deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-9802
Published: 2020-06-09
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9803
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9804
Published: 2020-06-09
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. Inserting a USB device that sends invalid messages may cause a kernel panic.
CVSS Score: 4.6 (MEDIUM)
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9805
Published: 2020-06-09
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9806
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9807
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9808
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to cause unexpected system termination or write kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9809
Published: 2020-06-09
Description: An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9811
Published: 2020-06-09
Description: An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9812
Published: 2020-06-09
Description: An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9813
Published: 2020-06-09
Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9814
Published: 2020-06-09
Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9815
Published: 2020-06-09
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9816
Published: 2020-06-09
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9817
Published: 2020-06-09
Description: A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.apple.com/HT211170; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-mac-priv-esc-VqST2nrT; https://support.apple.com/HT211170
CVE: CVE-2020-9818
Published: 2020-06-09
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211169; https://support.apple.com/HT211175
CVE: CVE-2020-9819
Published: 2020-06-09
Description: A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211169; https://support.apple.com/HT211175
CVE: CVE-2020-9820
Published: 2020-06-09
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5. A remote attacker may be able to modify the file system.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211168
CVE: CVE-2020-9821
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9822
Published: 2020-06-09
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9823
Published: 2020-06-09
Description: This issue was addressed with improved checks. This issue is fixed in iOS 13.5 and iPadOS 13.5. Users removed from an iMessage conversation may still be able to alter state.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211168
CVE: CVE-2020-9824
Published: 2020-06-09
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. A non-privileged user may be able to modify restricted network settings.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9825
Published: 2020-06-09
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A malicious application may be able to bypass Privacy preferences.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211168
CVE: CVE-2020-9826
Published: 2020-06-09
Description: A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A remote attacker may be able to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211168
CVE: CVE-2020-9827
Published: 2020-06-09
Description: A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A remote attacker may be able to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9829
Published: 2020-06-09
Description: A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5. Processing a maliciously crafted text message may lead to application denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9830
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9831
Published: 2020-06-09
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9832
Published: 2020-06-09
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9833
Published: 2020-06-09
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.5. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9834
Published: 2020-06-09
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9835
Published: 2020-06-09
Description: An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. This issue is fixed in iOS 13.5 and iPadOS 13.5. A user’s video may not be paused in a FaceTime call if they exit the FaceTime app while the call is ringing.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211168
CVE: CVE-2020-9837
Published: 2020-06-09
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5. A remote attacker may be able to leak memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9838
Published: 2020-06-09
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.apple.com/HT211168; https://support.apple.com/HT211168
CVE: CVE-2020-9839
Published: 2020-06-09
Description: A race condition was addressed with improved state handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to gain elevated privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9841
Published: 2020-06-09
Description: An integer overflow was addressed through improved input validation. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9842
Published: 2020-06-09
Description: An entitlement parsing issue was addressed with improved parsing. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application could interact with system processes to access private information and perform privileged actions.
CVSS Score: 7.1 (HIGH)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9843
Published: 2020-06-09
Description: An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to a cross site scripting attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9844
Published: 2020-06-09
Description: A double free issue was addressed with improved memory management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211168
CVE: CVE-2020-9847
Published: 2020-06-09
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9848
Published: 2020-06-09
Description: An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5. A person with physical access to an iOS device may be able to view notification contents from the lockscreen.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211168
CVE: CVE-2020-9850
Published: 2020-06-09
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/HT211168; https://support.apple.com/HT211171; https://support.apple.com/HT211175
CVE: CVE-2020-9851
Published: 2020-06-09
Description: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9852
Published: 2020-06-09
Description: An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://support.apple.com/HT211168; https://support.apple.com/HT211170; https://support.apple.com/HT211171
CVE: CVE-2020-9855
Published: 2020-06-09
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.5. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9856
Published: 2020-06-09
Description: This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. An application may be able to gain elevated privileges.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/HT211170; https://support.apple.com/HT211170
CVE: CVE-2020-9858
Published: 2020-06-09
Description: A dynamic library loading issue was addressed with improved path searching. This issue is fixed in Windows Migration Assistant 2.2.0.0 (v. 1A11). Running the installer in an untrusted directory may result in arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://support.apple.com/HT211186; https://support.apple.com/HT211186
CVE: CVE-2020-10644
Published: 2020-06-09
Description: The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html; https://www.us-cert.gov/ics/advisories/icsa-20-147-01; http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html
CVE: CVE-2020-12000
Published: 2020-06-09
Description: The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.us-cert.gov/ics/advisories/icsa-20-147-01; https://www.us-cert.gov/ics/advisories/icsa-20-147-01
CVE: CVE-2020-12004
Published: 2020-06-09
Description: The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html; https://www.us-cert.gov/ics/advisories/icsa-20-147-01; http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html
CVE: CVE-2020-13892
Published: 2020-06-09
Description: The SportsPress plugin before 2.7.2 for WordPress allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/10257; https://wpvulndb.com/vulnerabilities/10257
CVE: CVE-2020-11957
Published: 2020-06-09
Description: The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with both LE Secure Connections as well as LE Legacy Pairing. A predictable or brute-forceable random number allows an attacker (in radio range) to perform a MITM attack during BLE pairing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: https://www.cypress.com/file/504466/download; https://www.cypress.com/file/504466/download
CVE: CVE-2020-13872
Published: 2020-06-09
Description: Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307
References: http://packetstormsecurity.com/files/158000/RoyalTS-SSH-Tunnel-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/Jun/14; https://hacktips.it/royalts-ssh-tunnel-authentication-bypass/
CVE: CVE-2020-13911
Published: 2020-06-09
Description: Your Online Shop 1.8.0 allows authenticated users to trigger XSS via a Change Name or Change Surname operation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/kdrypr/5dac91c2d27c4dc82b1225dffa38f7a8; https://gist.github.com/kdrypr/5dac91c2d27c4dc82b1225dffa38f7a8
CVE: CVE-2020-6265
Published: 2020-06-09
Description: SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://launchpad.support.sap.com/#/notes/2918924; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775; https://launchpad.support.sap.com/#/notes/2918924