deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5577
Published: 2020-05-14
Description: Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allow remote authenticated attackers to upload arbitrary files and execute a php script via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://jvn.jp/en/jp/JVN28806943/index.html; https://movabletype.org/news/2020/05/mt[PII_REDACTED]-released.html; https://jvn.jp/en/jp/JVN28806943/index.html
CVE: CVE-2020-12717
Published: 2020-05-14
Description: The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.
CVSS Score: 6.5 (MEDIUM)
References: https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708; https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708
CVE: CVE-2019-15083
Published: 2020-05-14
Description: Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/48473; https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105
CVE: CVE-2020-10626
Published: 2020-05-14
Description: In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.us-cert.gov/ics/advisories/ICSA2012601; https://www.us-cert.gov/ics/advisories/ICSA2012601
CVE: CVE-2020-1945
Published: 2020-05-14
Description: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html; http://www.openwall.com/lists/oss-security/2020/09/30/6; http://www.openwall.com/lists/oss-security/2020/12/06/1
CVE: CVE-2020-4257
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175635.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175635; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175635
CVE: CVE-2020-4258
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175637.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175637; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175637
CVE: CVE-2020-4259
Published: 2020-05-14
Description: IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cookie to access functionality not authorized to. IBM X-Force ID: 175638.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175638; https://www.ibm.com/support/pages/node/6208038; https://exchange.xforce.ibmcloud.com/vulnerabilities/175638
CVE: CVE-2020-4261
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175644.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175644; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175644
CVE: CVE-2020-4262
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175645.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175645; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175645
CVE: CVE-2020-4263
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175646.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175646; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175646
CVE: CVE-2020-4264
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175647.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175647; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175647
CVE: CVE-2020-4265
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175648.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175648; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175648
CVE: CVE-2020-4266
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175649.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175649; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/175649
CVE: CVE-2020-4285
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 176266
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176266; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/176266
CVE: CVE-2020-4287
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 176269.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176269; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/176269
CVE: CVE-2020-4288
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 176270.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176270; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/176270
CVE: CVE-2020-4299
Published: 2020-05-14
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafted HTTP request. IBM X-Force ID: 176606.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176606; https://www.ibm.com/support/pages/node/6208041; https://exchange.xforce.ibmcloud.com/vulnerabilities/176606
CVE: CVE-2020-4343
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 178244.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178244; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/178244
CVE: CVE-2020-4365
Published: 2020-05-14
Description: IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178964; https://www.ibm.com/support/pages/node/6209099; https://exchange.xforce.ibmcloud.com/vulnerabilities/178964
CVE: CVE-2020-4422
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 180167.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180167; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/180167
CVE: CVE-2020-4467
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 181721.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181721; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/181721
CVE: CVE-2020-4468
Published: 2020-05-14
Description: IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 181723.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181723; https://www.ibm.com/support/pages/node/6209081; https://exchange.xforce.ibmcloud.com/vulnerabilities/181723
CVE: CVE-2019-13021
Published: 2020-05-14
Description: The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwords is made as part of the installation script, after the administrator has generated a password using ENCtool.jar (see CVE-2019-13022). This allows any low-privilege user who can read this file to trivially obtain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the encoded password hash is /opt/JetSelect/SFC/resources/sfc-general-properties.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/; https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/
CVE: CVE-2019-13022
Published: 2020-05-14
Description: Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/; https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/
CVE: CVE-2019-13023
Published: 2020-05-14
Description: An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RADIUS secrets, WPA passwords, and SNMP strings from 'non administrative' users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/; https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/
CVE: CVE-2019-17562
Published: 2020-05-14
Description: A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://lists.apache.org/thread.html/rcbaafc6ae1f32e8f1e5987c243a26faf83c5172348ee7c17a54ea7f9%40%3Cusers.cloudstack.apache.org%3E; https://lists.apache.org/thread.html/rcbaafc6ae1f32e8f1e5987c243a26faf83c5172348ee7c17a54ea7f9%40%3Cusers.cloudstack.apache.org%3E
CVE: CVE-2019-17572
Published: 2020-05-14
Description: In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E; https://seclists.org/oss-sec/2020/q2/112; https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E
CVE: CVE-2020-11971
Published: 2020-05-14
Description: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2020/05/14/7; https://camel.apache.org/security/CVE-2020-11971.html; https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9%40%3Ccommits.camel.apache.org%3E
CVE: CVE-2020-11972
Published: 2020-05-14
Description: Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2020/05/14/10; http://www.openwall.com/lists/oss-security/2020/05/14/8; https://camel.apache.org/security/CVE-2020-11972.html
CVE: CVE-2020-11973
Published: 2020-05-14
Description: Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2020/05/14/9; https://camel.apache.org/security/CVE-2020-11973.html; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2020-1941
Published: 2020-05-14
Description: In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://activemq.apache.org/security-advisories.data/CVE-2020-1941-announcement.txt; https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E; https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
CVE: CVE-2020-1960
Published: 2020-05-14
Description: A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.
CVSS Score: 4.7 (MEDIUM)
References: https://lists.apache.org/thread.html/r23e559dee1e69741557b5fe431846de1f1a5981356d0ddb9482df88a%40%3Cdev.flink.apache.org%3E; https://lists.apache.org/thread.html/r26fcdd4fe[PII_REDACTED]53437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3E; https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3E
CVE: CVE-2020-12677
Published: 2020-05-14
Description: An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3, 2018 SP1 - 2018.2 prior to 2018.2.3, 2018 SP2 - 2018.3 prior to 2018.3.7, 2019 - 2019.0 prior to 2019.0.3, 2019.1 - 2019.1 prior to 2019.1.2, and 2019.2 - 2019.2 prior to 2019.2.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.progress.com/s/article/MOVEit-Automation-Cross-Site-Scripting-Vulnerability-XSS-May-2020; https://docs.ipswitch.com/MOVEit/Automation2018/ReleaseNotes/en/index.htm#33958.htm; https://docs.ipswitch.com/MOVEit/Automation2018SP1/ReleaseNotes/en/index.htm#33958.htm
CVE: CVE-2020-5408
Published: 2020-05-14
Description: Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-329, CWE-330
References: https://tanzu.vmware.com/security/cve-2020-5408; https://www.oracle.com/security-alerts/cpuApr2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2020-12874
Published: 2020-05-14
Description: Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication credentials were provided to the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.veritas.com/content/support/en_US/security/VTS20-003; https://www.veritas.com/content/support/en_US/security/VTS20-003
CVE: CVE-2020-12875
Published: 2020-05-14
Description: Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive information or functionality by manipulating specific parameters within the application.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://www.veritas.com/content/support/en_US/security/VTS20-003; https://www.veritas.com/content/support/en_US/security/VTS20-003