8-pnio-l_firmware, io-link_master_8-pnio_firmware, io-link_master_dr-8-eip, io-link_master_dr-8-eip-p, io-link_master_dr-8-eip-p_firmware, io-link_master_dr-8-eip-t, io-link_master_dr-8-eip-t_firmware, io-link_master_dr-8-eip_firmware, io-link_master_dr-8-pnio, io-link_master_dr-8-pnio-p, io-link_master_dr-8-pnio-p_firmware, io-link_master_dr-8-pnio-t, io-link_master_dr-8-pnio-t_firmware, io-link_master_dr-8-pnio_firmware
CVE-2020-12514 (published 2021-01-22)
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: pepperl-fuchs
Affected products: io-link_master_4-eip, io-link_master_4-eip_firmware, io-link_master_4-pnio, io-link_master_4-pnio_firmware, io-link_master_8-eip, io-link_master_8-eip-l, io-link_master_8-eip-l_firmware, io-link_master_8-eip_firmware, io-link_master_8-pnio, io-link_master_8-pnio-l, io-link_master_8-pnio-l_firmware, io-link_master_8-pnio_firmware, io-link_master_dr-8-eip, io-link_master_dr-8-eip-p, io-link_master_dr-8-eip-p_firmware, io-link_master_dr-8-eip-t, io-link_master_dr-8-eip-t_firmware, io-link_master_dr-8-eip_firmware, io-link_master_dr-8-pnio, io-link_master_dr-8-pnio-p, io-link_master_dr-8-pnio-p_firmware, io-link_master_dr-8-pnio-t, io-link_master_dr-8-pnio-t_firmware, io-link_master_dr-8-pnio_firmware
CVE-2020-12516 (published 2020-12-10)
Older firmware versions (FW1 up to FW10) of the WAGO PLC family 750-88x and 750-352 are vulnerable for a special denial of service attack.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: wago
Affected products: 750-331, 750-331_firmware, 750-352, 750-352_firmware, 750-829, 750-829_firmware, 750-831, 750-831_firmware, 750-852, 750-852_firmware, 750-880, 750-880_firmware, 750-881, 750-881_firmware, 750-882, 750-882_firmware, 750-885, 750-885_firmware, 750-889, 750-889_firmware
CVE-2020-12517 (published 2020-12-17)
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: axc_f_1152, axc_f_2152, axc_f_2152_starterkit, axc_f_3152, plcnext_firmware, plcnext_technology_starterkit, rfc_4072s
CVE-2020-12518 (published 2020-12-17)
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: phoenixcontact
Affected products: axc_f_1152, axc_f_2152, axc_f_2152_starterkit, axc_f_3152, plcnext_firmware, plcnext_technology_starterkit, rfc_4072s
CVE-2020-12519 (published 2020-12-17)
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: phoenixcontact
Affected products: axc_f_1152, axc_f_2152, axc_f_2152_starterkit, axc_f_3152, plcnext_firmware, plcnext_technology_starterkit, rfc_4072s
CVE-2020-1252 (published 2020-09-11)
<p>A remote code execution vulnerability exists when Windows improperly handles objects in memory. To exploit the vulnerability an attacker would have to convince a user to run a specially crafted application.</p>
<p>An attacker who successfully exploited this vulnerability could execute arbitrary code and take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The updates address the vulnerability by correcting how Windows handles objects in memory.</p>
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12521 (published 2020-12-17)
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: phoenixcontact
Affected products: axc_f_1152, axc_f_2152, axc_f_2152_starterkit, axc_f_3152, plcnext_firmware, plcnext_technology_starterkit, rfc_4072s
CVE-2020-12522 (published 2020-12-17)
The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: wago
Affected products: 750-8101\/025-000, 750-8102\/025-000, 750-8202\/000-012, 750-8202\/000-022, 750-8202\/040-000, 750-8202\/040-001, 750-8206\/025-000, 750-8206\/025-001, 750-8206\/040-000, 750-8206\/040-001, 750-8207\/025-000, 750-8207\/025-001, 750-8208\/025-000, 750-8208\/025-001, 750-8210\/025-000, 750-8210\/040-000, 750-8211\/040-000, 750-8211\/040-001, 750-8212\/025-000, 750-8212\/025-001, 750-8212\/025-002, 750-8212\/040-000, 750-8212\/040-010, 750-8213\/040-010, 750-8216\/025-000
CVE-2020-12523 (published 2020-12-17)
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-909
Affected vendors: phoenixcontact
Affected products: fl_mguard_rs4004_tx\/dtx, fl_mguard_rs4004_tx\/dtx_firmware, fl_mguard_rs4004_tx\/dtx_vpn, fl_mguard_rs4004_tx\/dtx_vpn_firmware, innominate_mguard_rs4000_4tx\/3g\/tx_vpn, innominate_mguard_rs4000_4tx\/3g\/tx_vpn_firmware, innominate_mguard_rs4000_4tx\/tx, innominate_mguard_rs4000_4tx\/tx_firmware, innominate_mguard_rs4000_4tx\/tx_vpn, innominate_mguard_rs4000_4tx\/tx_vpn_firmware, tc_mguard_rs4000_3g_vpn, tc_mguard_rs4000_3g_vpn_firmware, tc_mguard_rs4000_4g_att_vpn, tc_mguard_rs4000_4g_att_vpn_firmware, tc_mguard_rs4000_4g_vpn, tc_mguard_rs4000_4g_vpn_firmware, tc_mguard_rs4000_4g_vzw_vpn, tc_mguard_rs4000_4g_vzw_vpn_firmware
CVE-2020-12524 (published 2020-12-02)
Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: phoenixcontact
Affected products: btp_2043w, btp_2043w_firmware, btp_2070w, btp_2070w_firmware, btp_2102w, btp_2102w_firmware
CVE-2020-12525 (published 2021-01-22)
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: emerson, pepperl-fuchs, wago, weidmueller
Affected products: dtminspector_3, fdtcontainer_application, fdtcontainer_component, io-link_master_4-eip, io-link_master_4-pnio, io-link_master_8-eip, io-link_master_8-eip-l, io-link_master_8-pnio, io-link_master_8-pnio-l, io-link_master_dr-8-eip, io-link_master_dr-8-eip-p, io-link_master_dr-8-eip-t, io-link_master_dr-8-pnio, io-link_master_dr-8-pnio-p, io-link_master_dr-8-pnio-t, io-link_master_firmware, pactware, rosemount_transmitter_interface_software, wi_manager
CVE-2020-12526 (published 2021-05-13)
TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of these requests the OPC UA server is no longer responsive to any client. This is without effect to the real-time functionality of IPCs.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-20
Affected vendors: beckhoff
Affected products: ipc_diagnostics_ua_server, tf6100, twincat_opc_ua_server
CVE-2020-12527 (published 2021-03-02)
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corresponding permissions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: helmholz, mbconnectline
Affected products: mbconnect24, mymbconnect24, myrex24, myrex24.virtual
CVE-2020-12528 (published 2021-03-02)
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a logged in user to kill web2go sessions in the account he should not have access to.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: mbconnectline
Affected products: mbconnect24, mymbconnect24
CVE-2020-12529 (published 2021-03-02)
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allowing an attacker to scan for open ports.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-918
Affected vendors: mbconnectline
Affected products: mbconnect24, mymbconnect24
CVE-2020-1253 (published 2020-06-09)
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1207, CVE-2020-1247, CVE-2020-1251, CVE-2020-1310.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12530 (published 2021-03-02)
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mbconnectline
Affected products: mbconnect24, mymbconnect24
CVE-2020-1254 (published 2020-06-09)
An elevation of privilege vulnerability exists when Windows Modules Installer Service improperly handles class object members.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Modules Installer Service Elevation of Privilege Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-1255 (published 2020-06-09)
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-1256 (published 2020-09-11)
<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p>
<p>There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage.</p>
<p>The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.</p>
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-1257 (published 2020-06-09)
An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1278, CVE-2020-1293.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: visual_studio, visual_studio_2017, visual_studio_2019, windows_10, windows_server_2016, windows_server_2019
CVE-2020-1258 (published 2020-06-09)
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-1259 (published 2020-06-09)
A security feature bypass vulnerability exists when Windows Host Guardian Service improperly handles hashes recorded and logged, aka 'Windows Host Guardian Service Security Feature Bypass Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-12593 (published 2020-11-18)
Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: symantec
Affected products: endpoint_detection_and_response
CVE-2020-12594 (published 2020-12-10)
A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: broadcom
Affected products: symantec_messaging_gateway
CVE-2020-12595 (published 2020-12-10)
An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be authorized to access. This affects SMG prior to 10.7.4.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: broadcom
Affected products: symantec_messaging_gateway
CVE-2020-1260 (published 2020-06-09)
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1230.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: internet_explorer, windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12603 (published 2020-07-01)
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: envoyproxy
Affected products: envoy
CVE-2020-12604 (published 2020-07-01)
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: envoyproxy
Affected products: envoy
CVE-2020-12605 (published 2020-07-01)
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: envoyproxy
Affected products: envoy
CVE-2020-12606 (published 2020-08-17)
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xp_cmdshell stored procedure.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: dbsoft
Affected products: sglac
CVE-2020-12607 (published 2020-06-02)
An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-347
Affected vendors: antonkueltz
Affected products: fastecdsa
CVE-2020-12608 (published 2020-05-07)
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: solarwinds
Affected products: managed_service_provider_patch_management_engine