deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6542
Published: 2020-09-21
Description: Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1107433; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6543
Published: 2020-09-21
Description: Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1104046; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6544
Published: 2020-09-21
Description: Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1108497; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6545
Published: 2020-09-21
Description: Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1095584; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6546
Published: 2020-09-21
Description: Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1100280; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6547
Published: 2020-09-21
Description: Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1102153; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6548
Published: 2020-09-21
Description: Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1103827; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6549
Published: 2020-09-21
Description: Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://packetstormsecurity.com/files/159558/Chrome-MediaElementEventListener-UpdateSources-Use-After-Free.html; https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1105426
CVE: CVE-2020-6550
Published: 2020-09-21
Description: Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://packetstormsecurity.com/files/159609/Chrome-WebIDBGetDBNamesCallbacksImpl-SuccessNamesAndVersionsList-Use-After-Free.html; https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1106682
CVE: CVE-2020-6551
Published: 2020-09-21
Description: Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://packetstormsecurity.com/files/159611/Chrome-XRSystem-FocusedFrameChanged-and-FocusController-NotifyFocusChangedObservers-Use-After-Free.html; https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1107815
CVE: CVE-2020-6552
Published: 2020-09-21
Description: Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1108518; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6553
Published: 2020-09-21
Description: Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1111307; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6554
Published: 2020-09-21
Description: Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1094235; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6555
Published: 2020-09-21
Description: Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 7.6 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html; https://crbug.com/1105202; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
CVE: CVE-2020-6556
Published: 2020-09-21
Description: Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00049.html; https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html; https://crbug.com/1115345
CVE: CVE-2020-6558
Published: 2020-09-21
Description: Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6559
Published: 2020-09-21
Description: Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6560
Published: 2020-09-21
Description: Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6561
Published: 2020-09-21
Description: Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6562
Published: 2020-09-21
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6563
Published: 2020-09-21
Description: Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6564
Published: 2020-09-21
Description: Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6565
Published: 2020-09-21
Description: Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6566
Published: 2020-09-21
Description: Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6567
Published: 2020-09-21
Description: Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6568
Published: 2020-09-21
Description: Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6569
Published: 2020-09-21
Description: Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6570
Published: 2020-09-21
Description: Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6571
Published: 2020-09-21
Description: Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6573
Published: 2020-09-21
Description: Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6574
Published: 2020-09-21
Description: Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6575
Published: 2020-09-21
Description: Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.3 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-6576
Published: 2020-09-21
Description: Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00081.html
CVE: CVE-2020-7734
Published: 2020-09-22
Description: All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/arachnys/cabot/pull/694; https://itsmeanonartist.tech/blogs/blog2.html; https://snyk.io/vuln/SNYK-PYTHON-CABOT-609862
CVE: CVE-2020-24619
Published: 2020-09-22
Description: In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/mltframework/shotcut/commit/f008adc039642307f6ee3378d378cdb842e52c1d; https://shotcut.org/blog/new-release-200913/; https://github.com/mltframework/shotcut/commit/f008adc039642307f6ee3378d378cdb842e52c1d
CVE: CVE-2020-8887
Published: 2020-09-22
Description: Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php (aka the server login page).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/google/security-research/security/advisories/GHSA-g69r-8jwh-2462; https://github.com/google/security-research/security/advisories/GHSA-g69r-8jwh-2462
CVE: CVE-2020-11855
Published: 2020-09-22
Description: An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attackers on the OBR host to execute code with escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://softwaresupport.softwaregrp.com/doc/KM03710590; https://www.zerodayinitiative.com/advisories/ZDI-20-1217/; https://softwaresupport.softwaregrp.com/doc/KM03710590
CVE: CVE-2020-11857
Published: 2020-09-22
Description: An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to access the OBR host as a non-admin user
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/162407/Micro-Focus-Operations-Bridge-Reporter-shrboadmin-Default-Password.html; https://softwaresupport.softwaregrp.com/doc/KM03710590; https://www.zerodayinitiative.com/advisories/ZDI-20-1215/
CVE: CVE-2020-23446
Published: 2020-09-22
Description: Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: http://cvewalkthrough.com/variant-unauthenticated-information-disclosure-via-api/; http://verint.com; https://tejaspingulkar.blogspot.com/2020/09/cve-2020-23446-verint-workforce.html
CVE: CVE-2020-3977
Published: 2020-09-22
Description: VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://www.vmware.com/security/advisories/VMSA-2020-0021.html; https://www.vmware.com/security/advisories/VMSA-2020-0021.html
CVE: CVE-2020-4611
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184922; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184922
CVE: CVE-2020-4612
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. IBM X-Force ID: 184924.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184924; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184924
CVE: CVE-2020-4613
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184925.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184925; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184925
CVE: CVE-2020-4614
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 184927.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184927; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184927
CVE: CVE-2020-4615
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 184928.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184928; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184928
CVE: CVE-2020-4616
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184929; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184929
CVE: CVE-2020-4617
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 184930.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184930; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184930
CVE: CVE-2020-4618
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184937; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184937
CVE: CVE-2020-4619
Published: 2020-09-22
Description: IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184976; https://www.ibm.com/support/pages/node/6335281; https://exchange.xforce.ibmcloud.com/vulnerabilities/184976