deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-1432
Published: 2020-07-14
Description: An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer Information Disclosure Vulnerability'.
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1432; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1432
CVE: CVE-2020-1433
Published: 2020-07-14
Description: An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1433; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1433
CVE: CVE-2020-1434
Published: 2020-07-14
Description: An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka 'Windows Sync Host Service Elevation of Privilege Vulnerability'.
CVSS Score: 5.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1434; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1434
CVE: CVE-2020-1435
Published: 2020-07-14
Description: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1435; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1435
CVE: CVE-2020-1436
Published: 2020-07-14
Description: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Windows Font Library Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2020/08/25/3; http://www.openwall.com/lists/oss-security/2020/08/25/5; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436
CVE: CVE-2020-1437
Published: 2020-07-14
Description: An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka 'Windows Network Location Awareness Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1437; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1437
CVE: CVE-2020-1438
Published: 2020-07-14
Description: An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connections Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1373, CVE-2020-1390, CVE-2020-1427, CVE-2020-1428.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1438; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1438
CVE: CVE-2020-1439
Published: 2020-07-14
Description: A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439; https://www.zerodayinitiative.com/advisories/ZDI-20-874/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1439
CVE: CVE-2020-1442
Published: 2020-07-14
Description: A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1442; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1442
CVE: CVE-2020-1443
Published: 2020-07-14
Description: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1443; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1443
CVE: CVE-2020-1444
Published: 2020-07-14
Description: A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1444; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1444
CVE: CVE-2020-1445
Published: 2020-07-14
Description: An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1342.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1445; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1445
CVE: CVE-2020-1446
Published: 2020-07-14
Description: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1447, CVE-2020-1448.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1446; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1446
CVE: CVE-2020-1447
Published: 2020-07-14
Description: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1446, CVE-2020-1448.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1447; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1447
CVE: CVE-2020-1448
Published: 2020-07-14
Description: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1446, CVE-2020-1447.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1448; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1448
CVE: CVE-2020-1449
Published: 2020-07-14
Description: A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1449; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1449
CVE: CVE-2020-1450
Published: 2020-07-14
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1451, CVE-2020-1456.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1450; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1450
CVE: CVE-2020-1451
Published: 2020-07-14
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1456.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1451; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1451
CVE: CVE-2020-1454
Published: 2020-07-14
Description: This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1454; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1454
CVE: CVE-2020-1456
Published: 2020-07-14
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1451.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Microsoft-Office-SharePoint; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1456; https://slashcrypto.org/2021/01/15/CVE-2020-1456/
CVE: CVE-2020-1458
Published: 2020-07-14
Description: A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading dynamic link library (DLL) files, aka 'Microsoft Office Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1458; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1458
CVE: CVE-2020-1461
Published: 2020-07-14
Description: An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1461; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1461
CVE: CVE-2020-1462
Published: 2020-07-14
Description: An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability'.
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1462; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1462
CVE: CVE-2020-1463
Published: 2020-07-14
Description: An elevation of privilege vulnerability exists in the way that the SharedStream Library handles objects in memory, aka 'Windows SharedStream Library Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1463; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1463
CVE: CVE-2020-1465
Published: 2020-07-14
Description: An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft OneDrive Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1465; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1465
CVE: CVE-2020-1468
Published: 2020-07-14
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1468; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1468
CVE: CVE-2020-1469
Published: 2020-07-14
Description: A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1469; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1469
CVE: CVE-2020-1481
Published: 2020-07-14
Description: A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual Studio Code ESLint Extention Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1481; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1481
CVE: CVE-2020-14497
Published: 2020-07-15
Description: Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01; https://www.zerodayinitiative.com/advisories/ZDI-20-827/; https://www.zerodayinitiative.com/advisories/ZDI-20-828/
CVE: CVE-2020-14505
Published: 2020-07-15
Description: Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any validation. The attacker may then remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-74
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01; https://www.zerodayinitiative.com/advisories/ZDI-20-831/; https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
CVE: CVE-2020-14507
Published: 2020-07-15
Description: Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01; https://www.zerodayinitiative.com/advisories/ZDI-20-829/; https://www.zerodayinitiative.com/advisories/ZDI-20-840/
CVE: CVE-2020-14499
Published: 2020-07-15
Description: Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01; https://www.zerodayinitiative.com/advisories/ZDI-20-867/; https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
CVE: CVE-2020-14501
Published: 2020-07-15
Description: Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also delete the administrator account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01; https://www.zerodayinitiative.com/advisories/ZDI-20-859/; https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
CVE: CVE-2020-14503
Published: 2020-07-15
Description: Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01; https://www.zerodayinitiative.com/advisories/ZDI-20-834/; https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
CVE: CVE-2020-14511
Published: 2020-07-15
Description: Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and EDR-G903 Series Routers (versions prior to 5.4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-196-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-196-02
CVE: CVE-2020-4100
Published: 2020-07-15
Description: "HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be loaded by default when the application is started. Typically, core components and additional dependencies are loaded natively at runtime; however, dynamically loaded components are only loaded as they are specifically requested. While this can have a positive impact on performance, or grant additional functionality (for example, a non-invasive update feature), it can also open the application to loading unintended code if not implemented properly."
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-913
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080800; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080800
CVE: CVE-2020-5765
Published: 2020-07-15
Description: Nessus 8.10.0 and earlier were found to contain a Stored XSS vulnerability due to improper validation of input during scan configuration. An authenticated, remote attacker could potentially exploit this vulnerability to execute arbitrary code in a user's session. Tenable has implemented additional input validation mechanisms to correct this issue in Nessus 8.11.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/tns-2020-05; https://www.tenable.com/security/tns-2020-05
CVE: CVE-2019-17637
Published: 2020-07-15
Description: In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571; https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html; https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
CVE: CVE-2020-7292
Published: 2020-07-15
Description: Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-838, CWE-838
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10323; https://kc.mcafee.com/corporate/index?page=content&id=SB10323
CVE: CVE-2020-13923
Published: 2020-07-15
Description: IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://lists.apache.org/thread.html/r0a0a701610b3bcdf[PII_REDACTED]adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r2e669797c1ea[PII_REDACTED]9d2dc4192d951945e0c36cb0754f5394a6%40%3Cannounce.apache.org%3E
CVE: CVE-2020-15695
Published: 2020-07-15
Description: An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-csrf-in-com-privacy-remove-request-feature.html; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-csrf-in-com-privacy-remove-request-feature.html
CVE: CVE-2020-15696
Published: 2020-07-15
Description: An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-escape-mod-random-image-link.html; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-escape-mod-random-image-link.html
CVE: CVE-2020-15697
Published: 2020-07-15
Description: An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-variable-tampering-via-user-table-class.html; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-variable-tampering-via-user-table-class.html
CVE: CVE-2020-15698
Published: 2020-07-15
Description: An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials
CVSS Score: 5.3 (MEDIUM)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-system-information-screen-could-expose-redis-or-proxy-credentials.html; https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-system-information-screen-could-expose-redis-or-proxy-credentials.html
CVE: CVE-2020-15699
Published: 2020-07-15
Description: An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-missing-checks-can-lead-to-a-broken-usergroups-table-record.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-missing-checks-can-lead-to-a-broken-usergroups-table-record.html
CVE: CVE-2020-15700
Published: 2020-07-15
Description: An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-com-installer-ajax-install-endpoint.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-com-installer-ajax-install-endpoint.html
CVE: CVE-2020-9496
Published: 2020-07-15
Description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-502
References: http://packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.html; http://packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.html; http://packetstormsecurity.com/files/163730/Apache-OfBiz-17.12.01-Remote-Command-Execution.html
CVE: CVE-2020-15572
Published: 2020-07-15
Description: Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes; https://gitlab.torproject.org/tpo/core/tor/-/issues/33119; https://trac.torproject.org/projects/tor/wiki/TROVE