deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-1639
Published: 2020-04-08
Description: When an attacker sends a specific crafted Ethernet Operation, Administration, and Maintenance (Ethernet OAM) packet to a target device, it may improperly handle the incoming malformed data and fail to sanitize this incoming data resulting in an overflow condition. This overflow condition in Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) condition by coring the CFM daemon. Continued receipt of these packets may cause an extended Denial of Service condition. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D95 on SRX Series; 14.1X50 versions prior to 14.1X50-D145; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R2; 15.1X49 versions prior to 15.1X49-D170 on SRX Series; 15.1X53 versions prior to 15.1X53-D67.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703, CWE-755
References: https://kb.juniper.net/; https://kb.juniper.net/
CVE: CVE-2020-1885
Published: 2020-04-08
Description: Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.facebook.com/security/advisories/cve-2020-1885; https://www.facebook.com/security/advisories/cve-2020-1885
CVE: CVE-2020-8826
Published: 2020-04-08
Description: As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://argoproj.github.io/argo-cd/security_considerations/; https://github.com/argoproj/argo/releases; https://www.soluble.ai/blog/argo-cves-2020
CVE: CVE-2020-8827
Published: 2020-04-08
Description: As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://argoproj.github.io/argo-cd/operator-manual/user-management/#disable-admin-user; https://argoproj.github.io/argo-cd/security_considerations/; https://github.com/argoproj/argo/releases
CVE: CVE-2020-8828
Published: 2020-04-08
Description: As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-1188
References: https://argoproj.github.io/argo-cd/security_considerations/; https://github.com/argoproj/argo/releases; https://www.soluble.ai/blog/argo-cves-2020
CVE: CVE-2020-2732
Published: 2020-04-08
Description: A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1805135; https://git.kernel.org/linus/07721feee46b4b[PII_REDACTED][PII_REDACTED]9b05ec; https://git.kernel.org/linus/35a571346a94fb93b5b3b6a599675ef3384bc75c
CVE: CVE-2019-20637
Published: 2020-04-08
Description: An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-212
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html; http://varnish-cache.org/security/VSV00004.html#vsv00004
CVE: CVE-2020-11650
Published: 2020-04-08
Description: An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://jira.ixsystems.com/browse/NAS-104748; https://security.ixsystems.com/cves/2020-04-08-cve-2020-11650/; https://jira.ixsystems.com/browse/NAS-104748
CVE: CVE-2020-11653
Published: 2020-04-08
Description: An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html
CVE: CVE-2020-11655
Published: 2020-04-09
Description: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://lists.debian.org/debian-lts-announce/2020/05/msg00006.html; https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
CVE: CVE-2020-11656
Published: 2020-04-09
Description: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc; https://security.gentoo.org/glsa/202007-26
CVE: CVE-2020-10551
Published: 2020-04-09
Description: QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users group, which includes all local and remote users. This can be abused by local attackers to escalate privileges to NT AUTHORITY\SYSTEM by writing a malicious executable to the location of TsService.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/seqred-s-a/CVE-2020-10551; https://seqred.pl/en/cve-2020-10551-privilege-escalation-in-qqbrowser/; https://github.com/seqred-s-a/CVE-2020-10551
CVE: CVE-2020-10621
Published: 2020-04-09
Description: Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-11553
Published: 2020-04-09
Description: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There is pervasive CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee; https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee
CVE: CVE-2020-11554
Published: 2020-04-09
Description: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive information via info.php4.
CVSS Score: 7.5 (HIGH)
References: https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee; https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee
CVE: CVE-2020-11555
Published: 2020-04-09
Description: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive credential information from backup files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee; https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee
CVE: CVE-2020-11556
Published: 2020-04-09
Description: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) and reflected XSS vulnerabilities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee; https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee
CVE: CVE-2020-11557
Published: 2020-04-09
Description: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's cookie value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-522
References: https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee; https://medium.com/tsscyber/noc-noc-whos-there-your-nms-is-pwned-1826174e0dee
CVE: CVE-2020-10603
Published: 2020-04-09
Description: WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-10617
Published: 2020-04-09
Description: There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-10619
Published: 2020-04-09
Description: An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-10623
Published: 2020-04-09
Description: Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-10625
Published: 2020-04-09
Description: WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-10629
Published: 2020-04-09
Description: WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-10631
Published: 2020-04-09
Description: An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-01; https://www.us-cert.gov/ics/advisories/icsa-20-098-01
CVE: CVE-2020-9499
Published: 2020-04-09
Description: Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNS test command, which may cause the device to go down.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: https://www.dahuasecurity.com/support/cybersecurity/details/727; https://www.dahuasecurity.com/support/cybersecurity/details/727
CVE: CVE-2020-9500
Published: 2020-04-09
Description: Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specific log query command, which may cause the device to go down.
CVSS Score: 4.9 (MEDIUM)
References: https://www.dahuasecurity.com/support/cybersecurity/details/727; https://www.dahuasecurity.com/support/cybersecurity/details/727
CVE: CVE-2020-5263
Published: 2020-04-09
Description: auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://github.com/auth0/auth0.js/commit/355ca749b229fb93142f0b3978399b248d710828; https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp; https://github.com/auth0/auth0.js/commit/355ca749b229fb93142f0b3978399b248d710828
CVE: CVE-2018-21034
Published: 2020-04-09
Description: In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399; https://github.com/argoproj/argo-cd/issues/470; https://github.com/argoproj/argo-cd/pull/3088
CVE: CVE-2020-1895
Published: 2020-04-09
Description: A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128.
CVSS Score: 7.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://www.facebook.com/security/advisories/cve-2020-1895; https://www.facebook.com/security/advisories/cve-2020-1895
CVE: CVE-2020-7922
Published: 2020-04-09
Description: X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.2.5; https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.2.5
CVE: CVE-2020-8961
Published: 2020-04-09
Description: An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality.
CVSS Score: 9.8 (CRITICAL)
References: https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows; https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows
CVE: CVE-2020-11668
Published: 2020-04-09
Description: In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.
CVSS Score: 7.1 (HIGH)
CWE: CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a246b4d547708f33ff4d4b9a7a5dbac741dc89d8; https://github.com/torvalds/linux/commit/a246b4d547708f33ff4d4b9a7a5dbac741dc89d8
CVE: CVE-2020-8834
Published: 2020-04-09
Description: KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file")
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-368, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html; https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717; https://usn.ubuntu.com/4318-1/
CVE: CVE-2020-1633
Published: 2020-04-09
Description: Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded, leading to a Denial of Service (DoS) condition. This issue only affects Junos OS 17.4 and later releases. Prior releases do not support this feature and are unaffected by this vulnerability. This issue only affects IPv6. IPv4 ARP proxy is unaffected by this vulnerability. This issue affects Juniper Networks Junos OS: 17.4 versions prior to 17.4R2-S9, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S9 on MX Series; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D60 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3 on MX Series; 18.4 versions prior to 18.4R1-S5, 18.4R2-S2, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4, 19.1R2 on MX Series; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: https://kb.juniper.net/JSA11012; https://kb.juniper.net/JSA11012
CVE: CVE-2019-18375
Published: 2020-04-10
Description: The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console.
CVSS Score: 6.5 (MEDIUM)
References: https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1752; https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1752
CVE: CVE-2019-18376
Published: 2020-04-10
Description: A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser history or a network device that intercepts/logs traffic to MC, to obtain CSRF tokens and use them to perform CSRF attacks against MC.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352
References: https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1751; https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1751
CVE: CVE-2019-7305
Published: 2020-04-10
Description: Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile patch file debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch, this can lead to data leakage, information disclosure and potentially remote code execution on the web server. This issue affects all versions of eXtplorer in Ubuntu and Debian
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-552
References: https://launchpad.net/bugs/1822013; https://launchpad.net/bugs/1822013
CVE: CVE-2020-8832
Published: 2020-04-10
Description: The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1862840; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://usn.ubuntu.com/usn/usn-4302-1
CVE: CVE-2020-1802
Published: 2020-04-10
Description: There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product versions include:OSCA-550 versions 1.0.1.23(SP2);OSCA-550A versions 1.0.1.23(SP2);OSCA-550AX versions 1.0.1.23(SP2);OSCA-550X versions 1.0.1.23(SP2).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-354
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-osca-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200408-01-osca-en
CVE: CVE-2020-3952
Published: 2020-04-10
Description: Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html; https://www.vmware.com/security/advisories/VMSA-2020-0006; http://packetstormsecurity.com/files/157896/VMware-vCenter-Server-6.7-Authentication-Bypass.html
CVE: CVE-2020-4362
Published: 2020-04-10
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178929; https://www.ibm.com/support/pages/node/6174417; https://exchange.xforce.ibmcloud.com/vulnerabilities/178929
CVE: CVE-2020-11669
Published: 2020-04-10
Description: An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html; https://access.redhat.com/errata/RHSA-2019:3517; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2