deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11286
Published: 2020-07-31
Description: VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against the service with a crafted set of credentials leading to remote code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://tanzu.vmware.com/security/cve-2019-11286; https://tanzu.vmware.com/security/cve-2019-11286
CVE: CVE-2020-15869
Published: 2020-07-31
Description: Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.sonatype.com; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]54; https://support.sonatype.com
CVE: CVE-2020-15870
Published: 2020-07-31
Description: Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.sonatype.com; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]54; https://support.sonatype.com
CVE: CVE-2020-15871
Published: 2020-07-31
Description: Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
CVSS Score: 8.8 (HIGH)
References: https://support.sonatype.com; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]93; https://support.sonatype.com
CVE: CVE-2020-5396
Published: 2020-07-31
Description: VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-862
References: https://tanzu.vmware.com/security/cve-2020-5396; https://tanzu.vmware.com/security/cve-2020-5396
CVE: CVE-2020-5413
Published: 2020-07-31
Description: Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://tanzu.vmware.com/security/cve-2020-5413; https://www.oracle.com//security-alerts/cpujul2021.html; https://www.oracle.com/security-alerts/cpuApr2021.html
CVE: CVE-2020-5414
Published: 2020-07-31
Description: VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://tanzu.vmware.com/security/cve-2020-5414; https://tanzu.vmware.com/security/cve-2020-5414
CVE: CVE-2020-14310
Published: 2020-07-31
Description: There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-122, CWE-190, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310
CVE: CVE-2020-14311
Published: 2020-07-31
Description: There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-122, CWE-190, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; http://www.openwall.com/lists/oss-security/2021/09/17/2
CVE: CVE-2020-8108
Published: 2020-08-03
Description: Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.bitdefender.com/support/security-advisories/insufficient-client-validation-bitdefender-endpoint-security-mac-va-8759/; https://www.bitdefender.com/support/security-advisories/insufficient-client-validation-bitdefender-endpoint-security-mac-va-8759/
CVE: CVE-2019-4366
Published: 2020-08-03
Description: IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached browser data. IBM X-Force ID: 161748.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161748; https://www.ibm.com/support/pages/node/6252853; https://exchange.xforce.ibmcloud.com/vulnerabilities/161748
CVE: CVE-2019-4589
Published: 2020-08-03
Description: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less privileged user. IBM X-Force ID: 167449.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167449; https://www.ibm.com/support/pages/node/6252853; https://exchange.xforce.ibmcloud.com/vulnerabilities/167449
CVE: CVE-2020-4328
Published: 2020-08-03
Description: IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 177839.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/177839; https://www.ibm.com/support/pages/node/6255154; https://exchange.xforce.ibmcloud.com/vulnerabilities/177839
CVE: CVE-2020-4377
Published: 2020-08-03
Description: IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179156; https://www.ibm.com/support/pages/node/6252853; https://exchange.xforce.ibmcloud.com/vulnerabilities/179156
CVE: CVE-2020-4534
Published: 2020-08-03
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges. IBM X-Force ID: 182808.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182808; https://www.ibm.com/support/pages/node/6255074; https://exchange.xforce.ibmcloud.com/vulnerabilities/182808
CVE: CVE-2020-4549
Published: 2020-08-03
Description: IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183317.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183317; https://www.ibm.com/support/pages/node/6254694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183317
CVE: CVE-2020-4550
Published: 2020-08-03
Description: IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183318.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183318; https://www.ibm.com/support/pages/node/6254694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183318
CVE: CVE-2020-4551
Published: 2020-08-03
Description: IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183319.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183319; https://www.ibm.com/support/pages/node/6254694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183319
CVE: CVE-2020-4552
Published: 2020-08-03
Description: IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183320.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183320; https://www.ibm.com/support/pages/node/6254694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183320
CVE: CVE-2020-4553
Published: 2020-08-03
Description: IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183321.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183321; https://www.ibm.com/support/pages/node/6254694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183321
CVE: CVE-2020-4554
Published: 2020-08-03
Description: IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183322.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183322; https://www.ibm.com/support/pages/node/6254694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183322
CVE: CVE-2020-4560
Published: 2020-08-03
Description: IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183900; https://www.ibm.com/support/pages/node/6255190; https://exchange.xforce.ibmcloud.com/vulnerabilities/183900
CVE: CVE-2019-19453
Published: 2020-08-03
Description: Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to insert a malicious payload that will be triggered in the main page of server settings. This issue was resolved in Wowza Streaming Engine 4.8.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-19453.txt; https://www.gruppotim.it/redteam; https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes
CVE: CVE-2019-19455
Published: 2020-08-03
Description: Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine / manager / bin / in the Linux version of the server by writing arbitrary commands in any file and execute them as root. This issue was resolved in Wowza Streaming Engine 4.8.5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-19455.txt; https://www.gruppotim.it/redteam; https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes
CVE: CVE-2015-9549
Published: 2020-08-03
Description: A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2015-9549-ocportal.html; https://github.com/cybersecurityworks/Disclosed/issues/11; https://www.openwall.com/lists/oss-security/2015/12/19/2
CVE: CVE-2020-16269
Published: 2020-08-03
Description: radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/radareorg/radare2/issues/17383; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45SGGCWFIIV7N2X2QZRREHOW7ODT3IH7/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJET3RR6W7LAK4H6VPTMAZS24W7XYHRZ/
CVE: CVE-2020-12739
Published: 2020-08-03
Description: A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause an affected CNC to become inaccessible to other devices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: http://jvn.jp/en/jp/JVN84959128/index.html; https://jvn.jp/en/jp/JVN84959128/index.html; https://jvn.jp/jp/JVN84959128/index.html
CVE: CVE-2020-13820
Published: 2020-08-03
Description: Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.extremenetworks.com/release_notes/netsight/XMC_8.5.0_Release_Notes.pdf; https://gtacknowledge.extremenetworks.com; https://gtacknowledge.extremenetworks.com/articles/Solution/000051136
CVE: CVE-2020-14319
Published: 2020-08-03
Description: It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Adobe Flash are vulnerable when targeted by an attacker. This flaw affects all versions of AMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1854373; https://bugzilla.redhat.com/show_bug.cgi?id=1854373
CVE: CVE-2020-16131
Published: 2020-08-03
Description: Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/tikiwiki/tiki/-/commit/d12d6ea7b025d3b3f81c8a71063fe9f89e0c4bf1; https://tiki.org/News; https://gitlab.com/tikiwiki/tiki/-/commit/d12d6ea7b025d3b3f81c8a71063fe9f89e0c4bf1
CVE: CVE-2020-16271
Published: 2020-08-03
Description: The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-330
References: https://danzinger.wien/exploiting-keepassrpc/; https://forum.kee.pm/t/a-critical-security-update-for-keepassrpc-is-available/3040; https://danzinger.wien/exploiting-keepassrpc/
CVE: CVE-2020-16272
Published: 2020-08-03
Description: The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://danzinger.wien/exploiting-keepassrpc/; https://forum.kee.pm/t/a-critical-security-update-for-keepassrpc-is-available/3040; https://danzinger.wien/exploiting-keepassrpc/
CVE: CVE-2020-8574
Published: 2020-08-03
Description: Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service enabled allowing unauthorized code execution to local users.
CVSS Score: 7.8 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-8575
Published: 2020-08-03
Description: Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service (DoS).
CVSS Score: 4.4 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-16116
Published: 2020-08-03
Description: In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00023.html; https://github.com/KDE/ark/commits/master; https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74ddf8a196bc9ffdb92f
CVE: CVE-2020-5770
Published: 2020-08-03
Description: Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2020-48; https://www.tenable.com/security/research/tra-2020-48
CVE: CVE-2020-5771
Published: 2020-08-03
Description: Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.tenable.com/security/research/tra-2020-48; https://www.tenable.com/security/research/tra-2020-48
CVE: CVE-2020-5772
Published: 2020-08-03
Description: Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://www.tenable.com/security/research/tra-2020-48; https://www.tenable.com/security/research/tra-2020-48
CVE: CVE-2020-5773
Published: 2020-08-03
Description: Improper Access Control in Teltonika firmware TRB2_R_00.02.04.01 allows a low privileged user to perform unauthorized write operations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.tenable.com/security/research/tra-2020-48; https://www.tenable.com/security/research/tra-2020-48
CVE: CVE-2020-11583
Published: 2020-08-03
Description: A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5; https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5
CVE: CVE-2020-11584
Published: 2020-08-03
Description: A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5; https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5
CVE: CVE-2020-5615
Published: 2020-08-04
Description: Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN73169744/index.html; https://www.php-factory.net/calendar/01.php; https://www.php-factory.net/calendar/02.php
CVE: CVE-2020-5616
Published: 2020-08-04
Description: [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] free edition ver1.0.0, [Gallery01] free edition ver1.0.3 and earlier, [CalendarForm01] free edition ver1.0.3 and earlier, and [Link01] free edition ver1.0.0 allows remote attackers to bypass authentication and log in to the product with administrative privileges via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN73169744/index.html; https://www.php-factory.net/calendar/01.php; https://www.php-factory.net/calendar/02.php
CVE: CVE-2020-5617
Published: 2020-08-04
Description: Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://jvn.jp/en/jp/JVN25422698/index.html; https://www.skyseaclientview.net/news/200803_01/; https://jvn.jp/en/jp/JVN25422698/index.html
CVE: CVE-2019-20001
Published: 2020-08-04
Description: An issue was discovered in RICOH Streamline NX Client Tool and RICOH Streamline NX PC Client that allows attackers to escalate local privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.ricoh.com/html_gen/util/STREAM/Streamline.html; https://www.ricoh-usa.com/en/support-and-download; https://support.ricoh.com/html_gen/util/STREAM/Streamline.html
CVE: CVE-2020-15467
Published: 2020-08-04
Description: The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execution leading to server compromise.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/fireeye/Vulnerability-Disclosures; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0007/FEYE-2020-0007.md; https://github.com/fireeye/Vulnerability-Disclosures