deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8011
Published: 2020-01-28
Description: Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2015/10/16/2; http://www.openwall.com/lists/oss-security/2015/10/30/2; https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
CVE: CVE-2015-8012
Published: 2020-01-28
Description: lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2015/10/18/2; http://www.openwall.com/lists/oss-security/2015/10/30/2; https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c[PII_REDACTED]7a00
CVE: CVE-2019-17338
Published: 2020-01-28
Description: The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Patterns - Search: versions 5.4.0 and below.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2020/01/tibco-security-advisory-january-28-2020-tibco-patterns; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-4568
Published: 2020-01-28
Description: IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of service when receiving data on the channel. IBM X-Force ID: 166629.
CVSS Score: 5.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166629; https://www.ibm.com/support/pages/node/1106517; https://exchange.xforce.ibmcloud.com/vulnerabilities/166629
CVE: CVE-2019-4614
Published: 2020-01-28
Description: IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid message. IBM X-Force ID: 168639.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168639; https://www.ibm.com/support/pages/node/1106523; https://exchange.xforce.ibmcloud.com/vulnerabilities/168639
CVE: CVE-2019-4620
Published: 2020-01-28
Description: IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. IBM X-Force ID: 168863.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168863; https://www.ibm.com/support/pages/node/1125891; https://exchange.xforce.ibmcloud.com/vulnerabilities/168863
CVE: CVE-2019-4631
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 170001.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170001; https://www.ibm.com/support/pages/node/1283224; https://exchange.xforce.ibmcloud.com/vulnerabilities/170001
CVE: CVE-2019-4632
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170004; https://www.ibm.com/support/pages/node/1283254; https://exchange.xforce.ibmcloud.com/vulnerabilities/170004
CVE: CVE-2019-4633
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170007; https://www.ibm.com/support/pages/node/1283200; https://exchange.xforce.ibmcloud.com/vulnerabilities/170007
CVE: CVE-2019-4635
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elements. IBM X-Force ID: 170011.
CVSS Score: 2.7 (LOW)
CWE: CWE-77
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170011; https://www.ibm.com/support/pages/node/1283212; https://exchange.xforce.ibmcloud.com/vulnerabilities/170011
CVE: CVE-2019-4636
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170013; https://www.ibm.com/support/pages/node/1283260; https://exchange.xforce.ibmcloud.com/vulnerabilities/170013
CVE: CVE-2019-4637
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170043; https://www.ibm.com/support/pages/node/1283242; https://exchange.xforce.ibmcloud.com/vulnerabilities/170043
CVE: CVE-2019-4638
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.
CVSS Score: 3.7 (LOW)
CWE: CWE-565
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170044; https://www.ibm.com/support/pages/node/1283236; https://exchange.xforce.ibmcloud.com/vulnerabilities/170044
CVE: CVE-2019-4639
Published: 2020-01-28
Description: IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 170045.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170045; https://www.ibm.com/support/pages/node/1283194; https://exchange.xforce.ibmcloud.com/vulnerabilities/170045
CVE: CVE-2019-4679
Published: 2020-01-28
Description: IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171515; https://www.ibm.com/support/pages/node/1283458; https://exchange.xforce.ibmcloud.com/vulnerabilities/171515
CVE: CVE-2019-4707
Published: 2020-01-28
Description: IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172018; https://www.ibm.com/support/pages/node/1284034; https://exchange.xforce.ibmcloud.com/vulnerabilities/172018
CVE: CVE-2020-4207
Published: 2020-01-28
Description: IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking when handling a failed HTTP request with specific content in the headers. By sending a specially crafted HTTP request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service. IBM X-Force ID: 174972.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174972; https://www.ibm.com/support/pages/node/1283626; https://exchange.xforce.ibmcloud.com/vulnerabilities/174972
CVE: CVE-2020-5211
Published: 2020-01-28
Description: In NetHack before 3.6.5, an invalid extended command in value for the AUTOCOMPLETE configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/NetHack/NetHack/security/advisories/GHSA-r788-4jf4-r9f7; https://github.com/NetHack/NetHack/security/advisories/GHSA-r788-4jf4-r9f7
CVE: CVE-2020-8315
Published: 2020-01-28
Description: In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-427
References: https://bugs.python.org/issue39401; https://bugs.python.org/issue39401
CVE: CVE-2013-1599
Published: 2020-01-28
Description: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.exploit-db.com/exploits/25138; http://www.securityfocus.com/bid/59564; https://exchange.xforce.ibmcloud.com/vulnerabilities/83941
CVE: CVE-2013-2714
Published: 2020-01-28
Description: Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/58421; http://www.securityfocus.com/bid/58421
CVE: CVE-2013-2748
Published: 2020-01-28
Description: Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.exploit-db.com/exploits/24924; http://www.securityfocus.com/bid/58929; https://exchange.xforce.ibmcloud.com/vulnerabilities/83296
CVE: CVE-2013-2764
Published: 2020-01-28
Description: Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct phishing attacks due to HSP_AbsoluteRedirects being disabled by default.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/64422; https://exchange.xforce.ibmcloud.com/vulnerabilities/89853; http://www.securityfocus.com/bid/64422
CVE: CVE-2014-8490
Published: 2020-01-28
Description: Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML via the pid parameter to index.cfm.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/83; http://tetraph.com/security/cves/cve-2014-8490-tennisconnect-components-system-xss-cross-site-scripting-security-vulnerability/; http://seclists.org/fulldisclosure/2014/Dec/83
CVE: CVE-2015-5483
Published: 2020-01-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133349/WordPress-Private-Only-3.5.1-CSRF-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Aug/77; https://security.dxw.com/advisories/csrfxss-vulnerability-in-private-only-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/
CVE: CVE-2013-1600
Published: 2020-01-28
Description: An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-2121 1.06_FR, 1.06, and 1.05_RU, DCS-2102 1.06_FR. 1.06, and 1.05_RU, which could let a malicious user obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/59566; https://exchange.xforce.ibmcloud.com/vulnerabilities/83916; https://packetstormsecurity.com/files/cve/CVE-2013-1600
CVE: CVE-2013-1601
Published: 2020-01-28
Description: An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03, which could let a malicious user obtain sensitive information. which could let a malicious user obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/59570; https://exchange.xforce.ibmcloud.com/vulnerabilities/83939; https://packetstormsecurity.com/files/cve/CVE-2013-1601
CVE: CVE-2013-3071
Published: 2020-01-28
Description: NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.securityfocus.com/bid/59406; https://www.securityfocus.com/bid/59406
CVE: CVE-2013-3074
Published: 2020-01-28
Description: NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.securityfocus.com/bid/59303; https://www.securityfocus.com/bid/59303
CVE: CVE-2013-3093
Published: 2020-01-28
Description: ASUS RT-N56U devices allow CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.securityfocus.com/archive/1/531194; https://www.securityfocus.com/archive/1/531194
CVE: CVE-2013-3212
Published: 2020-01-28
Description: vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: http://www.exploit-db.com/exploits/27279; http://www.securityfocus.com/bid/61560; https://exchange.xforce.ibmcloud.com/vulnerabilities/86162
CVE: CVE-2013-3214
Published: 2020-01-28
Description: vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.exploit-db.com/exploits/30787; http://www.securityfocus.com/bid/61558; https://exchange.xforce.ibmcloud.com/vulnerabilities/86164
CVE: CVE-2020-8417
Published: 2020-01-28
Description: The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/code-snippets/#developers; https://wpvulndb.com/vulnerabilities/10050; https://wordpress.org/plugins/code-snippets/#developers
CVE: CVE-2020-8419
Published: 2020-01-28
Description: An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-batch-actions; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-batch-actions
CVE: CVE-2020-8420
Published: 2020-01-28
Description: An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-csrf-com-templates-less-compiler; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-csrf-com-templates-less-compiler
CVE: CVE-2020-8421
Published: 2020-01-28
Description: An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-com-actionlogs; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-com-actionlogs
CVE: CVE-2013-1602
Published: 2020-01-28
Description: An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/59569; https://exchange.xforce.ibmcloud.com/vulnerabilities/83942; https://packetstormsecurity.com/files/cve/CVE-2013-1602
CVE: CVE-2013-1603
Published: 2020-01-28
Description: An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: http://www.securityfocus.com/bid/59571; https://exchange.xforce.ibmcloud.com/vulnerabilities/83940; https://packetstormsecurity.com/files/cve/CVE-2013-1603
CVE: CVE-2020-5215
Published: 2020-01-28
Description: In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar tf.float16 value with a scalar string will trigger this issue due to automatic conversions. This can be easily reproduced by tf.constant("hello", tf.float16), if eager execution is enabled. This issue is patched in TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched. TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected. Users are encouraged to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-754, CWE-20
References: https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf; https://github.com/tensorflow/tensorflow/releases/tag/v1.15.2; https://github.com/tensorflow/tensorflow/releases/tag/v2.0.1
CVE: CVE-2020-5227
Published: 2020-01-28
Description: Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-776, CWE-776
References: https://docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses; https://github.com/lkiesow/python-feedgen/commit/f57a01b20fa4aaaeccfa417f28e66b4084b9d0cf; https://github.com/lkiesow/python-feedgen/security/advisories/GHSA-g8q7-xv52-hf9f
CVE: CVE-2020-8424
Published: 2020-01-28
Description: Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/156140/Cups-Easy-1.0-Cross-Site-Request-Forgery.html; https://github.com/J3rryBl4nks/CUPSEasyExploits; http://packetstormsecurity.com/files/156140/Cups-Easy-1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2020-8425
Published: 2020-01-28
Description: Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/156140/Cups-Easy-1.0-Cross-Site-Request-Forgery.html; https://github.com/J3rryBl4nks/CUPSEasyExploits; http://packetstormsecurity.com/files/156140/Cups-Easy-1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2020-8426
Published: 2020-01-28
Description: The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.impenetrable.tech/xss-in-wordpress-elementor-plugin; https://wordpress.org/plugins/elementor/#developers; https://wpvulndb.com/vulnerabilities/10051
CVE: CVE-2020-8428
Published: 2020-01-29
Description: fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html; http://www.openwall.com/lists/oss-security/2020/01/28/4