deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-21217
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, and R6100 before 1.0.1.20.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055120/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2484; https://kb.netgear.com/000055120/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2484
CVE: CVE-2018-21218
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055119/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2483; https://kb.netgear.com/000055119/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2483
CVE: CVE-2018-21219
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055118/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2482; https://kb.netgear.com/000055118/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2482
CVE: CVE-2018-21220
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055117/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2481; https://kb.netgear.com/000055117/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2481
CVE: CVE-2016-11057
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://kb.netgear.com/29960/NETGEAR-Product-Vulnerability-Advisory-Potential-security-issue-associated-with-remote-management; https://kb.netgear.com/29960/NETGEAR-Product-Vulnerability-Advisory-Potential-security-issue-associated-with-remote-management
CVE: CVE-2016-11058
Published: 2020-04-28
Description: The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://kb.netgear.com/30922/NETGEAR-genie-App-for-Android-Hard-coded-API-Key-and-Session-ID-Vulnerability; https://kb.netgear.com/30922/NETGEAR-genie-App-for-Android-Hard-coded-API-Key-and-Session-ID-Vulnerability
CVE: CVE-2016-11059
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by password exposure. This affects AC1450 before 2017-01-06, C6300 before 2017-01-06, D500 before 2017-01-06, D1500 before 2017-01-06, D3600 before 2017-01-06, D6000 before 2017-01-06, D6100 before 2017-01-06, D6200 before 2017-01-06, D6200B before 2017-01-06, D6300B before 2017-01-06, D6300 before 2017-01-06, DGN1000v3 before 2017-01-06, DGN2200v1 before 2017-01-06, DGN2200v3 before 2017-01-06, DGN2200V4 before 2017-01-06, DGN2200Bv3 before 2017-01-06, DGN2200Bv4 before 2017-01-06, DGND3700v1 before 2017-01-06, DGND3700v2 before 2017-01-06, DGND3700Bv2 before 2017-01-06, JNR1010v1 before 2017-01-06, JNR1010v2 before 2017-01-06, JNR3300 before 2017-01-06, JR6100 before 2017-01-06, JR6150 before 2017-01-06, JWNR2000v5 before 2017-01-06, R2000 before 2017-01-06, R6050 before 2017-01-06, R6100 before 2017-01-06, R6200 before 2017-01-06, R6200v2 before 2017-01-06, R6220 before 2017-01-06, R6250 before 2017-01-06, R6300 before 2017-01-06, R6300v2 before 2017-01-06, R6700 before 2017-01-06, R7000 before 2017-01-06, R7900 before 2017-01-06, R7500 before 2017-01-06, R8000 before 2017-01-06, WGR614v10 before 2017-01-06, WNR1000v2 before 2017-01-06, WNR1000v3 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2000v3 before 2017-01-06, WNR2000v4 before 2017-01-06, WNR2000v5 before 2017-01-06, WNR2200 before 2017-01-06, WNR2500 before 2017-01-06, WNR3500Lv2 before 2017-01-06, WNDR3400v2 before 2017-01-06, WNDR3400v3 before 2017-01-06, WNDR3700v3 before 2017-01-06, WNDR3700v4 before 2017-01-06, WNDR3700v5 before 2017-01-06, WNDR4300 before 2017-01-06, WNDR4300v2 before 2017-01-06, WNDR4500v1 before 2017-01-06, WNDR4500v2 before 2017-01-06, and WNDR4500v3 before 2017-01-06.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://kb.netgear.com/27253/NETGEAR-Product-Vulnerability-Advisory-Authentication-Bypass-and-Information-Disclosure-on-Home-Routers; https://kb.netgear.com/27253/NETGEAR-Product-Vulnerability-Advisory-Authentication-Bypass-and-Information-Disclosure-on-Home-Routers
CVE: CVE-2016-11060
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by insecure renegotiation. This affects SRX5308 before 2017-02-10, FVS336Gv3 before 2017-02-10, FVS318N before 2017-02-10, and FVS318Gv2 before 2017-02-10.
CVSS Score: 7.5 (HIGH)
References: https://kb.netgear.com/31426/SSL-Renegotiation-Denial-of-Service-Vulnerability; https://kb.netgear.com/31426/SSL-Renegotiation-Denial-of-Service-Vulnerability
CVE: CVE-2017-18857
Published: 2020-04-28
Description: The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://kb.netgear.com/000038799/Security-Fix-for-Password-Management-in-NETGEAR-Insight-App-PSV-2017-1978; https://kb.netgear.com/000038799/Security-Fix-for-Password-Management-in-NETGEAR-Insight-App-PSV-2017-1978
CVE: CVE-2017-18858
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by command execution. This affects M4200-10MG-POE+ 12.0.2.11 and earlier, M4300-28G 12.0.2.11 and earlier, M4300-52G 12.0.2.11 and earlier, M4300-28G-POE+ 12.0.2.11 and earlier, M4300-52G-POE+ 12.0.2.11 and earlier, M4300-8X8F 12.0.2.11 and earlier, M4300-12X12F 12.0.2.11 and earlier, M4300-24X24F 12.0.2.11 and earlier, M4300-24X 12.0.2.11 and earlier, and M4300-48X 12.0.2.11 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://kb.netgear.com/000038655/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-M4200-and-M4300-PSV-2017-1971; https://kb.netgear.com/000038655/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-M4200-and-M4300-PSV-2017-1971
CVE: CVE-2017-18859
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by slowdown/stoppage. This affects C6300 before 2017-05-30, CM400 before 2017-05-30, CM700 before 2017-05-30, and CMD31T before 2017-05-30.
CVSS Score: 7.5 (HIGH)
References: https://kb.netgear.com/000038560/Security-Advisory-for-Vulnerability-on-Select-Cable-Modems-and-Gateways-PSV-2017-2165; https://kb.netgear.com/000038560/Security-Advisory-for-Vulnerability-on-Select-Cable-Modems-and-Gateways-PSV-2017-2165
CVE: CVE-2018-21221
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, and R9000 before 1.0.2.52.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055116/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2459; https://kb.netgear.com/000055116/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2459
CVE: CVE-2018-21222
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055115/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2458; https://kb.netgear.com/000055115/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2458
CVE: CVE-2018-21223
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055114/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2457; https://kb.netgear.com/000055114/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2457
CVE: CVE-2018-21224
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000055113/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2456; https://kb.netgear.com/000055113/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2456
CVE: CVE-2018-21225
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0.3.39, R6700 before 1.0.1.30, R6700v2 before 1.2.0.16, R6800 before 1.2.0.16, R6900 before 1.0.1.30, R6900P before 1.2.0.22, R6900v2 before 1.2.0.16, R7000 before 1.0.9.12, R7000P before 1.2.0.22, R7500v2 before 1.0.3.20, R7800 before 1.0.2.44, R8300 before 1.0.2.106, R8500 before 1.0.2.106, and R9000 before 1.0.2.52.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://kb.netgear.com/000055112/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2017-2160; https://kb.netgear.com/000055112/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2017-2160
CVE: CVE-2018-21226
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by authentication bypass. This affects JNR1010v2 before 1.1.0.48, JWNR2010v5 before 1.1.0.48, WNR1000v4 before 1.1.0.48, WNR2020 before 1.1.0.48, and WNR2050 before 1.1.0.48.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://kb.netgear.com/000055110/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0748; https://kb.netgear.com/000055110/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0748
CVE: CVE-2019-20791
Published: 2020-04-28
Description: OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19386; https://github.com/openthread/openthread/commit/b8c3161281f8e15873f8decabd8eac461717aefe; https://github.com/openthread/openthread/commit/c3a3a0c424322009fec3ab735fb20ce8f6e19e70
CVE: CVE-2020-10641
Published: 2020-04-28
Description: An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway (versions prior to 8.0.10), causing a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsa-20-112-01; https://www.us-cert.gov/ics/advisories/icsa-20-112-01
CVE: CVE-2020-12243
Published: 2020-04-28
Description: In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html; https://bugs.openldap.org/show_bug.cgi?id=9202; https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES
CVE: CVE-2020-7644
Published: 2020-04-28
Description: fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1321
References: https://github.com/nathan7/fun-map/blob/master/index.js#L137%2C; https://snyk.io/vuln/SNYK-JS-FUNMAP-564436; https://github.com/nathan7/fun-map/blob/master/index.js#L137%2C
CVE: CVE-2020-9482
Published: 2020-04-28
Description: If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://nifi.apache.org/registry-security.html#CVE-2020-9482; https://nifi.apache.org/registry-security.html#CVE-2020-9482
CVE: CVE-2019-15876
Published: 2020-04-28
Description: In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc
CVE: CVE-2019-15877
Published: 2020-04-28
Description: In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to trigger updates to the device's non-volatile memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:06.if_ixl_ioctl.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:06.if_ixl_ioctl.asc
CVE: CVE-2020-11014
Published: 2020-04-28
Description: Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.
CVSS Score: 6.1 (MEDIUM)
References: https://github.com/kristovatlas/rfc/blob/master/bips/bip-li01.mediawiki; https://github.com/simpleledger/Electron-Cash-SLP/commit/ea3912c3d508ba81b280ef7d78648464f7f76fb8; https://github.com/simpleledger/Electron-Cash-SLP/issues/126
CVE: CVE-2020-12429
Published: 2020-04-28
Description: Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass in the login pages: admin/change-password.php, admin/check_availability.php, admin/index.php, change-password.php, check_availability.php, includes/header.php, index.php, and pincode-verification.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/48385; https://www.exploit-db.com/exploits/48385
CVE: CVE-2020-12430
Published: 2020-04-28
Description: An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1804548; https://bugzilla.redhat.com/show_bug.cgi?id=1828190; https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581
CVE: CVE-2020-7451
Published: 2020-04-28
Description: In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE-p7, a TCP SYN-ACK or challenge TCP-ACK segment over IPv6 that is transmitted or retransmitted does not properly initialize the Traffic Class field disclosing one byte of kernel memory over the network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-908
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:04.tcp.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:04.tcp.asc
CVE: CVE-2020-10663
Published: 2020-04-28
Description: The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html; http://seclists.org/fulldisclosure/2020/Dec/32; https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
CVE: CVE-2020-12102
Published: 2020-04-28
Description: In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the filesystem (outside of the application scope).
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/; https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06; https://github.com/prasathmani/tinyfilemanager/issues/357
CVE: CVE-2020-12438
Published: 2020-04-28
Description: An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8; https://github.com/php-fusion/PHP-Fusion/issues/2307; https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8
CVE: CVE-2020-12103
Published: 2020-04-28
Description: In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/; https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06; https://github.com/prasathmani/tinyfilemanager/issues/357
CVE: CVE-2020-12261
Published: 2020-04-28
Description: Open-AudIT 3.3.0 allows an XSS attack after login.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/157401/Open-AudIT-3.3.0-Cross-Site-Scripting.html; https://community.opmantek.com/display/OA/Errata+-+3.3.0+XSS+in+error+templates; https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.1
CVE: CVE-2020-12442
Published: 2020-04-28
Description: Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://forums.ivanti.com/s/article/SQL-Injection-Vulnerability-in-Avalanche; https://forums.ivanti.com/s/article/SQL-Injection-Vulnerability-in-Avalanche
CVE: CVE-2019-15874
Published: 2020-04-29
Description: In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in memory access after it has been freed leading to a kernel panic or other unpredictable results.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-416
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc
CVE: CVE-2019-5614
Published: 2020-04-29
Description: In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in accessing out-of-bounds memory leading to a kernel panic or other unpredictable results.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-119
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc
CVE: CVE-2020-7452
Published: 2020-04-29
Description: In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE-p7, incorrect use of a user-controlled pointer in the epair virtual network module allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc