deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28912
Published: 2020-12-24
Description: With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other vendors that were originally affected by CVE-2019-2503.
CVSS Score: 7.0 (HIGH)
References: https://hackerone.com/reports/1019891; https://jira.mariadb.org/browse/MDEV-24040; https://hackerone.com/reports/1019891
CVE: CVE-2020-29247
Published: 2020-12-24
Description: WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://wondercms.com; https://systemweakness.com/cve-2020-29247-wondercms-3-1-3-page-persistent-cross-site-scripting-3dd2bb210beb; https://www.exploit-db.com/exploits/49102
CVE: CVE-2020-29472
Published: 2020-12-24
Description: EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://systemweakness.com/cve-2020-29472-under-construction-page-with-cpanel-1-0-sql-injection-18a6508c9683; https://www.exploit-db.com/exploits/49150; https://systemweakness.com/cve-2020-29472-under-construction-page-with-cpanel-1-0-sql-injection-18a6508c9683
CVE: CVE-2020-29474
Published: 2020-12-24
Description: EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://systemweakness.com/cve-2020-29474-egavilanmedia-address-book-1-0-exploit-sqli-auth-bypass-228cd4864262; https://www.exploit-db.com/exploits/49182; https://systemweakness.com/cve-2020-29474-egavilanmedia-address-book-1-0-exploit-sqli-auth-bypass-228cd4864262
CVE: CVE-2020-26282
Published: 2020-12-24
Description: BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74
References: https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578ab; https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2; https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hq
CVE: CVE-2020-35702
Published: 2020-12-25
Description: DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011
CVE: CVE-2020-35704
Published: 2020-12-25
Description: Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Bottelet/DaybydayCRM/releases; https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html; https://github.com/Bottelet/DaybydayCRM/releases
CVE: CVE-2020-35705
Published: 2020-12-25
Description: Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Bottelet/DaybydayCRM/releases; https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html; https://github.com/Bottelet/DaybydayCRM/releases
CVE: CVE-2020-35706
Published: 2020-12-25
Description: Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Bottelet/DaybydayCRM/releases; https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html; https://github.com/Bottelet/DaybydayCRM/releases
CVE: CVE-2020-35707
Published: 2020-12-25
Description: Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Bottelet/DaybydayCRM/releases; https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html; https://github.com/Bottelet/DaybydayCRM/releases
CVE: CVE-2020-35708
Published: 2020-12-25
Description: phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://sourceforge.net/projects/phplist/files/phplist/; https://tufangungor.github.io/exploit/2020/12/15/phplist-3.5.9-sql-injection.html; https://sourceforge.net/projects/phplist/files/phplist/
CVE: CVE-2020-35709
Published: 2020-12-25
Description: bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/alexlang24/bloofoxCMS/issues/7; https://github.com/alexlang24/bloofoxCMS/issues/7
CVE: CVE-2020-35710
Published: 2020-12-25
Description: Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://twitter.com/amadapa/status/[PII_REDACTED]10218753; https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html; https://twitter.com/amadapa/status/[PII_REDACTED]10218753
CVE: CVE-2020-35711
Published: 2020-12-25
Description: An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.
CVSS Score: 7.5 (HIGH)
References: https://github.com/vorner/arc-swap/issues/45; https://rustsec.org/advisories/RUSTSEC-2020-0091.html; https://github.com/vorner/arc-swap/issues/45
CVE: CVE-2020-35712
Published: 2020-12-26
Description: Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDEyODA2MA==; https://support.esri.com/en/technical-article/000022931; https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDEyODA2MA==
CVE: CVE-2020-35713
Published: 2020-12-26
Description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions; https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt; https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html
CVE: CVE-2020-35714
Published: 2020-12-26
Description: Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions; https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt; https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html
CVE: CVE-2020-35715
Published: 2020-12-26
Description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the upload_settings.cgi page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions; https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt; https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html
CVE: CVE-2020-35716
Published: 2020-12-26
Description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a long /goform/langSwitch langSelectionOnly parameter.
CVSS Score: 7.5 (HIGH)
References: https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions; https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt; https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html
CVE: CVE-2020-25917
Published: 2020-12-26
Description: Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser.do page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-669, CWE-862
References: http://packetstormsecurity.com/files/160652/Stratodesk-NoTouch-Center-Privilege-Escalation.html; http://packetstormsecurity.com/files/160652/Stratodesk-NoTouch-Center-Privilege-Escalation.html
CVE: CVE-2020-26766
Published: 2020-12-26
Description: A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management System With Admin Panel 2.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/49180; https://www.exploit-db.com/exploits/49180
CVE: CVE-2020-27515
Published: 2020-12-26
Description: A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/savsofts/savsoftquiz_v5; https://savsoftquiz.com/; https://www.exploit-db.com/exploits/49208
CVE: CVE-2020-29172
Published: 2020-12-26
Description: A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/litespeed-cache/#developers; https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration; https://wordpress.org/plugins/litespeed-cache/#developers
CVE: CVE-2020-29385
Published: 2020-12-26
Description: GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=977166; https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/blob/master/NEWS; https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164
CVE: CVE-2020-35575
Published: 2020-12-26
Description: A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/163274/TP-Link-TL-WR841N-Command-Injection.html; https://pastebin.com/F8AuUdck; https://static.tp-link.com/2020/202012/20201214/wa901ndv5_eu_3_16_9_up_boot%28201211%29.zip
CVE: CVE-2020-35388
Published: 2020-12-26
Description: rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.
CVSS Score: 7.5 (HIGH)
References: https://github.com/xuechengen/xinhu-oa/blob/main/README.md; https://github.com/xuechengen/xinhu-oa/blob/main/README.md
CVE: CVE-2020-20412
Published: 2020-12-26
Description: lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/stepmania/stepmania/issues/1890; https://github.com/stepmania/stepmania/issues/1890
CVE: CVE-2020-35346
Published: 2020-12-26
Description: CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/cbkhwx/cxuucmsv3/issues/4; https://github.com/cbkhwx/cxuucmsv3/issues/4
CVE: CVE-2020-35347
Published: 2020-12-26
Description: CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/cbkhwx/cxuucmsv3/issues/5; https://github.com/cbkhwx/cxuucmsv3/issues/5
CVE: CVE-2020-35349
Published: 2020-12-26
Description: Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49196; https://www.exploit-db.com/exploits/49196
CVE: CVE-2020-35376
Published: 2020-12-26
Description: Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42066; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZUU5QG6SSVRTKZTR3A72LDRVZETEI63/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLOYVJSM54IL6I5RY4QTJGRS7PIEG44X/
CVE: CVE-2020-35437
Published: 2020-12-26
Description: Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160783/Subrion-CMS-4.2.1-Cross-Site-Scripting.html; https://github.com/intelliants/subrion/issues/880; http://packetstormsecurity.com/files/160783/Subrion-CMS-4.2.1-Cross-Site-Scripting.html
CVE: CVE-2020-35359
Published: 2020-12-26
Description: Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.exploit-db.com/exploits/49105; https://www.exploit-db.com/exploits/49105
CVE: CVE-2020-35450
Published: 2020-12-26
Description: Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/gobby/gobby/pull/184; https://github.com/gobby/gobby/pull/184
CVE: CVE-2020-35284
Published: 2020-12-26
Description: Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product's source code is available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/balloonwj/flamingo/issues/48; https://github.com/balloonwj/flamingo/issues/48
CVE: CVE-2020-35362
Published: 2020-12-26
Description: DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker must provide the correct fileOrgName value).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/kbgsft/vuln-dext5upload/wiki/File-Download-Vulnerability-in-DEXT5Upload-2.7.1262310-by-xcuter; https://github.com/kbgsft/vuln-dext5upload/wiki/File-Download-Vulnerability-in-DEXT5Upload-2.7.1262310-by-xcuter
CVE: CVE-2020-35364
Published: 2020-12-26
Description: Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/yangfan6888/PoC; https://github.com/yangfan6888/PoC/blob/main/PoC.cpp; https://github.com/yangfan6888/PoC
CVE: CVE-2020-28759
Published: 2020-12-26
Description: The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. NOTE: another person has stated "I don't think there is an proof of overflow so far.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/OAID/Tengine/issues/476; https://github.com/OAID/Tengine/issues/476
CVE: CVE-2020-29203
Published: 2020-12-26
Description: struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/armink/struct2json/issues/13; https://github.com/armink/struct2json/issues/13
CVE: CVE-2020-35242
Published: 2020-12-26
Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/balloonwj/flamingo/issues/47; https://github.com/balloonwj/flamingo/issues/47
CVE: CVE-2020-35243
Published: 2020-12-26
Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/balloonwj/flamingo/issues/47; https://github.com/balloonwj/flamingo/issues/47
CVE: CVE-2020-35244
Published: 2020-12-26
Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/balloonwj/flamingo/issues/47; https://github.com/balloonwj/flamingo/issues/47
CVE: CVE-2020-35245
Published: 2020-12-26
Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/balloonwj/flamingo/issues/47; https://github.com/balloonwj/flamingo/issues/47
CVE: CVE-2020-35678
Published: 2020-12-27
Description: Autobahn|Python before 20.12.3 allows redirect header injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://autobahn.readthedocs.io/en/latest/changelog.html; https://github.com/crossbario/autobahn-python; https://github.com/crossbario/autobahn-python/compare/v20.12.2...v20.12.3
CVE: CVE-2020-7845
Published: 2020-12-27
Description: Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command. It leads remote attacker to execute arbitrary code via crafted packet.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.jiransecurity.com/; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35855; https://www.jiransecurity.com/
CVE: CVE-2020-8289
Published: 2020-12-27
Description: Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295, CWE-295
References: http://seclists.org/fulldisclosure/2020/Dec/57; http://seclists.org/fulldisclosure/2020/Dec/58; https://github.com/geffner/CVE-2020-8289/blob/master/README.md
CVE: CVE-2020-8290
Published: 2020-12-27
Description: Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/geffner/CVE-2020-8290/blob/master/README.md; https://hackerone.com/reports/818857; https://youtu.be/OpC6neWd2aM
CVE: CVE-2020-35448
Published: 2020-12-27
Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://security.gentoo.org/glsa/202107-24; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=26574
CVE: CVE-2020-35728
Published: 2020-12-27
Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/FasterXML/jackson-databind/issues/2999; https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html; https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062