deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26503
Published: 2022-03-17
Description: Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://veeam.com; https://www.veeam.com/kb4289; https://veeam.com
CVE: CVE-2022-25949
Published: 2022-03-17
Description: The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://jvn.jp/en/jp/JVN21234459/; https://support.kingsoft.jp/support-info/weakness.html; https://jvn.jp/en/jp/JVN21234459/
CVE: CVE-2022-25969
Published: 2022-03-17
Description: The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://jvn.jp/en/jp/JVN21234459/; https://support.kingsoft.jp/support-info/weakness.html; https://jvn.jp/en/jp/JVN21234459/
CVE: CVE-2022-26081
Published: 2022-03-17
Description: The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://jvn.jp/en/jp/JVN21234459/; https://support.kingsoft.jp/support-info/weakness.html; https://jvn.jp/en/jp/JVN21234459/
CVE: CVE-2022-26511
Published: 2022-03-17
Description: WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading).
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://jvn.jp/en/jp/JVN21234459/; https://support.kingsoft.jp/support-info/weakness.html; https://jvn.jp/en/jp/JVN21234459/
CVE: CVE-2021-44907
Published: 2022-03-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45040
Published: 2022-03-17
Description: The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cybersecthreat.com/2022/03/14/cve-2021-45040/; https://spatie.be/docs/laravel-medialibrary/v9/handling-uploads-with-media-library-pro/processing-uploads-on-the-server; https://cybersecthreat.com/2022/03/14/cve-2021-45040/
CVE: CVE-2021-46107
Published: 2022-03-17
Description: Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/; https://raw.githubusercontent.com/Orange-Cyberdefense/CVE-repository/master/PoCs/POC_CVE-2021-46107.py; https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
CVE: CVE-2022-21822
Published: 2022-03-17
Description: NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47; https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47
CVE: CVE-2022-24770
Published: 2022-03-17
Description: `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://github.com/gradio-app/gradio/commit/80fea89117358ee105973453fdc402398ae20239; https://github.com/gradio-app/gradio/pull/817; https://github.com/gradio-app/gradio/security/advisories/GHSA-f8xq-q7px-wg8c
CVE: CVE-2022-26500
Published: 2022-03-17
Description: Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://veeam.com; https://www.veeam.com/kb4288; https://veeam.com
CVE: CVE-2022-26501
Published: 2022-03-17
Description: Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://veeam.com; https://www.veeam.com/kb4288; https://veeam.com
CVE: CVE-2022-26504
Published: 2022-03-17
Description: Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://veeam.com; https://www.veeam.com/kb4290; https://veeam.com
CVE: CVE-2021-43961
Published: 2022-03-17
Description: Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://issues.sonatype.org/secure/ReleaseNote.jspa; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]307; https://issues.sonatype.org/secure/ReleaseNote.jspa
CVE: CVE-2021-44087
Published: 2022-03-17
Description: A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to upload a maliciously crafted PHP via photo upload.
CVSS Score: 9.8 (CRITICAL)
References: http://sourcecodester.com; https://www.exploit-db.com/exploits/50801; https://www.sourcecodester.com/sites/default/files/download/oretnom23/apsystem.zip
CVE: CVE-2021-44088
Published: 2022-03-17
Description: An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://sourcecodester.com; https://www.exploit-db.com/exploits/50802; https://www.sourcecodester.com/sites/default/files/download/oretnom23/apsystem.zip
CVE: CVE-2022-24302
Published: 2022-03-17
Description: In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546; https://lists.debian.org/debian-lts-announce/2022/03/msg00032.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00013.html
CVE: CVE-2022-0237
Published: 2022-03-17
Description: Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264, CWE-428
References: https://docs.rapid7.com/release-notes/insightagent/20220225/; https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251; https://docs.rapid7.com/release-notes/insightagent/20220225/
CVE: CVE-2022-0757
Published: 2022-03-17
Description: Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in the SearchCriteria and inject SQL code. This issue was fixed in Rapid7 Nexpose version 6.6.129.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://docs.rapid7.com/release-notes/nexpose/20220302/; https://docs.rapid7.com/release-notes/nexpose/20220302/
CVE: CVE-2022-0758
Published: 2022-03-17
Description: Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the tool. With this vulnerability an attacker could pass literal values as the test credentials, providing the opportunity for a potential XSS attack. This issue is fixed in Rapid7 Nexpose version 6.6.130.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://docs.rapid7.com/release-notes/nexpose/20220309/; https://docs.rapid7.com/release-notes/nexpose/20220309/
CVE: CVE-2021-45966
Published: 2022-03-18
Description: An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://kerbit.io/research/read/blog/4; https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html; https://www.pascom.net/doc/en/release-notes/
CVE: CVE-2021-45967
Published: 2022-03-18
Description: An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://kerbit.io/research/read/blog/4; https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html; https://www.pascom.net/doc/en/release-notes/
CVE: CVE-2021-45968
Published: 2022-03-18
Description: An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://jivesoftware.com/platform/; https://kerbit.io/research/read/blog/4; https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
CVE: CVE-2022-27240
Published: 2022-03-18
Description: scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/babelouest/glewlwyd/commit/4c5597c155bfbaf6491cf6b83479d241ae66940a; https://github.com/babelouest/glewlwyd/releases/tag/v2.6.2; https://github.com/babelouest/glewlwyd/commit/4c5597c155bfbaf6491cf6b83479d241ae66940a
CVE: CVE-2021-45868
Published: 2022-03-18
Description: In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.kernel.org/show_bug.cgi?id=214655; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050
CVE: CVE-2022-26965
Published: 2022-03-18
Description: In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://packetstormsecurity.com/files/166336/Pluck-CMS-4.7.16-Shell-Upload.html; https://youtu.be/sN6J_X4mEbY; https://packetstormsecurity.com/files/166336/Pluck-CMS-4.7.16-Shell-Upload.html
CVE: CVE-2022-27191
Published: 2022-03-18
Description: The golang.org/x/crypto/ssh package before 0.0.0[PII_REDACTED]4659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS Score: 7.5 (HIGH)
References: https://groups.google.com/g/golang-announce; https://groups.google.com/g/golang-announce/c/-cp44ypCT5s; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
CVE: CVE-2021-22571
Published: 2022-03-18
Description: A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery. We recommend upgrading to version 1.0.3 or above.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-275, CWE-276
References: https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7fjx-657r-9r5h; https://github.com/google/sa360-webquery-bigquery/pull/15; https://github.com/google/sa360-webquery-bigquery/releases/tag/v1.0.3
CVE: CVE-2021-45834
Published: 2022-03-18
Description: An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://opendocman.com; https://github.com/opendocman/opendocman; https://github.com/opendocman/opendocman/issues/326
CVE: CVE-2021-45835
Published: 2022-03-18
Description: The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/rskoolrash/Online-Admission-System; https://github.com/rskoolrash/Online-Admission-System/issues/2; https://www.exploit-db.com/exploits/50623
CVE: CVE-2022-24655
Published: 2022-03-18
Description: A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lead to the execution of arbitrary code without authentication.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/doudoudedi/Netgear_product_stack_overflow/blob/main/NETGEAR%20EX%20series%20upnpd%20stack_overflow.md; https://kb.netgear.com/000064615/Security-Advisory-for-Pre-Authentication-Command-Injection-on-EX6100v1-and-Pre-Authentication-Stack-Overflow-on-Multiple-Products-PSV-2021-0282-PSV-2021-0288; https://www.netgear.com/about/security/
CVE: CVE-2022-0742
Published: 2022-03-18
Description: Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-275, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d3916f3189172d5c69d33065c3c21119fe539fc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2022/03/15/3
CVE: CVE-2022-24595
Published: 2022-03-18
Description: Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required.
CVSS Score: 9.8 (CRITICAL)
References: https://youtu.be/E-ZTuWSg-JU; https://youtu.be/E-ZTuWSg-JU
CVE: CVE-2022-24771
Published: 2022-03-18
Description: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1; https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765; https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
CVE: CVE-2022-24772
Published: 2022-03-18
Description: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1; https://github.com/digitalbazaar/forge/commit/bb822c02df0b[PII_REDACTED]2e29b9790cc541cdb2; https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g
CVE: CVE-2022-24773
Published: 2022-03-18
Description: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1; https://github.com/digitalbazaar/forge/commit/bb822c02df0b[PII_REDACTED]2e29b9790cc541cdb2; https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr
CVE: CVE-2021-29899
Published: 2022-03-18
Description: IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207413; https://www.ibm.com/support/pages/node/6564317; https://exchange.xforce.ibmcloud.com/vulnerabilities/207413
CVE: CVE-2021-39046
Published: 2022-03-18
Description: IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can be read by a lprivileged user. IBM X-Force ID: 214346.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214346; https://www.ibm.com/support/pages/node/6564387; https://exchange.xforce.ibmcloud.com/vulnerabilities/214346
CVE: CVE-2022-24637
Published: 2022-03-18
Description: Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html; http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html; https://devel0pment.de/?p=2494
CVE: CVE-2020-15388
Published: 2022-03-18
Description: A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the history command to write arbitrary content to files.
CVSS Score: 6.5 (MEDIUM)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1493; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1493
CVE: CVE-2020-16232
Published: 2022-03-18
Description: In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file.
CVSS Score: 2.8 (LOW)
CWE: CWE-120, CWE-120
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-273-02; https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/; https://www.cisa.gov/uscert/ics/advisories/icsa-20-273-02
CVE: CVE-2020-25176
Published: 2022-03-18
Description: Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699; https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
CVE: CVE-2020-25178
Published: 2022-03-18
Description: ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699; https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
CVE: CVE-2020-25180
Published: 2022-03-18
Description: Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699; https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
CVE: CVE-2020-25182
Published: 2022-03-18
Description: Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699; https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01