deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15220
Published: 2021-01-13
Description: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-613
References: https://github.com/Combodo/iTop/security/advisories/GHSA-qw4q-cmcv-7vv2; https://github.com/Combodo/iTop/security/advisories/GHSA-qw4q-cmcv-7vv2
CVE: CVE-2020-15221
Published: 2021-01-13
Description: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw; https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw
CVE: CVE-2020-35687
Published: 2021-01-13
Description: PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/PHPFusion/PHPFusion/issues/2347; https://www.exploit-db.com/exploits/49426; https://github.com/PHPFusion/PHPFusion/issues/2347
CVE: CVE-2021-3028
Published: 2021-01-13
Description: git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/git-big-picture/git-big-picture/pull/27; https://github.com/git-big-picture/git-big-picture/pull/62; https://github.com/git-big-picture/git-big-picture/releases/tag/v1.0.0
CVE: CVE-2019-4160
Published: 2021-01-13
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158577.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158577; https://www.ibm.com/support/pages/node/6403331; https://exchange.xforce.ibmcloud.com/vulnerabilities/158577
CVE: CVE-2019-4687
Published: 2021-01-13
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 171823.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171823; https://www.ibm.com/support/pages/node/6403331; https://exchange.xforce.ibmcloud.com/vulnerabilities/171823
CVE: CVE-2019-4702
Published: 2021-01-13
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171937; https://www.ibm.com/support/pages/node/6403331; https://exchange.xforce.ibmcloud.com/vulnerabilities/171937
CVE: CVE-2020-23653
Published: 2021-01-13
Description: An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/zoujingli/ThinkAdmin/issues/238; https://github.com/zoujingli/ThinkAdmin/issues/238
CVE: CVE-2021-3031
Published: 2021-01-13
Description: Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001. This issue impacts: PAN-OS 8.1 version earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-212
References: https://security.paloaltonetworks.com/CVE-2021-3031; https://security.paloaltonetworks.com/CVE-2021-3031
CVE: CVE-2021-3032
Published: 2021-01-13
Description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://security.paloaltonetworks.com/CVE-2021-3032; https://security.paloaltonetworks.com/CVE-2021-3032
CVE: CVE-2020-26262
Published: 2021-01-13
Description: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
CVSS Score: 7.2 (HIGH)
CWE: CWE-441, CWE-682
References: https://github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog#L48; https://github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4d; https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p
CVE: CVE-2020-4594
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184800.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184800; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184800
CVE: CVE-2020-4595
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184819.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184819; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184819
CVE: CVE-2020-4596
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184812.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184821; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184821
CVE: CVE-2020-4597
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 184822.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184822; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184822
CVE: CVE-2020-4599
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184824; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184824
CVE: CVE-2020-4600
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184832.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184832; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184832
CVE: CVE-2020-4602
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184836.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184836; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184836
CVE: CVE-2020-4604
Published: 2021-01-13
Description: IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 184861.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184881; https://www.ibm.com/support/pages/node/6403463; https://exchange.xforce.ibmcloud.com/vulnerabilities/184881
CVE: CVE-2020-9144
Published: 2021-01-13
Description: There is a heap overflow vulnerability in some Huawei smartphone, attackers can exploit this vulnerability to cause heap overflows due to improper restriction of operations within the bounds of a memory buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2021-21252
Published: 2021-01-13
Description: The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d; https://github.com/jquery-validation/jquery-validation/pull/2371; https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm
CVE: CVE-2020-27488
Published: 2021-01-13
Description: Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device's firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/; https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/; https://www.loxone.com/dede/sicherheit-cloud-dns/
CVE: CVE-2020-9145
Published: 2021-01-13
Description: There is an Out-of-bounds Write vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability may cause out-of-bounds access to the physical memory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-35578
Published: 2021-01-13
Description: An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/160948/Nagios-XI-5.7.x-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162207/Nagios-XI-Remote-Code-Execution.html; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2021-1189
Published: 2021-01-13
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U
CVE: CVE-2020-9138
Published: 2021-01-13
Description: There is a heap-based buffer overflow vulnerability in some Huawei Smartphone, Successful exploit of this vulnerability can cause process exceptions during updating.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-9139
Published: 2021-01-13
Description: There is a improper input validation vulnerability in some Huawei Smartphone.Successful exploit of this vulnerability can cause memory access errors and denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-9140
Published: 2021-01-13
Description: There is a vulnerability with buffer access with incorrect length value in some Huawei Smartphone.Unauthorized users may trigger code execution when a buffer overflow occurs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-9141
Published: 2021-01-13
Description: There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosure and malfunctions due to insufficient verification of data authenticity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269, CWE-345
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-9142
Published: 2021-01-13
Description: There is a heap base buffer overflow vulnerability in some Huawei smartphone.Successful exploitation of this vulnerability can cause heap overflow and memory overwriting when the system incorrectly processes the update file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-9143
Published: 2021-01-13
Description: There is a missing authentication vulnerability in some Huawei smartphone.Successful exploitation of this vulnerability may lead to low-sensitive information exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2020/12/; https://consumer.huawei.com/en/support/bulletin/2020/12/
CVE: CVE-2020-9203
Published: 2021-01-13
Description: There is a resource management errors vulnerability in Huawei P30. Local attackers construct broadcast message for some application, causing this application to send this broadcast message and impact the customer's use experience.
CVSS Score: 3.3 (LOW)
CWE: CWE-400
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201230-01-resourcemanagement-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201230-01-resourcemanagement-en
CVE: CVE-2021-1126
Published: 2021-01-13
Description: A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view credentials for a configured proxy server. The vulnerability is due to clear-text storage and weak permissions of related configuration files. An attacker could exploit this vulnerability by accessing the CLI of the affected software and viewing the contents of the affected files. A successful exploit could allow the attacker to view the credentials that are used to access the proxy server.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-256, CWE-522, CWE-732
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-infodisc-RJdktM6f; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-infodisc-RJdktM6f
CVE: CVE-2021-1127
Published: 2021-01-13
Description: A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-xss-smsz5Vhb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-xss-smsz5Vhb
CVE: CVE-2021-1130
Published: 2021-01-13
Description: A vulnerability in the web-based management interface of Cisco DNA Center software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have administrative credentials on the affected device.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-xss-HfV73cS3; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-xss-HfV73cS3
CVE: CVE-2021-1131
Published: 2021-01-13
Description: A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause an affected IP camera to reload. The vulnerability is due to missing checks when Cisco Discovery Protocol messages are processed. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected IP camera. A successful exploit could allow the attacker to cause the affected IP camera to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcameras-dos-9zdZcUfq; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcameras-dos-9zdZcUfq
CVE: CVE-2021-1143
Published: 2021-01-13
Description: A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on the system. The vulnerability is due to a lack of authorization checks for certain API GET requests. An attacker could exploit this vulnerability by sending specific API GET requests to an affected device. A successful exploit could allow the attacker to enumerate users of the CMX system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-862
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxapi-KsKwCmfp; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxapi-KsKwCmfp
CVE: CVE-2021-1144
Published: 2021-01-13
Description: A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow a remote, authenticated attacker without administrative privileges to alter the password of any user on an affected system. The vulnerability is due to incorrect handling of authorization checks for changing a password. An authenticated attacker without administrative privileges could exploit this vulnerability by sending a modified HTTP request to an affected device. A successful exploit could allow the attacker to alter the passwords of any user on the system, including an administrative user, and then impersonate that user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxpe-75Asy9k; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxpe-75Asy9k