deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4591
Published: 2020-08-28
Description: IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool. IBM X-Force ID: 184746.
CVSS Score: 3.3 (LOW)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184746; https://www.ibm.com/support/pages/node/6323765; https://exchange.xforce.ibmcloud.com/vulnerabilities/184746
CVE: CVE-2020-9298
Published: 2020-08-28
Description: The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md; https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md
CVE: CVE-2020-15164
Published: 2020-08-28
Description: in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-74
References: https://github.com/InternationalScratchWiki/mediawiki-scratch-login/commit/70849ef375016a1061490c8c4744046dbfc3e679; https://github.com/InternationalScratchWiki/mediawiki-scratch-login/security/advisories/GHSA-8fq5-g4m5-6j43; https://github.com/InternationalScratchWiki/mediawiki-scratch-login/commit/70849ef375016a1061490c8c4744046dbfc3e679
CVE: CVE-2020-16610
Published: 2020-08-28
Description: Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF). When an attacker induces authenticated admin user to a malicious web page, any accounts can be deleted without admin user's intention.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/havok89/Hoosk/issues/53; https://github.com/havok89/Hoosk/pull/56; https://github.com/havok89/Hoosk/issues/53
CVE: CVE-2020-15165
Published: 2020-08-28
Description: Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-506
References: https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6; https://play.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US; https://github.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6
CVE: CVE-2020-15154
Published: 2020-08-28
Description: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://basercms.net/security/20200827; https://github.com/baserproject/basercms/security/advisories/GHSA-cpxc-67rc-c775; https://basercms.net/security/20200827
CVE: CVE-2020-15155
Published: 2020-08-28
Description: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://basercms.net/security/20200827; https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f; https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3
CVE: CVE-2020-15159
Published: 2020-08-28
Description: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://basercms.net/security/20200827; https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d; https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw
CVE: CVE-2020-25016
Published: 2020-08-29
Description: A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119, CWE-843
References: https://github.com/kornelski/rust-rgb/issues/35; https://rustsec.org/advisories/RUSTSEC-2020-0029.html; https://github.com/kornelski/rust-rgb/issues/35
CVE: CVE-2020-3566
Published: 2020-08-29
Description: A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-770
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3566
CVE: CVE-2020-25019
Published: 2020-08-29
Description: jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14; https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0; https://github.com/jitsi/jitsi-meet-electron/security/advisories/GHSA-x4h8-fhrp-pm3p
CVE: CVE-2020-25020
Published: 2020-08-29
Description: MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9; https://www.oracle.com/security-alerts/cpujan2021.html; https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9
CVE: CVE-2020-24897
Published: 2020-08-29
Description: The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown markup to the "Table from CSV" macro.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://stiltsoft.atlassian.net/browse/VD-2; https://stiltsoft.atlassian.net/browse/VD-2
CVE: CVE-2020-24898
Published: 2020-08-29
Description: The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (URL parameter).
CVSS Score: 7.6 (HIGH)
CWE: CWE-918
References: https://stiltsoft.atlassian.net/browse/VD-1; https://stiltsoft.atlassian.net/browse/VD-1
CVE: CVE-2020-24928
Published: 2020-08-29
Description: managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server (port 3020) open to all origins, which allows attackers to obtain sensitive Discord user information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/PreMiD/PreMiD/pull/501; https://github.com/PreMiD/PreMiD/pull/501
CVE: CVE-2020-24972
Published: 2020-08-29
Description: The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html; https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
CVE: CVE-2020-7712
Published: 2020-08-30
Description: This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/trentm/json/issues/144; https://github.com/trentm/json/pull/145; https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
CVE: CVE-2020-14352
Published: 2020-08-30
Description: A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html; https://bugzilla.redhat.com/show_bug.cgi?id=1866498
CVE: CVE-2020-8244
Published: 2020-08-30
Description: A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://hackerone.com/reports/966347; https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html; https://hackerone.com/reports/966347
CVE: CVE-2020-24917
Published: 2020-08-30
Description: osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/osTicket/osTicket/commit/518de223933eab0c5558741ce317f36958ef193d; https://github.com/osTicket/osTicket/compare/v1.14.2...v1.14.3; https://sisl.lab.uic.edu/projects/chess/osticket-xss/
CVE: CVE-2020-24223
Published: 2020-08-30
Description: Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158728/Mara-CMS-7.5-Cross-Site-Scripting.html; https://github.com/FreySolarEye/CVE/blob/master/Mara%20CMS%207.5%20-%20Cross%20Site%20Scripting; https://www.exploit-db.com/exploits/48777
CVE: CVE-2020-8097
Published: 2020-08-30
Description: An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. Bitdefender Endpoint Security SDK versions prior to 6.6.18.261.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.bitdefender.com/support/security-advisories/improper-authentication-vulnerability-bitdefender-endpoint-security-tools-endpoint-security-sdk-va-8646; https://www.bitdefender.com/support/security-advisories/improper-authentication-vulnerability-bitdefender-endpoint-security-tools-endpoint-security-sdk-va-8646
CVE: CVE-2020-24104
Published: 2020-08-30
Description: XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wireless.htm SET2 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://n0hat.blogspot.com/2020/07/stored-cross-site-scripting-xss-at-pix.html; http://n0hat.blogspot.com/2020/07/stored-cross-site-scripting-xss-at-pix.html
CVE: CVE-2020-25031
Published: 2020-08-31
Description: checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://bugs.launchpad.net/ubuntu/+source/checkinstall/+bug/1861281; https://bugs.launchpad.net/ubuntu/+source/checkinstall/+bug/1861281
CVE: CVE-2020-25032
Published: 2020-08-31
Description: An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.html
CVE: CVE-2020-25033
Published: 2020-08-31
Description: The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/subscribe-sidebar/#developers; https://zeroaptitude.com/pitticus/subscribe-sidebar-plugin-by-blubrry-v1-3-1-reflected-xss-20-jun-2020/; https://wordpress.org/plugins/subscribe-sidebar/#developers
CVE: CVE-2020-15020
Published: 2020-08-31
Description: An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://hidden-one.co.in/2020/07/07/cve-2020-1020-stored-xss-on-elementor-wordpress-plugin/; https://wordpress.org/plugins/elementor/#developers; http://hidden-one.co.in/2020/07/07/cve-2020-1020-stored-xss-on-elementor-wordpress-plugin/
CVE: CVE-2020-4492
Published: 2020-08-31
Description: IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by sending a subset of ioctls on the device with invalid arguments. IBM X-Force ID: 181992.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-88
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181992; https://www.ibm.com/support/pages/node/6324249; https://exchange.xforce.ibmcloud.com/vulnerabilities/181992
CVE: CVE-2020-24115
Published: 2020-08-31
Description: In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://medium.com/%40th3cyb3rc0p/cve-2020-24115-use-of-hardcoded-credentials-in-source-code-leads-to-admin-panel-access-77e5028ec9af; https://systemweakness.com/cve-2020-24115-use-of-hardcoded-credentials-in-source-code-leads-to-admin-panel-access-77e5028ec9af; https://medium.com/%40th3cyb3rc0p/cve-2020-24115-use-of-hardcoded-credentials-in-source-code-leads-to-admin-panel-access-77e5028ec9af
CVE: CVE-2020-11617
Published: 2020-08-31
Description: The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which allows a man-in-the-middle attacker to modify the data delivered to the client.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://decoded.avast.io/vladislaviliushin/flaws-in-dvb-t2-set-top-boxes-exposed/; https://decoded.avast.io/vladislaviliushin/flaws-in-dvb-t2-set-top-boxes-exposed/
CVE: CVE-2020-11618
Published: 2020-08-31
Description: THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allows an attacker on the local network to achieve root access via the TELNET protocol.
CVSS Score: 7.8 (HIGH)
References: https://decoded.avast.io/vladislaviliushin/flaws-in-dvb-t2-set-top-boxes-exposed/; https://decoded.avast.io/vladislaviliushin/flaws-in-dvb-t2-set-top-boxes-exposed/
CVE: CVE-2020-12643
Published: 2020-08-31
Description: OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: http://seclists.org/fulldisclosure/2020/Aug/14; https://www.open-xchange.com/; http://seclists.org/fulldisclosure/2020/Aug/14
CVE: CVE-2020-12644
Published: 2020-08-31
Description: OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://seclists.org/fulldisclosure/2020/Aug/14; https://www.open-xchange.com/; https://exchange.xforce.ibmcloud.com/vulnerabilities/187116
CVE: CVE-2020-12645
Published: 2020-08-31
Description: OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://seclists.org/fulldisclosure/2020/Aug/14; https://www.open-xchange.com/; https://seclists.org/fulldisclosure/2020/Aug/14
CVE: CVE-2020-12646
Published: 2020-08-31
Description: OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.open-xchange.com/; https://exchange.xforce.ibmcloud.com/vulnerabilities/187114; https://www.open-xchange.com/
CVE: CVE-2020-12829
Published: 2020-08-31
Description: In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.
CVSS Score: 3.8 (LOW)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1808510; https://usn.ubuntu.com/4467-1/; https://www.debian.org/security/2020/dsa-4760
CVE: CVE-2020-13593
Published: 2020-08-31
Description: The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-Hellman check during the Secure Connection pairing to be skipped if the Link Layer encryption setup is performed earlier. An attacker in radio range can achieve arbitrary read/write access to protected GATT service data, cause a denial of service, or possibly control a device's function by establishing an encrypted session with an unauthenticated Long Term Key (LTK).
CVSS Score: 8.8 (HIGH)
CWE: CWE-347
References: http://www.ti.com/tool/BLE-STACK; https://asset-group.github.io/cves.html; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2020-13594
Published: 2020-08-31
Description: The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map field of the connection request packet on reception, allowing attackers in radio range to cause a denial of service (crash) via a crafted packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://asset-group.github.io/cves.html; https://asset-group.github.io/disclosures/sweyntooth/; https://github.com/espressif/esp32-bt-lib
CVE: CVE-2020-13595
Published: 2020-08-31
Description: The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion on the host stack when receiving a packet with an MIC failure. An attacker within radio range can silently trigger the assertion (which disables the target's BLE stack) by sending a crafted sequence of BLE packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://asset-group.github.io/cves.html; https://asset-group.github.io/disclosures/sweyntooth/; https://github.com/espressif/esp32-bt-lib
CVE: CVE-2020-13655
Published: 2020-08-31
Description: An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.collabtive.o-dyn.de/blog/; https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-collabtive/; http://www.collabtive.o-dyn.de/blog/
CVE: CVE-2020-24786
Published: 2020-08-31
Description: An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5; https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements; https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability
CVE: CVE-2020-5419
Published: 2020-08-31
Description: RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could carry out a local binary hijacking (planting) attack and execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://tanzu.vmware.com/security/cve-2020-5419; https://tanzu.vmware.com/security/cve-2020-5419
CVE: CVE-2020-13463
Published: 2020-08-31
Description: The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firmware via the debug interface and exception handling.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-755
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf