deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7132
Published: 2020-04-23
Description: A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE Onboard Administrator. * OA 4.95 (Linux and Windows).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbhf03988en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03988en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbhf03988en_us
CVE: CVE-2020-8797
Published: 2020-04-23
Description: Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://cerne.xyz/bugs/CVE-2020-8797.html; https://cerne.xyz/bugs/CVE-2020-8797.html
CVE: CVE-2018-21101
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://kb.netgear.com/000060449/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0380; https://kb.netgear.com/000060449/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0380
CVE: CVE-2018-21102
Published: 2020-04-23
Description: NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000060454/Security-Advisory-for-Cross-Site-Request-Forgery-on-ReadyNAS-OS-6-PSV-2018-0373; https://kb.netgear.com/000060454/Security-Advisory-for-Cross-Site-Request-Forgery-on-ReadyNAS-OS-6-PSV-2018-0373
CVE: CVE-2018-21103
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060448/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0363; https://kb.netgear.com/000060448/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0363
CVE: CVE-2018-21104
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060447/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0362; https://kb.netgear.com/000060447/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0362
CVE: CVE-2018-21105
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060446/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0361; https://kb.netgear.com/000060446/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0361
CVE: CVE-2019-17101
Published: 2020-04-23
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Camera allows an attacker to execute commands on the device. This issue affects: Netatmo Smart Indoor Camera version and prior versions.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://labs.bitdefender.com/2020/04/cracking-the-netatmo-smart-indoor-security-camera/; https://labs.bitdefender.com/2020/04/cracking-the-netatmo-smart-indoor-security-camera/
CVE: CVE-2019-20788
Published: 2020-04-23
Description: libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html; https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf; https://github.com/LibVNC/libvncserver/commit/[PII_REDACTED]6b5001fbbb9fa73c4e1a2cb9413fed
CVE: CVE-2020-5864
Published: 2020-04-23
Description: In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K27205552; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-5865
Published: 2020-04-23
Description: In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-319
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K21009022; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-5866
Published: 2020-04-23
Description: In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K11922628; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-8798
Published: 2020-04-23
Description: httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://cerne.xyz/bugs/CVE-2020-8798.html; https://cerne.xyz/bugs/CVE-2020-8798.html
CVE: CVE-2018-21106
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060445/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0360; https://kb.netgear.com/000060445/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0360
CVE: CVE-2018-21107
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060444/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0359; https://kb.netgear.com/000060444/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0359
CVE: CVE-2018-21108
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060443/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0357; https://kb.netgear.com/000060443/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0357
CVE: CVE-2018-21109
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060442/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0356; https://kb.netgear.com/000060442/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0356
CVE: CVE-2018-21110
Published: 2020-04-23
Description: NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000060441/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0355; https://kb.netgear.com/000060441/Security-Advisory-for-a-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0355
CVE: CVE-2018-21131
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by unauthenticated firmware downgrade. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVSS Score: 9.1 (CRITICAL)
References: https://kb.netgear.com/000060244/Security-Advisory-for-Unauthenticated-Firmware-Downgrade-on-Some-Wireless-Access-Points-PSV-2018-0269; https://kb.netgear.com/000060244/Security-Advisory-for-Unauthenticated-Firmware-Downgrade-on-Some-Wireless-Access-Points-PSV-2018-0269
CVE: CVE-2018-21132
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by authentication bypass. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://kb.netgear.com/000060228/Security-Advisory-for-Authentication-Bypass-on-Some-Wireless-Access-Points-PSV-2018-0299; https://kb.netgear.com/000060228/Security-Advisory-for-Authentication-Bypass-on-Some-Wireless-Access-Points-PSV-2018-0299
CVE: CVE-2018-21133
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://kb.netgear.com/000060227/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Wireless-Access-Points-PSV-2018-0326; https://kb.netgear.com/000060227/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Wireless-Access-Points-PSV-2018-0326
CVE: CVE-2018-21134
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6700 before 1.0.1.48, R7900 before 1.0.2.16, R6900 before 1.0.1.48, R7000P before 1.3.1.44, R6900P before 1.3.1.44, R6250 before 1.0.4.30, R6300v2 before 1.0.4.32, R6400 before 1.0.1.44, R6400v2 before 1.0.2.60, R7000 before 1.0.9.34, R7100LG before 1.0.0.48, R7300 before 1.0.0.68, R8000 before 1.0.4.18, R8000P before 1.4.1.24, R7900P before 1.4.1.24, R8500 before 1.0.2.122, R8300 before 1.0.2.122, WN2500RPv2 before 1.0.1.54, EX3700 before 1.0.0.72, EX3800 before 1.0.0.72, EX6000 before 1.0.0.32, EX6100 before 1.0.2.24, EX6120 before 1.0.0.42, EX6130 before 1.0.0.24, EX6150v1 before 1.0.0.42, EX6200 before 1.0.3.88, EX7000 before 1.0.0.66, D7000v2 before 1.0.0.51, D6220 before 1.0.0.46, D6400 before 1.0.0.82, and D8500 before 1.0.3.42.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://kb.netgear.com/000060226/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Wireless-Extenders-PSV-2017-2019; https://kb.netgear.com/000060226/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Wireless-Extenders-PSV-2017-2019
CVE: CVE-2020-5867
Published: 2020-04-23
Description: In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
CVSS Score: 8.1 (HIGH)
CWE: CWE-319, CWE-494
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K00958787; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-21135
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700 before 1.0.1.48, R7500 before 1.0.0.124, R7800 before 1.0.2.58, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.56, WNDR4500v3 before 1.0.0.56, and WNR2000v5-R2000 before 1.0.0.68.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000060225/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-3165; https://kb.netgear.com/000060225/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-3165
CVE: CVE-2018-21136
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://kb.netgear.com/000060224/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Modem-Routers-PSV-2018-0100; https://kb.netgear.com/000060224/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Modem-Routers-PSV-2018-0100
CVE: CVE-2018-21137
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a hardcoded password. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://kb.netgear.com/000060223/Security-Advisory-for-Hardcoded-Password-on-Some-Modem-Routers-PSV-2018-0099; https://kb.netgear.com/000060223/Security-Advisory-for-Hardcoded-Password-on-Some-Modem-Routers-PSV-2018-0099
CVE: CVE-2018-21138
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000060222/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2018-0098; https://kb.netgear.com/000060222/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2018-0098
CVE: CVE-2018-21139
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D1500 before 1.0.0.27, D500 before 1.0.0.27, D6100 before 1.0.0.58, D6200 before 1.1.00.30, D6220 before 1.0.0.46, D6400 before 1.0.0.82, D7000 before 1.0.1.68, D7000v2 before 1.0.0.51, D7800 before 1.0.1.42, D8500 before 1.0.3.42, DC112A before 1.0.0.40, DGN2200Bv4 before 1.0.0.102, DGN2200v4 before 1.0.0.102, JNR1010v2 before 1.1.0.54, JR6150 before 1.0.1.18, JWNR2010v5 before 1.1.0.54, PR2000 before 1.0.0.24, R6020 before 1.0.0.34, R6050 before 1.0.1.18, R6080 before 1.0.0.34, R6100 before 1.0.1.22, R6120 before 1.0.0.42, R6220 before 1.1.0.68, R6250 before 1.0.4.30, R6300v2 before 1.0.4.32, R6400 before 1.0.1.44, R6400v2 before 1.0.2.60, R6700 before 1.0.1.48, R6700v2 before 1.2.0.24, R6800 before 1.2.0.24, R6900 before 1.0.1.48, R6900P before 1.3.1.44, R6900v2 before 1.2.0.24, R7000 before 1.0.9.34, R7000P before 1.3.1.44, R7100LG before 1.0.0.48, R7300 before 1.0.0.68, R7500 before 1.0.0.124, R7500v2 before 1.0.3.38, R7900 before 1.0.2.16, R7900P before 1.4.1.24, R8000 before 1.0.4.18, R8000P before 1.4.1.24, R8300 before 1.0.2.122, R8500 before 1.0.2.122, WN3000RP before 1.0.0.68, WN3000RPv2 before 1.0.0.68, WNDR3400v3 before 1.0.1.18, WNDR3700v4 before 1.0.2.102, WNDR3700v5 before 1.1.0.54, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.56, WNDR4500v3 before 1.0.0.56, WNR1000v4 before 1.1.0.54, WNR2020 before 1.1.0.54, WNR2050 before 1.1.0.54, and WNR3500Lv2 before 1.2.0.54.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://kb.netgear.com/000060220/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Smart-Cradles-PSV-2017-2198; https://kb.netgear.com/000060220/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Smart-Cradles-PSV-2017-2198
CVE: CVE-2018-21142
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.
CVSS Score: 4.9 (MEDIUM)
References: https://kb.netgear.com/000059491/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2017-3169; https://kb.netgear.com/000059491/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2017-3169
CVE: CVE-2018-21161
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.34, R7800 before 1.0.2.46, and R9000 before 1.0.3.16.
CVSS Score: 9.8 (CRITICAL)
References: https://kb.netgear.com/000059469/Security-Advisory-for-Security-Misconfiguration-on-Some-Gateways-and-Routers-PSV-2017-0429; https://kb.netgear.com/000059469/Security-Advisory-for-Security-Misconfiguration-on-Some-Gateways-and-Routers-PSV-2017-0429
CVE: CVE-2018-21162
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6400 before 1.0.0.78, EX6200 before 1.0.3.86, EX7000 before 1.0.0.64, R6250 before 1.0.4.8, R6300v2 before 1.0.4.6, R6400 before 1.0.1.12, R6700 before 1.0.1.16, R7000 before 1.0.7.10, R7100LG before 1.0.0.42, R7300DST before 1.0.0.44, R7900 before 1.0.1.12, R8000 before 1.0.3.36, R8300 before 1.0.2.74, R8500 before 1.0.2.74, WNDR3400v3 before 1.0.1.14, and WNR3500Lv2 before 1.2.0.48.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://kb.netgear.com/000059147/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Gateways-Routers-and-Extenders-PSV-2016-0074; https://kb.netgear.com/000059147/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Gateways-Routers-and-Extenders-PSV-2016-0074
CVE: CVE-2018-21163
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects DGN2200Bv4 before 1.0.0.102, DGN2200v4 before 1.0.0.102, EX3700 before 1.0.0.70, EX3800 before 1.0.0.70, EX6000 before 1.0.0.30, EX6100 before 1.0.2.22, EX6120 before 1.0.0.40, EX6130 before 1.0.0.22, EX6150 before 1.0.0.38, EX6200 before 1.0.3.86, EX7000 before 1.0.0.64, R6300v2 before 1.0.4.22, R6900P before 1.3.0.18, R7000P before 1.3.0.18, R7300DST before 1.0.0.62, R7900P before 1.3.0.10, R8000 before 1.0.4.12, R8000P before 1.3.0.10, WN2500RPv2 before 1.0.1.52, and WNDR3400v3 before 1.0.1.18.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000055196/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0308; https://kb.netgear.com/000055196/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0308
CVE: CVE-2018-21160
Published: 2020-04-23
Description: NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000059470/Security-Advisory-for-Cross-Site-Request-Forgery-on-ReadyNAS-OS-6-PSV-2017-1998; https://kb.netgear.com/000059470/Security-Advisory-for-Cross-Site-Request-Forgery-on-ReadyNAS-OS-6-PSV-2017-1998
CVE: CVE-2018-21164
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.64 and WNDR3700v5 before 1.1.0.54.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://kb.netgear.com/000055195/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2017-3171; https://kb.netgear.com/000055195/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2017-3171
CVE: CVE-2018-21165
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.
CVSS Score: 4.9 (MEDIUM)
References: https://kb.netgear.com/000055194/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2017-3170; https://kb.netgear.com/000055194/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2017-3170
CVE: CVE-2018-21166
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.
CVSS Score: 4.9 (MEDIUM)
References: https://kb.netgear.com/000055193/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2017-3167; https://kb.netgear.com/000055193/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2017-3167
CVE: CVE-2020-11012
Published: 2020-04-23
Description: MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-305, CWE-755
References: https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923; https://github.com/minio/minio/pull/9422; https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z
CVE: CVE-2020-12118
Published: 2020-04-23
Description: The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
CVSS Score: 8.2 (HIGH)
CWE: CWE-276
References: https://github.com/binance-chain/tss-lib/pull/89; https://github.com/binance-chain/tss-lib/releases/tag/v1.2.0; https://github.com/binance-chain/tss-lib/pull/89
CVE: CVE-2019-15791
Published: 2020-04-24
Description: In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.
CVSS Score: 7.1 (HIGH)
CWE: CWE-672, CWE-191
References: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=601a64857b3d7040ca15c39c929e6b9db3373ec1; https://usn.ubuntu.com/usn/usn-4183-1; https://usn.ubuntu.com/usn/usn-4184-1
CVE: CVE-2019-15792
Published: 2020-04-24
Description: In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.
CVSS Score: 7.1 (HIGH)
CWE: CWE-843, CWE-843
References: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=5df147c8140efc71ac0879ae3b0057f577226d4c; https://usn.ubuntu.com/usn/usn-4183-1; https://usn.ubuntu.com/usn/usn-4184-1
CVE: CVE-2019-15793
Published: 2020-04-24
Description: In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-538, CWE-276
References: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=3644b9d5688da86f18e017c9c580b75cf52927bb; https://usn.ubuntu.com/usn/usn-4183-1; https://usn.ubuntu.com/usn/usn-4184-1