deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-14043
Published: 2020-08-24
Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins to make a vulnerable request without them knowing and result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://advisory.checkmarx.net/advisory/CX-2020-4279; https://github.com/Codiad/Codiad/blob/master/README.md; https://github.com/Codiad/Codiad/issues/1122
CVE: CVE-2020-14044
Published: 2020-08-24
Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://advisory.checkmarx.net/advisory/CX-2020-4280; https://github.com/Codiad/Codiad/blob/master/README.md; https://github.com/Codiad/Codiad/issues/1122
CVE: CVE-2020-4165
Published: 2020-08-24
Description: IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 174401.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174401; https://www.ibm.com/support/pages/node/6320069; https://exchange.xforce.ibmcloud.com/vulnerabilities/174401
CVE: CVE-2020-4170
Published: 2020-08-24
Description: IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174406.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174406; https://www.ibm.com/support/pages/node/6320055; https://exchange.xforce.ibmcloud.com/vulnerabilities/174406
CVE: CVE-2020-4382
Published: 2020-08-24
Description: IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgrade pertaining to xcat services. IBM X-Force ID: 179163.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179163; https://www.ibm.com/support/pages/node/6320001; https://exchange.xforce.ibmcloud.com/vulnerabilities/179163
CVE: CVE-2020-4383
Published: 2020-08-24
Description: IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while configuring some of the network services. IBM X-Force ID: 179165.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179165; https://www.ibm.com/support/pages/node/6320003; https://exchange.xforce.ibmcloud.com/vulnerabilities/179165
CVE: CVE-2020-4587
Published: 2020-08-24
Description: IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking. A local attacker could manipulate CD UNIX to obtain root provileges. IBM X-Force ID: 184578.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184578; https://www.ibm.com/support/pages/node/6320317; https://exchange.xforce.ibmcloud.com/vulnerabilities/184578
CVE: CVE-2020-4593
Published: 2020-08-24
Description: IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184747.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184747; https://www.ibm.com/support/pages/node/6320067; https://exchange.xforce.ibmcloud.com/vulnerabilities/184747
CVE: CVE-2020-4598
Published: 2020-08-24
Description: IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 184823.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184823; https://www.ibm.com/support/pages/node/6320061; https://exchange.xforce.ibmcloud.com/vulnerabilities/184823
CVE: CVE-2020-10775
Published: 2020-08-24
Description: An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer visible. The highest threat from this vulnerability is on confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-451, CWE-601
References: https://bugzilla.redhat.com/show_bug.cgi?id=1847420; https://bugzilla.redhat.com/show_bug.cgi?id=1847420
CVE: CVE-2020-24606
Published: 2020-08-24
Description: Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.
CVSS Score: 8.6 (HIGH)
CWE: CWE-667
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html; http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch
CVE: CVE-2020-7705
Published: 2020-08-24
Description: This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1021
References: https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/; https://snyk.io/research/sour-mint-malicious-sdk/; https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852
CVE: CVE-2020-24364
Published: 2020-08-24
Description: MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/theart42/cves/blob/master/cve-2020-24364/CVE-2020-24364.md; https://minetime.ai; https://github.com/theart42/cves/blob/master/cve-2020-24364/CVE-2020-24364.md
CVE: CVE-2020-6637
Published: 2020-08-24
Description: openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cinzinga.com/CVE-2020-6637/; https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8; https://opensis.com/
CVE: CVE-2020-7376
Published: 2020-08-24
Description: The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.
CVSS Score: 7.1 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/rapid7/metasploit-framework/issues/14008; https://github.com/rapid7/metasploit-framework/issues/14008
CVE: CVE-2020-7377
Published: 2020-08-24
Description: The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/rapid7/metasploit-framework/issues/14015; https://github.com/rapid7/metasploit-framework/issues/14015
CVE: CVE-2020-24572
Published: 2020-08-24
Description: An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://deadb0x.io/lunchb0x/cve-2020-24572/; https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00; https://github.com/billz/raspap-webgui/releases
CVE: CVE-2020-24612
Published: 2020-08-24
Description: An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=1860888; https://github.com/fedora-selinux/selinux-policy/commit/71e[PII_REDACTED]c7875d3436fd3966c587fa383fb; https://bugzilla.redhat.com/show_bug.cgi?id=1860888
CVE: CVE-2020-24613
Published: 2020-08-24
Description: wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://research.nccgroup.com/2020/08/24/technical-advisory-wolfssl-tls-1-3-client-man-in-the-middle-attack/; https://research.nccgroup.com/2020/08/24/technical-advisory-wolfssl-tls-1-3-client-man-in-the-middle-attack/
CVE: CVE-2020-5540
Published: 2020-08-25
Description: Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/tonykuo76/d2480727faeb768a97800db3058dceed; https://jvn.jp/en/jp/JVN46258789/; https://sup.cybersolutions.co.jp/otrs/customer.pl?Action=CustomerFAQZoom%3BItemID=985
CVE: CVE-2020-5541
Published: 2020-08-25
Description: Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sites and conduct phishing attacks via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://gist.github.com/tonykuo76/ffdaa7bfabf2205dc5bac010eee38509; https://jvn.jp/en/jp/JVN46258789/; https://sup.cybersolutions.co.jp/otrs/customer.pl?Action=CustomerFAQZoom%3BItemID=985
CVE: CVE-2020-5619
Published: 2020-08-25
Description: Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exment.net/docs/#/weakness/20200819; https://jvn.jp/en/jp/JVN88315581/; https://exment.net/docs/#/weakness/20200819
CVE: CVE-2020-5620
Published: 2020-08-25
Description: Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via a specially crafted file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exment.net/docs/#/weakness/20200819; https://jvn.jp/en/jp/JVN88315581/; https://exment.net/docs/#/weakness/20200819
CVE: CVE-2020-17384
Published: 2020-08-25
Description: Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-3845-be6bf-1.html; https://www.twcert.org.tw/tw/cp-132-3845-be6bf-1.html
CVE: CVE-2020-17385
Published: 2020-08-25
Description: Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-3846-7790c-1.html; https://www.twcert.org.tw/tw/cp-132-3846-7790c-1.html
CVE: CVE-2020-17386
Published: 2020-08-25
Description: Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html; https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html
CVE: CVE-2020-14500
Published: 2020-08-25
Description: Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-158, CWE-476
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01
CVE: CVE-2020-14508
Published: 2020-08-25
Description: GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-193, CWE-193
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01
CVE: CVE-2020-14510
Published: 2020-08-25
Description: GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193, CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01
CVE: CVE-2020-14512
Published: 2020-08-25
Description: GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.
CVSS Score: 8.1 (HIGH)
CWE: CWE-916, CWE-916
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-210-01
CVE: CVE-2020-14522
Published: 2020-08-25
Description: Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption, which may allow an attacker to cause a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-210-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-210-02
CVE: CVE-2020-14524
Published: 2020-08-25
Description: Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-210-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-210-02
CVE: CVE-2020-24240
Published: 2020-08-25
Description: GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/akimd/bison/commit/be95a4fe[PII_REDACTED]efc9454ffee8638faaf68d; https://github.com/akimd/bison/compare/v3.7...v3.7.1; https://lists.gnu.org/r/bug-bison/2020-07/msg00051.html
CVE: CVE-2020-24241
Published: 2020-08-25
Description: In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392707; https://bugzilla.nasm.us/show_bug.cgi?id=3392707
CVE: CVE-2020-24242
Published: 2020-08-25
Description: In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.
CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392708; https://bugzilla.nasm.us/show_bug.cgi?id=3392708
CVE: CVE-2020-24614
Published: 2020-08-25
Description: Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00065.html; http://www.openwall.com/lists/oss-security/2020/08/25/1; https://fossil-scm.org/forum/info/a05ae3ce7760daf6
CVE: CVE-2020-14042
Published: 2020-08-25
Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://advisory.checkmarx.net/advisory/CX-2020-4278; https://github.com/Codiad/Codiad/blob/master/README.md; https://github.com/Codiad/Codiad/issues/1122
CVE: CVE-2020-24609
Published: 2020-08-25
Description: TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie via crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/48753; https://www.exploit-db.com/exploits/48785; https://www.exploit-db.com/exploits/48753
CVE: CVE-2020-24616
Published: 2020-08-25
Description: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/FasterXML/jackson-databind/issues/2814; https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html; https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
CVE: CVE-2020-16197
Published: 2020-08-25
Description: An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/OctopusDeploy/Issues/issues/6529; https://github.com/OctopusDeploy/Issues/issues/6530; https://github.com/OctopusDeploy/Issues/issues/6531
CVE: CVE-2020-16245
Published: 2020-08-25
Description: Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-238-01; https://www.zerodayinitiative.com/advisories/ZDI-20-1084/; https://www.zerodayinitiative.com/advisories/ZDI-20-1085/
CVE: CVE-2020-24622
Published: 2020-08-25
Description: In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://issues.sonatype.org/browse/NEXUS-25019; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]93; https://issues.sonatype.org/browse/NEXUS-25019
CVE: CVE-2020-7824
Published: 2020-08-25
Description: A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnerability by modification the cookie value to an affected device. A successful exploit could allow the attacker access to sensitive device information, which includes configuration files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-267, CWE-276
References: http://www.ericssonlg.co.kr/; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35572; http://www.ericssonlg.co.kr/
CVE: CVE-2020-15639
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decryptFile method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10496.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-967/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf
CVE: CVE-2020-15640
Published: 2020-08-25
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getFileUploadBytes method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10497.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-968/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf