deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7012
Published: 2020-04-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-7013
Published: 2020-04-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-7014
Published: 2020-04-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-7015
Published: 2020-04-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-7016
Published: 2020-04-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-7017
Published: 2020-04-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2020-11490
Published: 2020-04-02
Description: Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi cert_issuer, cert_division, cert_organization, cert_locality, cert_state, cert_country, or cert_email parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://code610.blogspot.com/2020/03/pentesting-zen-load-balancer-quick.html; https://github.com/c610/tmp/blob/master/zenload4patreons.zip; http://code610.blogspot.com/2020/03/pentesting-zen-load-balancer-quick.html
CVE: CVE-2020-11491
Published: 2020-04-02
Description: Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow request to index.cgi.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://code610.blogspot.com/2020/03/pentesting-zen-load-balancer-quick.html; https://github.com/c610/tmp/blob/master/zenload4patreons.zip; http://code610.blogspot.com/2020/03/pentesting-zen-load-balancer-quick.html
CVE: CVE-2020-8016
Published: 2020-04-02
Description: A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-367, CWE-367
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html; https://bugzilla.suse.com/show_bug.cgi?id=1159740; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html
CVE: CVE-2020-8017
Published: 2020-04-02
Description: A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-367, CWE-367
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html; https://bugzilla.suse.com/show_bug.cgi?id=1158910; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00021.html
CVE: CVE-2020-11100
Published: 2020-04-02
Description: In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html; http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html; http://www.haproxy.org
CVE: CVE-2020-11450
Published: 2020-04-02
Description: Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Apr/1; https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
CVE: CVE-2020-11451
Published: 2020-04-02
Description: The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF). Note: The ability to upload visualization plugins requires administrator privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Apr/1; https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
CVE: CVE-2020-11454
Published: 2020-04-02
Description: Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Apr/1; https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
CVE: CVE-2020-4303
Published: 2020-04-02
Description: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176668.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176668; https://www.ibm.com/support/pages/node/6147195; https://exchange.xforce.ibmcloud.com/vulnerabilities/176668
CVE: CVE-2020-4304
Published: 2020-04-02
Description: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176670.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176670; https://www.ibm.com/support/pages/node/6147195; https://exchange.xforce.ibmcloud.com/vulnerabilities/176670
CVE: CVE-2020-4325
Published: 2020-04-02
Description: The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates to retrieve Global Teams information from the federated systems. As a consequence, the Java Virtual Machine can't recover the memory used by those thread pools, which leads to an OutOfMemory exception when the Process Federation Server Global Teams REST API is used extensively. IBM X-Force ID: 177596.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/177596; https://www.ibm.com/support/pages/node/6125403; https://exchange.xforce.ibmcloud.com/vulnerabilities/177596
CVE: CVE-2020-6852
Published: 2020-04-02
Description: CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://insights.oem.avira.com/serious-security-flaws-uncovered-in-cacagoo-ip-cameras/; https://www.cacagoo.com; https://insights.oem.avira.com/serious-security-flaws-uncovered-in-cacagoo-ip-cameras/
CVE: CVE-2020-9349
Published: 2020-04-02
Description: The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://insights.oem.avira.com/serious-security-flaws-uncovered-in-cacagoo-ip-cameras/; https://www.cacagoo.com; https://insights.oem.avira.com/serious-security-flaws-uncovered-in-cacagoo-ip-cameras/
CVE: CVE-2019-20635
Published: 2020-04-02
Description: codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-470
References: https://codebeamer.com/cb/wiki/7372223; https://codebeamer.com/cb/wiki/7372223
CVE: CVE-2020-11452
Published: 2020-04-02
Description: Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Apr/1; https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
CVE: CVE-2020-11453
Published: 2020-04-02
Description: Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed). NOTE: MicroStrategy is unable to reproduce the issue reported in any version of its product
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Apr/1; https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
CVE: CVE-2019-14868
Published: 2020-04-02
Description: In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.
CVSS Score: 7.4 (HIGH)
CWE: CWE-77, CWE-77
References: http://seclists.org/fulldisclosure/2020/May/53; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868; https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2
CVE: CVE-2020-8423
Published: 2020-04-02
Description: A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: https://ktln2.org/2020/03/29/exploiting-mips-router/; https://www.tp-link.com/us/security; https://ktln2.org/2020/03/29/exploiting-mips-router/
CVE: CVE-2020-11107
Published: 2020-04-02
Description: An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users (including admins) to enable arbitrary command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://packetstormsecurity.com/files/164292/XAMPP-7.4.3-Privilege-Escalation.html; https://www.apachefriends.org/blog/new_xampp_20200401.html; http://packetstormsecurity.com/files/164292/XAMPP-7.4.3-Privilege-Escalation.html
CVE: CVE-2020-11444
Published: 2020-04-02
Description: Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://support.sonatype.com; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]53; https://support.sonatype.com
CVE: CVE-2020-7617
Published: 2020-04-02
Description: ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-1321
References: https://github.com/rawiroaisen/node-ini-parser/blob/master/index.js#L14; https://snyk.io/vuln/SNYK-JS-INIPARSER-564122; https://github.com/rawiroaisen/node-ini-parser/blob/master/index.js#L14
CVE: CVE-2020-8835
Published: 2020-04-02
Description: In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: http://www.openwall.com/lists/oss-security/2021/07/20/1; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
CVE: CVE-2019-19000
Published: 2020-04-02
Description: For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-16, CWE-202, CWE-200
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19001
Published: 2020-04-02
Description: For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-16, CWE-1021
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19002
Published: 2020-04-02
Description: For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-16, CWE-79, CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19003
Published: 2020-04-02
Description: For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-16, CWE-79, CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19089
Published: 2020-04-02
Description: For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text interpreted as JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-16, CWE-94, CWE-436
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19090
Published: 2020-04-02
Description: For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping.
CVSS Score: 3.5 (LOW)
CWE: CWE-16, CWE-311
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19091
Published: 2020-04-02
Description: For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16, CWE-202, CWE-200
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19092
Published: 2020-04-02
Description: ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed.
CVSS Score: 3.5 (LOW)
CWE: CWE-16, CWE-306
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19093
Published: 2020-04-02
Description: eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-521, CWE-521
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19094
Published: 2020-04-02
Description: Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19095
Published: 2020-04-02
Description: Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing malicious content in the database.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19096
Published: 2020-04-02
Description: The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-257, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19097
Published: 2020-04-02
Description: ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to eavesdrop and/or intercept the connection.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-16, CWE-326, CWE-326
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19346
Published: 2020-04-02
Description: An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4 . An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19346; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19346
CVE: CVE-2019-19348
Published: 2020-04-02
Description: An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19348; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19348
CVE: CVE-2020-11494
Published: 2020-04-02
Description: An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-908, CWE-909
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html; http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=08fadc32ce6239dc75fd5e869590e29bc62bbc28