deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5186
Published: 2020-02-24
Description: DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dnnsoftware/Dnn.Platform/releases; https://medium.com/%40SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175; https://packetstormsecurity.com/files/156483/DotNetNuke-CMS-9.5.0-Cross-Site-Scripting.html
CVE: CVE-2020-5187
Published: 2020-02-24
Description: DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/156489/DotNetNuke-CMS-9.4.4-Zip-Directory-Traversal.html; https://github.com/dnnsoftware/Dnn.Platform/releases; https://medium.com/%40SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175
CVE: CVE-2020-5188
Published: 2020-02-24
Description: DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-669
References: http://packetstormsecurity.com/files/156484/DotNetNuke-CMS-9.5.0-File-Extension-Check-Bypass.html; https://github.com/dnnsoftware/Dnn.Platform/releases; https://medium.com/%40SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175
CVE: CVE-2020-8130
Published: 2020-02-24
Description: There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html; https://hackerone.com/reports/651518; https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html
CVE: CVE-2020-8131
Published: 2020-02-24
Description: Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/yarnpkg/yarn/pull/7831; https://hackerone.com/reports/730239; https://github.com/yarnpkg/yarn/pull/7831
CVE: CVE-2019-4595
Published: 2020-02-24
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 167878.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167878; https://www.ibm.com/support/pages/node/3137439; https://exchange.xforce.ibmcloud.com/vulnerabilities/167878
CVE: CVE-2019-4703
Published: 2020-02-24
Description: IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly sensitive information.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172013; https://www.ibm.com/support/pages/node/3177915; https://exchange.xforce.ibmcloud.com/vulnerabilities/172013
CVE: CVE-2019-4745
Published: 2020-02-24
Description: IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL. IBM X-Force ID: 172883.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172883; https://www.ibm.com/support/pages/node/3245409; https://exchange.xforce.ibmcloud.com/vulnerabilities/172883
CVE: CVE-2020-4210
Published: 2020-02-24
Description: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175020; https://www.ibm.com/support/pages/node/3178863; https://www.zerodayinitiative.com/advisories/ZDI-20-274/
CVE: CVE-2020-4211
Published: 2020-02-24
Description: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175022.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175022; https://www.ibm.com/support/pages/node/3178863; https://www.zerodayinitiative.com/advisories/ZDI-20-273/
CVE: CVE-2020-4212
Published: 2020-02-24
Description: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175023; https://www.ibm.com/support/pages/node/3178863; https://www.zerodayinitiative.com/advisories/ZDI-20-272/
CVE: CVE-2020-4213
Published: 2020-02-24
Description: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175024.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175024; https://www.ibm.com/support/pages/node/3178863; https://www.zerodayinitiative.com/advisories/ZDI-20-270/
CVE: CVE-2020-4222
Published: 2020-02-24
Description: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175091.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175091; https://www.ibm.com/support/pages/node/3178863; https://www.zerodayinitiative.com/advisories/ZDI-20-271/
CVE: CVE-2020-9362
Published: 2020-02-24
Description: The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Security, Total Security Multi-Device, Internet Security, Total Security for Mac, AntiVirus Pro, AntiVirus for Server, and Total Security for Android.
CVSS Score: 7.8 (HIGH)
CWE: CWE-436
References: http://packetstormsecurity.com/files/156580/QuickHeal-Generic-Malformed-Archive-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/14; https://blog.zoller.lu/p/from-low-hanging-fruit-department_24.html
CVE: CVE-2020-9363
Published: 2020-02-24
Description: The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.
CVSS Score: 7.8 (HIGH)
CWE: CWE-436
References: https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html; https://community.sophos.com/b/security-blog/posts/sophos-comments-to-cve-2020-9363; https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html
CVE: CVE-2020-9365
Published: 2020-02-24
Description: An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/jedisct1/pure-ftpd/commit/36c6d268cb190282a2c17106acfd31863121b58e; https://github.com/jedisct1/pure-ftpd/commit/bf6fcd4935e95128cf22af5924cdc8fe5c0579da; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/
CVE: CVE-2012-0785
Published: 2020-02-24
Description: Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2012/01/20/8; https://access.redhat.com/security/cve/cve-2012-0785; https://jenkins.io/security/advisory/2012-01-12/
CVE: CVE-2020-9366
Published: 2020-02-24
Description: A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2020/02/25/1; https://lists.gnu.org/archive/html/screen-devel/2020-02/msg00007.html; https://security.gentoo.org/glsa/202003-62
CVE: CVE-2019-10796
Published: 2020-02-24
Description: rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/xseignard/rpi/blob/master/src/lib/gpio.js#L47; https://snyk.io/vuln/SNYK-JS-RPI-548942; https://github.com/xseignard/rpi/blob/master/src/lib/gpio.js#L47
CVE: CVE-2019-10798
Published: 2020-02-24
Description: rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/rdf-ext-archive/rdf-graph-array/blob/master/index.js#L211; https://snyk.io/vuln/SNYK-JS-RDFGRAPHARRAY-551803; https://github.com/rdf-ext-archive/rdf-graph-array/blob/master/index.js#L211
CVE: CVE-2019-10799
Published: 2020-02-24
Description: compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://github.com/eiskalteschatten/compile-sass/commit/d9ada7797ff93875b6466dea7a78768e90a0f8d2; https://snyk.io/vuln/SNYK-JS-COMPILESASS-551804; https://github.com/eiskalteschatten/compile-sass/commit/d9ada7797ff93875b6466dea7a78768e90a0f8d2
CVE: CVE-2020-5244
Published: 2020-02-24
Description: In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.
CVSS Score: 8.0 (HIGH)
CWE: CWE-284, CWE-200
References: https://buddypress.org/2020/01/buddypress-5-1-2/; https://github.com/buddypress/BuddyPress/commit/[PII_REDACTED]9a0c992290577a9d740f4a2f2c2ca3; https://github.com/buddypress/BuddyPress/security/advisories/GHSA-3j78-7m59-r7gv
CVE: CVE-2020-5245
Published: 2020-02-24
Description: Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.

The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
CVSS Score: 7.9 (HIGH)
CWE: CWE-74, CWE-74
References: https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation; https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions; https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
CVE: CVE-2020-9369
Published: 2020-02-24
Description: Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/sympa-community/sympa/issues/886; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6TMVZ5LVYCCIHGEC7RQUMGUE7DJWUXN7/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3FUYYLV6URRLAJVWXNJYK2CNOKKNHXC/
CVE: CVE-2018-13313
Published: 2020-02-24
Description: In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154; https://www.ise.io/casestudies/sohopelessly-broken-2-0/; https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE: CVE-2018-14705
Published: 2020-02-24
Description: In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these applications, but also poses severe risks to the confidentiality and integrity of data stored within the applications and the device itself.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc; https://www.ise.io/casestudies/sohopelessly-broken-2-0/; https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE: CVE-2019-12510
Published: 2020-02-24
Description: In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For header of the device's LAN IP address (192.168.1.1) in every request. As a result, an attacker may modify almost all of the device's settings and view various configuration settings.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-345
References: https://www.ise.io/casestudies/sohopelessly-broken-2-0/; https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE: CVE-2019-12511
Published: 2020-02-24
Description: In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled, and a valid authentication JWT, additional vulnerabilities (CVE-2019-12510) allow an attacker to interact with the entire SOAP API without authentication. Additionally, DNS rebinding techniques may be used to exploit this vulnerability remotely. Exploiting this vulnerability is somewhat involved. The following limitations apply to the payload and must be overcome for successful exploitation: - No more than 17 characters may be used. - At least one colon must be included to prevent mangling. - A single-quote and meta-character must be used to break out of the existing command. - Parent command remnants after the injection point must be dealt with. - The payload must be in all-caps. Despite these limitations, it is still possible to gain access to an interactive root shell via this vulnerability. Since the web server assigns certain HTTP headers to environment variables with all-caps names, it is possible to insert a payload into one such header and reference the subsequent environment variable in the injection point.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.ise.io/casestudies/sohopelessly-broken-2-0/; https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE: CVE-2019-12512
Published: 2020-02-24
Description: In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanced settings->Administration->Logs, and may trigger when the page is viewed. Although this value is inserted into a textarea tag, the attack simply needs to supply a closing textarea tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ise.io/casestudies/sohopelessly-broken-2-0/; https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE: CVE-2019-12513
Published: 2020-02-24
Description: In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious hostname. This log entry may then be viewed at Advanced settings->Administration->Logs to trigger the exploit. Although this value is inserted into a textarea tag, converted to all-caps, and limited in length, attacks are still possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ise.io/casestudies/sohopelessly-broken-2-0/; https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE: CVE-2019-17228
Published: 2020-02-24
Description: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin/; https://wordpress.org/plugins/motors-car-dealership-classified-listings/#developers; https://wpvulndb.com/vulnerabilities/9884
CVE: CVE-2019-17229
Published: 2020-02-24
Description: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin/; https://wordpress.org/plugins/motors-car-dealership-classified-listings/#developers; https://wpvulndb.com/vulnerabilities/9884
CVE: CVE-2020-9374
Published: 2020-02-24
Description: On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shell metacharacters to the panel's traceroute feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/156584/TP-Link-TL-WR849N-Remote-Code-Execution.html; https://fireshellsecurity.team/hack-n-routers/; https://github.com/ElberTavares/routers-exploit/tree/master/tp-link
CVE: CVE-2020-1937
Published: 2020-02-24
Description: Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E; https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E; https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E
CVE: CVE-2019-17569
Published: 2020-02-24
Description: The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html; https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E; https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E
CVE: CVE-2020-1935
Published: 2020-02-24
Description: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html; https://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E; https://lists.apache.org/thread.html/r441c1f30a252bf14b07396286f6abd8089ce4240e91323211f1a2d75%40%3Cusers.tomcat.apache.org%3E
CVE: CVE-2020-1938
Published: 2020-02-24
Description: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html; http://support.blackberry.com/kb/articleDetail?articleNumber=000062739
CVE: CVE-2020-9381
Published: 2020-02-24
Description: controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/saddean/research/blob/master/totaljs/Broken-acces-control.md; https://github.com/totaljs/cms/commit/2a26c4c6a61d3fda4527a761716ef7e1c5f7c970; https://github.com/saddean/research/blob/master/totaljs/Broken-acces-control.md