deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-21175
Published: 2020-04-27
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000055183/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2624; https://kb.netgear.com/000055183/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2624
CVE: CVE-2018-21176
Published: 2020-04-27
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7500 before 1.0.0.122, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000055182/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2623; https://kb.netgear.com/000055182/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2623
CVE: CVE-2018-21177
Published: 2020-04-27
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000055181/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2622; https://kb.netgear.com/000055181/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2622
CVE: CVE-2018-21178
Published: 2020-04-27
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055180/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2621; https://kb.netgear.com/000055180/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2621
CVE: CVE-2018-21179
Published: 2020-04-27
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, D7800 before 1.0.1.30, R7500 before 1.0.0.122, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055179/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2620; https://kb.netgear.com/000055179/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2620
CVE: CVE-2018-21180
Published: 2020-04-27
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055178/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2619; https://kb.netgear.com/000055178/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2619
CVE: CVE-2020-1722
Published: 2020-04-27
Description: A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1722; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1722
CVE: CVE-2020-1762
Published: 2020-04-27
Description: An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
CVSS Score: 7.0 (HIGH)
CWE: CWE-384, CWE-613, CWE-384, CWE-613
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762; https://kiali.io/news/security-bulletins/kiali-security-001/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762
CVE: CVE-2020-7067
Published: 2020-04-27
Description: In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-196, CWE-125
References: https://bugs.php.net/bug.php?id=79465; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2020/dsa-4717
CVE: CVE-2020-7609
Published: 2020-04-27
Description: node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/mithunsatheesh/node-rules/commit/[PII_REDACTED]4bb6478fcc33b701c7dee11f7b832%2C; https://snyk.io/vuln/SNYK-JS-NODERULES-560426; https://github.com/mithunsatheesh/node-rules/commit/[PII_REDACTED]4bb6478fcc33b701c7dee11f7b832
CVE: CVE-2020-7640
Published: 2020-04-27
Description: pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8%2C; https://snyk.io/vuln/SNYK-JS-PIXLCLASS-564968; https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8
CVE: CVE-2020-9481
Published: 2020-04-27
Description: Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://lists.apache.org/thread.html/r21ddaf0a4a973f3c43c7ff399ae50d2f858f13f87bd6a9551c5cf6db%40%3Cannounce.trafficserver.apache.org%3E; https://www.debian.org/security/2020/dsa-4672; https://lists.apache.org/thread.html/r21ddaf0a4a973f3c43c7ff399ae50d2f858f13f87bd6a9551c5cf6db%40%3Cannounce.trafficserver.apache.org%3E
CVE: CVE-2019-15790
Published: 2020-04-28
Description: Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit this to read information about a privileged running process by exploiting PID recycling. This information could then be used to obtain ASLR offsets for a process with an existing memory corruption vulnerability. The initial fix introduced regressions in the Python Apport library due to a missing argument in Report.add_proc_environ in apport/report.py. It also caused an autopkgtest failure when reading /proc/pid and with Python 2 compatibility by reading /proc maps. The initial and subsequent regression fixes are in 2.20.11-0ubuntu16, 2.20.11-0ubuntu8.6, 2.20.9-0ubuntu7.12, 2.20.1-0ubuntu2.22 and 2.14.1-0ubuntu3.29+esm3.
CVSS Score: 2.8 (LOW)
CWE: CWE-250, CWE-269
References: http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html; https://bugs.launchpad.net/apport/+bug/1854237; https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1839795
CVE: CVE-2020-5562
Published: 2020-04-28
Description: Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/36304; https://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2020-5563
Published: 2020-04-28
Description: Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN35649781/index.html; https://kb.cybozu.support/article/36118/; https://jvn.jp/en/jp/JVN35649781/index.html
CVE: CVE-2020-5564
Published: 2020-04-28
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the application 'E-mail'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN35649781/index.html; https://kb.cybozu.support/article/36116/; https://jvn.jp/en/jp/JVN35649781/index.html
CVE: CVE-2020-5565
Published: 2020-04-28
Description: Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's data via the applications 'Workflow' and 'MultiReport'.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN35649781/index.html; https://kb.cybozu.support/article/36119/; https://jvn.jp/en/jp/JVN35649781/index.html
CVE: CVE-2020-5566
Published: 2020-04-28
Description: Improper authorization vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to alter the application's data via the applications 'E-mail' and 'Messages'.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN35649781/index.html; https://kb.cybozu.support/article/36113/; https://jvn.jp/en/jp/JVN35649781/index.html
CVE: CVE-2020-5567
Published: 2020-04-28
Description: Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN35649781/index.html; https://kb.cybozu.support/article/36114/; https://jvn.jp/en/jp/JVN35649781/index.html
CVE: CVE-2020-5568
Published: 2020-04-28
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the applications 'Messages' and 'Bulletin Board'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN35649781/index.html; https://kb.cybozu.support/article/36302/; https://jvn.jp/en/jp/JVN35649781/index.html
CVE: CVE-2020-12284
Published: 2020-04-28
Description: cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734; https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726; https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca[PII_REDACTED]4d40c047f7b20a99
CVE: CVE-2020-5570
Published: 2020-04-28
Description: Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN47668991/index.html; http://ni-consul.jp/support/info/2020/20200424_ge.html; https://jvn.jp/en/jp/JVN47668991/index.html
CVE: CVE-2020-12286
Published: 2020-04-28
Description: In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/OctopusDeploy/Issues/issues/6331; https://github.com/OctopusDeploy/Issues/issues/6332; https://github.com/OctopusDeploy/Issues/issues/6333
CVE: CVE-2018-21181
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 before 1.0.1.28, EX2700 before 1.0.1.32, EX6200v2 before 1.0.1.56, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.3.6, WN2000RPTv3 before 1.0.1.20, WN3000RPv3 before 1.0.2.52, WN3100RPv2 before 1.0.0.42, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000055177/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2618; https://kb.netgear.com/000055177/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2618
CVE: CVE-2018-21182
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, and WNDR4300 before 1.0.2.94.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055176/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2617; https://kb.netgear.com/000055176/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2617
CVE: CVE-2018-21183
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, and WNDR4300 before 1.0.2.94.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055175/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2616; https://kb.netgear.com/000055175/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2616
CVE: CVE-2018-21184
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, D7800 before 1.0.1.28, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, and R9000 before 1.0.3.6.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055174/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2615; https://kb.netgear.com/000055174/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2615
CVE: CVE-2018-21185
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, D7800 before 1.0.1.34, R7500 before 1.0.0.122, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055173/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2610; https://kb.netgear.com/000055173/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2610
CVE: CVE-2020-10093
Published: 2020-04-28
Description: A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.lexmark.com/index?page=content&id=TE936; http://support.lexmark.com/index?page=content&id=TE936
CVE: CVE-2020-10094
Published: 2020-04-28
Description: A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.lexmark.com/index?page=content&id=TE936; http://support.lexmark.com/index?page=content&id=TE936
CVE: CVE-2020-10944
Published: 2020-04-28
Description: HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/hashicorp/nomad/issues/7468; https://github.com/hashicorp/nomad/issues/7468
CVE: CVE-2020-12078
Published: 2020-04-28
Description: An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html; https://gist.github.com/mhaskar/dca62d0f0facc13f6364b8ed88d5a7fd; https://github.com/Opmantek/open-audit/commit/6ffc7f9032c55eaa1c37cf5e070809b7211c7e9a
CVE: CVE-2020-1774
Published: 2020-04-28
Description: When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-201
References: https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2020-11/
CVE: CVE-2020-4329
Published: 2020-04-28
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID: 177841.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/177841; https://www.ibm.com/support/pages/node/6201862; https://exchange.xforce.ibmcloud.com/vulnerabilities/177841
CVE: CVE-2018-21186
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055172/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2609; https://kb.netgear.com/000055172/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2609
CVE: CVE-2018-21187
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 before 1.0.1.30, R7500 before 1.0.0.122, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055170/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2608; https://kb.netgear.com/000055170/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2608
CVE: CVE-2018-21188
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 before 1.0.1.30, R7500v2 before 1.0.3.24, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055169/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2607; https://kb.netgear.com/000055169/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2607
CVE: CVE-2018-21189
Published: 2020-04-28
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, WNDR4300 before 1.0.2.94, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000055168/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2606; https://kb.netgear.com/000055168/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2606