deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-35197
Published: 2020-12-17
Description: The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35197; https://github.com/koharin/koharin2/blob/main/CVE-2020-35197
CVE: CVE-2020-25094
Published: 2020-12-17
Description: LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/; https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
CVE: CVE-2020-25095
Published: 2020-12-17
Description: LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/; https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
CVE: CVE-2020-25096
Published: 2020-12-17
Description: LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application server, which will forward requests to any configured back-end server, regardless of whether the user's access rights should permit this. As a result, even the most low-privileged user can interact with any back-end component that has a LogRhythm agent installed.
CVSS Score: 8.8 (HIGH)
References: https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/; https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
CVE: CVE-2020-25010
Published: 2020-12-17
Description: An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an instruction to write a file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/AnfieldQi/CVE_list/blob/master/CVE-2020-25010.md; https://www.cnvd.org.cn/flaw/show/CNVD-2020-55990; https://github.com/AnfieldQi/CVE_list/blob/master/CVE-2020-25010.md
CVE: CVE-2020-25011
Published: 2020-12-17
Description: A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to get username and password by request /cgi-bin/webadminget.cgi script via the browser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://github.com/AnfieldQi/CVE_list/blob/master/CVE-2020-25011.md; https://www.cnvd.org.cn/flaw/show/CNVD-2020-55988; https://github.com/AnfieldQi/CVE_list/blob/master/CVE-2020-25011.md
CVE: CVE-2020-35123
Published: 2020-12-17
Description: In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17; https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10
CVE: CVE-2020-27199
Published: 2020-12-17
Description: The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for correct password to gain access to the mobile application as that victim user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/magic-home-pro-mobile-application-authentication-bypass-cve-2020-27199/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/magic-home-pro-mobile-application-authentication-bypass-cve-2020-27199/
CVE: CVE-2020-29652
Published: 2020-12-17
Description: A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0[PII_REDACTED]3018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://go-review.googlesource.com/c/crypto/+/278852; https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1; https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E
CVE: CVE-2020-35177
Published: 2020-12-17
Description: HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984; https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161; https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984
CVE: CVE-2020-35453
Published: 2020-12-17
Description: HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.
CVSS Score: 5.3 (MEDIUM)
References: https://discuss.hashicorp.com/t/hcsec-2020-24-vault-enterprise-s-sentinel-egp-policies-may-impact-parent-or-sibling-namespaces/18983; https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161; https://discuss.hashicorp.com/t/hcsec-2020-24-vault-enterprise-s-sentinel-egp-policies-may-impact-parent-or-sibling-namespaces/18983
CVE: CVE-2020-22083
Published: 2020-12-17
Description: jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/security/cve/CVE-2020-22083; https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874; https://github.com/j0lt-github/python-deserialization-attack-payload-generator
CVE: CVE-2020-15292
Published: 2020-12-17
Description: Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor (IntPeGetDirectory), TOCTOU (IntPeParseUnwindData) or insufficient validations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.bitdefender.com/support/security-advisories/lack-validation-data-read-guest-memory-bitdefender-hvi-va-9333/; https://www.bitdefender.com/support/security-advisories/lack-validation-data-read-guest-memory-bitdefender-hvi-va-9333/
CVE: CVE-2020-15293
Published: 2020-12-17
Description: Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of service conditions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.bitdefender.com/support/security-advisories/memory-corruption-bitdefender-hypervisor-introspection-va-9336/; https://www.bitdefender.com/support/security-advisories/memory-corruption-bitdefender-hypervisor-introspection-va-9336/
CVE: CVE-2020-15294
Published: 2020-12-17
Description: Compiler Optimization Removal or Modification of Security-critical Code vulnerability in IntPeParseUnwindData() results in multiple dereferences to the same pointer. If the pointer is located in memory-mapped from the guest space, this may cause a race-condition where the generated code would dereference the same address twice, thus obtaining different values, which may lead to arbitrary code execution. This issue affects: Bitdefender Hypervisor Introspection versions prior to 1.132.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-733
References: https://www.bitdefender.com/support/security-advisories/compiler-optimization-removal-modification-security-critical-code-vulnerability-bitdefender-hypervisor-introspection-va-9339/; https://www.bitdefender.com/support/security-advisories/compiler-optimization-removal-modification-security-critical-code-vulnerability-bitdefender-hypervisor-introspection-va-9339/
CVE: CVE-2020-35489
Published: 2020-12-17
Description: The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://contactform7.com/2020/12/17/contact-form-7-532/; https://wordpress.org/plugins/contact-form-7/#developers; https://wpscan.com/vulnerability/10508
CVE: CVE-2020-35490
Published: 2020-12-17
Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062; https://github.com/FasterXML/jackson-databind/issues/2986; https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
CVE: CVE-2020-35491
Published: 2020-12-17
Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062; https://github.com/FasterXML/jackson-databind/issues/2986; https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
CVE: CVE-2020-4845
Published: 2020-12-17
Description: IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190289.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190289; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/190289
CVE: CVE-2020-4846
Published: 2020-12-17
Description: IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190290.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190290; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/190290
CVE: CVE-2020-26276
Published: 2020-12-17
Description: Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020; https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607; https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx
CVE: CVE-2020-35545
Published: 2020-12-17
Description: Time-based SQL injection exists in Spotweb 1.4.9 via the query string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/spotweb/spotweb/issues/629; https://github.com/spotweb/spotweb/issues/629
CVE: CVE-2020-27010
Published: 2020-12-17
Description: A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product in a manner separate from the similar CVE-2020-8462.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/000283077; https://success.trendmicro.com/solution/000283077
CVE: CVE-2020-8461
Published: 2020-12-17
Description: A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/; https://success.trendmicro.com/solution/000283077; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
CVE: CVE-2020-8462
Published: 2020-12-17
Description: A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/; https://success.trendmicro.com/solution/000283077; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
CVE: CVE-2020-8463
Published: 2020-12-17
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization check for anonymous users by manipulating request paths.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/; https://success.trendmicro.com/solution/000283077; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
CVE: CVE-2020-8464
Published: 2020-12-17
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normally have access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/; https://success.trendmicro.com/solution/000283077; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
CVE: CVE-2020-8465
Published: 2020-12-17
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass (CVE-2020-8461) and authentication bypass (CVE-2020-8464) to execute code as user root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-352
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/; https://success.trendmicro.com/solution/000283077; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
CVE: CVE-2020-8466
Published: 2020-12-17
Description: A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/; https://success.trendmicro.com/solution/000283077; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
CVE: CVE-2020-12517
Published: 2020-12-17
Description: On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/en-us/advisories/vde-2020-049; https://cert.vde.com/en-us/advisories/vde-2020-049
CVE: CVE-2020-12518
Published: 2020-12-17
Description: On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://cert.vde.com/en-us/advisories/vde-2020-049; https://cert.vde.com/en-us/advisories/vde-2020-049
CVE: CVE-2020-12519
Published: 2020-12-17
Description: On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://cert.vde.com/en-us/advisories/vde-2020-049; https://cert.vde.com/en-us/advisories/vde-2020-049
CVE: CVE-2020-12521
Published: 2020-12-17
Description: On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://cert.vde.com/en-us/advisories/vde-2020-049; https://cert.vde.com/en-us/advisories/vde-2020-049
CVE: CVE-2020-12522
Published: 2020-12-17
Description: The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://cert.vde.com/en-us/advisories/vde-2020-045; https://cert.vde.com/en-us/advisories/vde-2020-045
CVE: CVE-2020-12523
Published: 2020-12-17
Description: On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-909, CWE-909
References: https://cert.vde.com/en-us/advisories/vde-2020-046; https://cert.vde.com/en-us/advisories/vde-2020-046
CVE: CVE-2020-20138
Published: 2020-12-17
Description: Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html
CVE: CVE-2020-20139
Published: 2020-12-17
Description: Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html
CVE: CVE-2020-20140
Published: 2020-12-17
Description: Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html
CVE: CVE-2020-20141
Published: 2020-12-17
Description: Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html
CVE: CVE-2020-20142
Published: 2020-12-17
Description: Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html
CVE: CVE-2020-13509
Published: 2020-12-18
Description: An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) Using the IRP 0x9c4060cc gives a low privilege user direct access to the IN instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability and this access could allow for information leakage of sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1110; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1110
CVE: CVE-2020-13510
Published: 2020-12-18
Description: An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) using the IRP 0x9c4060d0 gives a low privilege user direct access to the IN instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1110; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1110