deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6195
Published: 2020-04-14
Description: SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-522
References: https://launchpad.support.sap.com/#/notes/2878507; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2878507
CVE: CVE-2020-6211
Published: 2020-04-14
Description: SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/2878507; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2878507
CVE: CVE-2020-6215
Published: 2020-04-14
Description: SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/174985/SAP-Application-Server-ABAP-Open-Redirection.html; http://seclists.org/fulldisclosure/2023/Oct/13; https://launchpad.support.sap.com/#/notes/2872782
CVE: CVE-2020-6217
Published: 2020-04-14
Description: SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2872545; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2872545
CVE: CVE-2020-6225
Published: 2020-04-14
Description: SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently validate path information provided by users, thus characters representing traverse to parent directory are passed through to the file APIs, allowing the attacker to overwrite, delete, or corrupt arbitrary files on the remote server, leading to Path Traversal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://launchpad.support.sap.com/#/notes/2896682; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2896682
CVE: CVE-2020-7574
Published: 2020-04-14
Description: A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the "Server Config" web interface of the affected devices that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf
CVE: CVE-2020-7575
Published: 2020-04-14
Description: A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitrary JavaScript code via specially crafted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web sessions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf
CVE: CVE-2020-9384
Published: 2020-04-14
Description: An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the application
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: http://packetstormsecurity.com/files/157197/Subex-ROC-Partner-Settlement-10.5-Insecure-Direct-Object-Reference.html; https://www.subex.com/partner-settlement/; http://packetstormsecurity.com/files/157197/Subex-ROC-Partner-Settlement-10.5-Insecure-Direct-Object-Reference.html
CVE: CVE-2020-8316
Published: 2020-04-14
Description: A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://support.lenovo.com/us/en/product_security/LEN-30401; https://support.lenovo.com/us/en/product_security/LEN-30401
CVE: CVE-2020-8318
Published: 2020-04-14
Description: A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version that could allow an authenticated user to execute code with elevated privileges.
CVSS Score: 7.3 (HIGH)
References: https://support.lenovo.com/us/en/product_security/LEN-30401; https://support.lenovo.com/us/en/product_security/LEN-30401
CVE: CVE-2020-8319
Published: 2020-04-14
Description: A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to execute code with elevated privileges.
CVSS Score: 7.3 (HIGH)
References: https://support.lenovo.com/us/en/product_security/LEN-30401; https://support.lenovo.com/us/en/product_security/LEN-30401
CVE: CVE-2020-8324
Published: 2020-04-14
Description: A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could allow unsigned DLL files to be executed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-347, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-30401; https://support.lenovo.com/us/en/product_security/LEN-30401
CVE: CVE-2020-8327
Published: 2020-04-14
Description: A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to execute code with elevated privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-428, CWE-269
References: https://support.lenovo.com/us/en/product_security/LEN-30401; https://support.lenovo.com/us/en/product_security/LEN-30401
CVE: CVE-2020-11001
Published: 2020-04-14
Description: In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision
comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail
admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform
actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to
the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6; https://github.com/wagtail/wagtail/commit/61045ceefea114c40ac4b680af58990dbe732389; https://github.com/wagtail/wagtail/releases/tag/v2.8.1
CVE: CVE-2020-11003
Published: 2020-04-14
Description: Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read/write to vulnerable applications. This has been patched in 2.15.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/fraction/oasis/security/advisories/GHSA-j438-45hc-vjhm; https://github.com/fraction/oasis/security/advisories/GHSA-j438-45hc-vjhm
CVE: CVE-2020-11005
Published: 2020-04-14
Description: The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again. This has been patched in version 1.0.4.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-288, CWE-327
References: https://github.com/SeppPenner/WindowsHello/issues/3; https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6cw; https://github.com/SeppPenner/WindowsHello/issues/3
CVE: CVE-2020-11758
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-11759
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write to an out-of-bounds pointer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020; https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1
CVE: CVE-2020-11760
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-11761
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-11762
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-11763
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-11764
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-11765
Published: 2020-04-14
Description: An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-193
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1987; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
CVE: CVE-2020-5260
Published: 2020-04-14
Description: Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20, CWE-522
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html
CVE: CVE-2020-11767
Published: 2020-04-15
Description: Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request for a domain concurrently configured explicitly (e.g., abc.example.com) is sent to the server(s) listening behind *.example.com. The outcome should instead be 421 Misdirected Request. Imagine a shared caching forward proxy re-using an HTTP/2 connection for a large subnet with many users. If a victim is interacting with abc.example.com, and a server (for abc.example.com) recycles the TCP connection to the forward proxy, the victim's browser may suddenly start sending sensitive data to a *.example.com server. This occurs because the forward proxy between the victim and the origin server reuses connections (which obeys the specification), but neither Istio nor Envoy corrects this by sending a 421 error. Similarly, this behavior voids the security model browsers have put in place between domains.
CVSS Score: 3.1 (LOW)
References: https://bugs.chromium.org/p/chromium/issues/detail?id=954160#c5; https://github.com/envoyproxy/envoy/issues/6767; https://github.com/istio/istio/issues/13589
CVE: CVE-2020-10505
Published: 2020-04-15
Description: The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based injection query string to get databases schema and username/password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d; https://www.twcert.org.tw/tw/cp-132-3530-53d32-1.html; https://www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d
CVE: CVE-2020-10506
Published: 2020-04-15
Description: The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d; https://www.twcert.org.tw/tw/cp-132-3531-cba24-1.html; https://www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d
CVE: CVE-2020-10507
Published: 2020-04-15
Description: The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload (RCE) , that would allow attackers to gain access in the hosting machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d; https://www.twcert.org.tw/tw/cp-132-3532-26d71-1.html; https://www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d
CVE: CVE-2020-10511
Published: 2020-04-15
Description: HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0; https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b; https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html
CVE: CVE-2020-10512
Published: 2020-04-15
Description: HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a; https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e; https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html
CVE: CVE-2020-10513
Published: 2020-04-15
Description: The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d; https://www.twcert.org.tw/tw/cp-132-3533-10afe-1.html; https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d
CVE: CVE-2020-10514
Published: 2020-04-15
Description: iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d; https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html; https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d
CVE: CVE-2020-3932
Published: 2020-04-15
Description: A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.
CVSS Score: 7.5 (HIGH)
References: https://www.twcert.org.tw/tw/cp-132-3537-1e215-1.html; https://www.twcert.org.tw/tw/cp-132-3537-1e215-1.html
CVE: CVE-2020-7278
Published: 2020-04-15
Description: Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules not being handled correctly when updating to the February 2020 updates.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284, CWE-862
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10309; https://kc.mcafee.com/corporate/index?page=content&id=SB10309
CVE: CVE-2020-7257
Published: 2020-04-15
Description: Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links whilst an anti-virus scan was in progress. This is timing dependent.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10309; https://kc.mcafee.com/corporate/index?page=content&id=SB10309
CVE: CVE-2020-7259
Published: 2020-04-15
Description: Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local security protection via a carefully crafted input file
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10309; https://kc.mcafee.com/corporate/index?page=content&id=SB10309
CVE: CVE-2020-7261
Published: 2020-04-15
Description: Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10309; https://kc.mcafee.com/corporate/index?page=content&id=SB10309
CVE: CVE-2020-7273
Published: 2020-04-15
Description: Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to delete or rename programs in the autorun key via manipulation of some parameters.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10309; https://kc.mcafee.com/corporate/index?page=content&id=SB10309
CVE: CVE-2020-7274
Published: 2020-04-15
Description: Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10309; https://kc.mcafee.com/corporate/index?page=content&id=SB10309