auren-research/cyber-sec huggingface dataset:
cveID: CVE-2020-14750
vendorProject: Oracle
product: WebLogic Server
vulnerabilityName: Oracle WebLogic Server Remote Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-14750
cveID: CVE-2020-14882
vendorProject: Oracle
product: WebLogic Server
vulnerabilityName: Oracle WebLogic Server Remote Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-14882
cveID: CVE-2020-14883
vendorProject: Oracle
product: WebLogic Server
vulnerabilityName: Oracle WebLogic Server Unspecified Vulnerability
dateAdded: 2021-11-03
shortDescription: Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-14883
cveID: CVE-2020-8644
vendorProject: PlaySMS
product: PlaySMS
vulnerabilityName: PlaySMS Server-Side Template Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-8644
cwes: CWE-94
cveID: CVE-2019-18935
vendorProject: Progress
product: Telerik UI for ASP.NET AJAX
vulnerabilityName: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
dateAdded: 2021-11-03
shortDescription: Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-18935
cwes: CWE-502
cveID: CVE-2021-22893
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Use-After-Free Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22893
cwes: CWE-287
cveID: CVE-2020-8243
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8243
cwes: CWE-94
cveID: CVE-2021-22900
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22900
cwes: CWE-94
cveID: CVE-2021-22894
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22894
cwes: CWE-94
cveID: CVE-2020-8260
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8260
cwes: CWE-434
cveID: CVE-2021-22899
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Command Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22899
cwes: CWE-77
cveID: CVE-2019-11510
vendorProject: Ivanti
product: Pulse Connect Secure
vulnerabilityName: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2019-11510
cwes: CWE-22
cveID: CVE-2019-11539
vendorProject: Ivanti
product: Pulse Connect Secure and Pulse Policy Secure
vulnerabilityName: Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-11539
cwes: CWE-78
cveID: CVE-2021-1906
vendorProject: Qualcomm
product: Multiple Chipsets
vulnerabilityName: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
dateAdded: 2021-11-03
shortDescription: Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-1906
cwes: CWE-390
cveID: CVE-2021-1905
vendorProject: Qualcomm
product: Multiple Chipsets
vulnerabilityName: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
dateAdded: 2021-11-03
shortDescription: Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-1905
cwes: CWE-416
cveID: CVE-2020-10221
vendorProject: rConfig
product: rConfig
vulnerabilityName: rConfig OS Command Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-10221
cwes: CWE-78
cveID: CVE-2021-35395
vendorProject: Realtek
product: AP-Router SDK
vulnerabilityName: Realtek AP-Router SDK Buffer Overflow Vulnerability
dateAdded: 2021-11-03
shortDescription: Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35395
cwes: CWE-20
CWE-122
cveID: CVE-2017-16651
vendorProject: Roundcube
product: Roundcube Webmail
vulnerabilityName: Roundcube Webmail File Disclosure Vulnerability
dateAdded: 2021-11-03
shortDescription: Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-16651
cwes: CWE-552
cveID: CVE-2020-11652
vendorProject: SaltStack
product: Salt
vulnerabilityName: SaltStack Salt Path Traversal Vulnerability
dateAdded: 2021-11-03
shortDescription: SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-11652
cwes: CWE-22
cveID: CVE-2020-11651
vendorProject: SaltStack
product: Salt
vulnerabilityName: SaltStack Salt Authentication Bypass Vulnerability
dateAdded: 2021-11-03
shortDescription: SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-11651
cveID: CVE-2020-16846
vendorProject: SaltStack
product: Salt
vulnerabilityName: SaltStack Salt Shell Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-16846
cwes: CWE-78
cveID: CVE-2018-2380
vendorProject: SAP
product: Customer Relationship Management (CRM)
vulnerabilityName: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
dateAdded: 2021-11-03
shortDescription: SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-2380
cwes: CWE-22
cveID: CVE-2010-5326
vendorProject: SAP
product: NetWeaver
vulnerabilityName: SAP NetWeaver Remote Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2010-5326
cveID: CVE-2016-9563
vendorProject: SAP
product: NetWeaver
vulnerabilityName: SAP NetWeaver XML External Entity (XXE) Vulnerability
dateAdded: 2021-11-03
shortDescription: SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2016-9563
cwes: CWE-611
cveID: CVE-2020-6287
vendorProject: SAP
product: NetWeaver
vulnerabilityName: SAP NetWeaver Missing Authentication for Critical Function Vulnerability
dateAdded: 2021-11-03
shortDescription: SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-6287
cwes: CWE-306
cveID: CVE-2020-6207
vendorProject: SAP
product: Solution Manager
vulnerabilityName: SAP Solution Manager Missing Authentication for Critical Function Vulnerability
dateAdded: 2021-11-03
shortDescription: SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-6207
cwes: CWE-306
cveID: CVE-2016-3976
vendorProject: SAP
product: NetWeaver
vulnerabilityName: SAP NetWeaver Directory Traversal Vulnerability
dateAdded: 2021-11-03
shortDescription: SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2016-3976
cwes: CWE-22
cveID: CVE-2019-16256
vendorProject: SIMalliance
product: Toolbox Browser
vulnerabilityName: SIMalliance Toolbox Browser Command Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-16256
cveID: CVE-2020-10148
vendorProject: SolarWinds
product: Orion
vulnerabilityName: SolarWinds Orion Authentication Bypass Vulnerability
dateAdded: 2021-11-03
shortDescription: SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-10148
cwes: CWE-288
cveID: CVE-2021-35211
vendorProject: SolarWinds
product: Serv-U
vulnerabilityName: SolarWinds Serv-U Remote Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35211
cwes: CWE-787
cveID: CVE-2016-3643
vendorProject: SolarWinds
product: Virtualization Manager
vulnerabilityName: SolarWinds Virtualization Manager Privilege Escalation Vulnerability
dateAdded: 2021-11-03
shortDescription: SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2016-3643
cwes: CWE-264
cveID: CVE-2020-10199
vendorProject: Sonatype
product: Nexus Repository
vulnerabilityName: Sonatype Nexus Repository Remote Code Execution Vulnerability
dateAdded: 2021-11-03
shortDescription: Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-10199
cwes: CWE-917
cveID: CVE-2021-20021
vendorProject: SonicWall
product: SonicWall Email Security
vulnerabilityName: SonicWall Email Security Improper Privilege Management Vulnerability
dateAdded: 2021-11-03
shortDescription: SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-20021
cwes: CWE-306
cveID: CVE-2019-7481
vendorProject: SonicWall
product: SMA100
vulnerabilityName: SonicWall SMA100 SQL Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-7481
cwes: CWE-89
cveID: CVE-2021-20022
vendorProject: SonicWall
product: SonicWall Email Security
vulnerabilityName: SonicWall Email Security Unrestricted Upload of File Vulnerability
dateAdded: 2021-11-03
shortDescription: SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-20022
cwes: CWE-434
cveID: CVE-2021-20023
vendorProject: SonicWall
product: SonicWall Email Security
vulnerabilityName: SonicWall Email Security Path Traversal Vulnerability
dateAdded: 2021-11-03
shortDescription: SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-20023
cwes: CWE-22
cveID: CVE-2021-20016
vendorProject: SonicWall
product: SSLVPN SMA100
vulnerabilityName: SonicWall SSLVPN SMA100 SQL Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-20016
cwes: CWE-89
cveID: CVE-2020-12271
vendorProject: Sophos
product: SFOS
vulnerabilityName: Sophos SFOS SQL Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-12271
cwes: CWE-89
cveID: CVE-2020-10181
vendorProject: Sumavision
product: Enhanced Multimedia Router (EMR)
vulnerabilityName: Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability
dateAdded: 2021-11-03
shortDescription: Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-10181
cwes: CWE-352