deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11595
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path.
CVSS Score: 7.5 (HIGH)
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11596
Published: 2020-04-06
Description: A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make HTTP GET requests to a certain URL and obtain information about what files and directories reside on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11597
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11598
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-434
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11599
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 6.80 Build[PII_REDACTED]. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11586
Published: 2020-04-06
Description: An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11587
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server.
CVSS Score: 7.5 (HIGH)
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-8096
Published: 2020-04-07
Description: Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the search path. This issue affects: Bitdefender High-Level Antimalware SDK for Windows versions prior to 3.0.1.204 .
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-high-level-antimalware-sdk-windows/; https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-high-level-antimalware-sdk-windows/
CVE: CVE-2016-11041
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 (June 2016).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11042
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11043
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. The S/MIME implementation in EAS uses DES (where 3DES is intended). The Samsung ID is SVE-2016-5871 (June 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11044
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software. The check of an application's signature can be bypassed during installation. The Samsung ID is SVE-2016-5923 (June 2016).
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11045
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. The Gallery library allow memory corruption via a malformed image. The Samsung ID is SVE-2016-5317 (May 2016).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11046
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with JBP(4.3), KK(4.4), and L(5.0/5.1) software. Because of a misused whitelist, attackers can reach the radio layer (aka RIL or RILD) to place calls or send SMS messages. The Samsung ID is SVE-2016-5733 (May 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11047
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with JBP(4.2) and KK(4.4) (Marvell chipsets) software. The ACIPC-MSOCKET driver allows local privilege escalation via a stack-based buffer overflow. The Samsung ID is SVE-2016-5393 (April 2016).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11048
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) (Spreadtrum or Marvell chipsets) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-5421 (March 2016).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11049
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2016-01-16 (Shannon333/308/310 chipsets). The IMEI may be retrieved and modified because of an error in managing key information. The Samsung ID is SVE-2016-5435 (March 2016).
CVSS Score: 9.1 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11050
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with S3(KK), Note2(KK), S4(L), Note3(L), and S5(L) software. An attacker can rewrite the IMEI by flashing crafted firmware. The Samsung ID is SVE-2016-5562 (March 2016).
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11051
Published: 2020-04-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-0569. Reason: This candidate is a duplicate of CVE-2015-0569. Notes: All CVE users should reference CVE-2015-0569 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-11052
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. je_free in libQjpeg.so in Qjpeg in Qt 5.5 allows memory corruption via a malformed JPEG file. The Samsung ID is SVE-2015-5110 (January 2016).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11053
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2015-11-11 (supporting FRP/RL). There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2015-5131 (January 2016).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-2172
Published: 2020-04-07
Description: Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: http://www.openwall.com/lists/oss-security/2020/04/07/3; https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1699; http://www.openwall.com/lists/oss-security/2020/04/07/3
CVE: CVE-2020-2173
Published: 2020-04-07
Description: Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/04/07/3; https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1633; http://www.openwall.com/lists/oss-security/2020/04/07/3
CVE: CVE-2020-2174
Published: 2020-04-07
Description: Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a reflected cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/04/07/3; https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1769; http://www.openwall.com/lists/oss-security/2020/04/07/3
CVE: CVE-2020-2175
Published: 2020-04-07
Description: Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/04/07/3; https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1801; http://www.openwall.com/lists/oss-security/2020/04/07/3
CVE: CVE-2020-2176
Published: 2020-04-07
Description: Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/04/07/3; https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1780; http://www.openwall.com/lists/oss-security/2020/04/07/3
CVE: CVE-2020-6171
Published: 2020-04-07
Description: A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.deepcode.ca/index.php/2020/04/07/cve-2020-xss-in-clink-office-v2/; https://www.deepcode.ca/index.php/2020/04/07/cve-2020-xss-in-clink-office-v2/
CVE: CVE-2016-11025
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a memcpy heap-based buffer overflow in the OTP service. The Samsung ID is SVE-2016-7114 (December 2016).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11026
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 (December 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11027
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on the lock screen. The Samsung ID is SVE-2016-7132 (December 2016).
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11028
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a stack-based buffer overflow in the OTP TrustZone trustlet. The Samsung IDs are SVE-2016-7173 and SVE-2016-7174 (December 2016).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11029
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11030
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (with Hrm sensor support) software. The sysfs of the MAX86902 sensor driver does not prevent concurrent access, leading to a race condition and resultant heap-based buffer overflow. The Samsung ID is SVE-2016-7341 (December 2016).
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11031
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. AntService allows a system_server crash and reboot. The Samsung ID is SVE-2016-7044 (November 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11032
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. An attacker can disable all Sound functionality by broadcasting an unprotected intent. The Samsung IDs are SVE-2016-7179 and SVE-2016-7182 (November 2016).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11033
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. There is a heap-based buffer overflow in tlc_server. The Samsung IDs are SVE-2016-7220 and SVE-2016-7225 (November 2016).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11034
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. The decode function in Qjpeg in Qt 5.7 allows attackers to trigger a system crash via a malformed image. The Samsung ID is SVE-2016-6560 (October 2016).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11035
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2016-05-27 (Exynos AP chipsets). A local graphics user can cause a Kernel Crash via the fb0(DECON) frame buffer interface. The Samsung ID is SVE-2016-7011 (October 2016).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11036
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (August 2016).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11037
Published: 2020-04-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6604. Reason: This candidate is a reservation duplicate of CVE-2016-6604. Notes: All CVE users should reference CVE-2016-6604 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-11038
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service doesn't implement access control for shared memory, leading to arbitrary code execution or privilege escalation. The Samsung ID is SVE-2016-5953 (July 2016).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11039
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (AP + CP MDM9x35, or Qualcomm Onechip) software. There is a NULL pointer dereference issue in the IPC socket code. The Samsung ID is SVE-2016-5980 (July 2016).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-11040
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) (with USB OTG MyFile2014_L_ESS support) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2015-5068 (June 2016).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18692
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (MSM8939, MSM8996, MSM8998, Exynos7580, Exynos8890, or Exynos8895 chipsets) software. There is a race condition, with a resultant buffer overflow, in the sec_ts touchscreen sysfs interface. The Samsung ID is SVE-2016-7501 (January 2017).
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18693
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. There is a buffer overflow in the fps sysfs entry. The Samsung ID is SVE-2016-7510 (January 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18694
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with software through 2016-10-25 (Exynos5 chipsets). Attackers can read kernel addresses in the log because an incorrect format specifier is used. The Samsung ID is SVE-2016-7551 (January 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18695
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Attackers (who control a certain subdomain) can discover a user's credentials, during an email account login, via an EAS autodiscover packet. The Samsung ID is SVE-2016-7654 (January 2017).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18696
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos7420, Exynos8890, or MSM8996 chipsets) software. RKP allows memory corruption. The Samsung ID is SVE-2016-7897 (January 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-11608
Published: 2020-04-07
Description: An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=998912346c0da53a6dbb71fab3a138586b596b30
CVE: CVE-2020-5734
Published: 2020-04-07
Description: Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.tenable.com/security/research/tra-2020-19; https://www.tenable.com/security/research/tra-2020-19
CVE: CVE-2020-7613
Published: 2020-04-07
Description: clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://github.com/kylefarris/clamscan/blob/master/index.js#L34; https://snyk.io/vuln/SNYK-JS-CLAMSCAN-564113; https://github.com/kylefarris/clamscan/blob/master/index.js#L34
CVE: CVE-2020-7614
Published: 2020-04-07
Description: npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-78
References: https://github.com/Manak/npm-programmatic/blob/master/index.js#L18; https://snyk.io/vuln/SNYK-JS-NPMPROGRAMMATIC-564115; https://github.com/Manak/npm-programmatic/blob/master/index.js#L18
CVE: CVE-2020-7615
Published: 2020-04-07
Description: fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/gregof/fsa/blob/master/lib/rep.js#L12; https://snyk.io/vuln/SNYK-JS-FSA-564118; https://github.com/gregof/fsa/blob/master/lib/rep.js#L12