deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-27622
Published: 2020-11-16
Description: In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27623
Published: 2020-11-16
Description: JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.
CVSS Score: 7.5 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27627
Published: 2020-11-16
Description: JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27988
Published: 2020-11-16
Description: Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-27989
Published: 2020-11-16
Description: Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-27990
Published: 2020-11-16
Description: Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-27991
Published: 2020-11-16
Description: Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28723
Published: 2020-11-16
Description: Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/CloudAvid/PParam/issues/9; https://github.com/raminfp/fuzz-libpparam; https://github.com/CloudAvid/PParam/issues/9
CVE: CVE-2020-4475
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181777; https://www.ibm.com/support/pages/node/6367963; https://exchange.xforce.ibmcloud.com/vulnerabilities/181777
CVE: CVE-2020-4476
Published: 2020-11-16
Description: IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181778.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181778; https://www.ibm.com/support/pages/node/6367971; https://exchange.xforce.ibmcloud.com/vulnerabilities/181778
CVE: CVE-2020-4566
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially highly sensitive information in log files that could be read by an authenticated user. IBM X-Force ID: 184083.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184083; https://www.ibm.com/support/pages/node/6367975; https://exchange.xforce.ibmcloud.com/vulnerabilities/184083
CVE: CVE-2020-4647
Published: 2020-11-16
Description: IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185809; https://www.ibm.com/support/pages/node/6367981; https://exchange.xforce.ibmcloud.com/vulnerabilities/185809
CVE: CVE-2020-4655
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 186091.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186091; https://www.ibm.com/support/pages/node/6367995; https://exchange.xforce.ibmcloud.com/vulnerabilities/186091
CVE: CVE-2020-4665
Published: 2020-11-16
Description: IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 186280.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186280; https://www.ibm.com/support/pages/node/6367997; https://exchange.xforce.ibmcloud.com/vulnerabilities/186280
CVE: CVE-2020-4671
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that could be read by an authenticatedl user. IBM X-Force ID: 186284.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186284; https://www.ibm.com/support/pages/node/6368001; https://exchange.xforce.ibmcloud.com/vulnerabilities/186284
CVE: CVE-2020-4672
Published: 2020-11-16
Description: IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186285; https://www.ibm.com/support/pages/node/6367813; https://exchange.xforce.ibmcloud.com/vulnerabilities/186285
CVE: CVE-2020-4692
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive information from the Dashboard UI. IBM X-Force ID: 186780.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186780; https://www.ibm.com/support/pages/node/6368009; https://exchange.xforce.ibmcloud.com/vulnerabilities/186780
CVE: CVE-2020-4700
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belonging to a specific user group to create a user or group with administrative privileges. IBM X-Force ID: 187077.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187077; https://www.ibm.com/support/pages/node/6367979; https://exchange.xforce.ibmcloud.com/vulnerabilities/187077
CVE: CVE-2020-4705
Published: 2020-11-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187190.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187190; https://www.ibm.com/support/pages/node/6368013; https://exchange.xforce.ibmcloud.com/vulnerabilities/187190
CVE: CVE-2020-4763
Published: 2020-11-16
Description: IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188897.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188897; https://www.ibm.com/support/pages/node/6368025; https://exchange.xforce.ibmcloud.com/vulnerabilities/188897
CVE: CVE-2020-23489
Published: 2020-11-16
Description: The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://cube01.io/blog/Avideo-Remote-Code-Execution.html; https://github.com/WWBN/AVideo/commit/ecc5f40470bbafff231133f58db1df70f47bfb33; https://cube01.io/blog/Avideo-Remote-Code-Execution.html
CVE: CVE-2020-23490
Published: 2020-11-16
Description: There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.
CVSS Score: 7.5 (HIGH)
References: https://cube01.io/blog/Avideo-Remote-Code-Execution.html; https://github.com/WWBN/AVideo/commit/218c98cbd4a4a2c15745852bcd0f29faf101bd8c; https://cube01.io/blog/Avideo-Remote-Code-Execution.html
CVE: CVE-2020-28692
Published: 2020-11-16
Description: In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing PHP files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/jkana/Gila-CMS-1.16.0-shell-upload; https://github.com/jkana/Gila-CMS-1.16.0-shell-upload
CVE: CVE-2020-26508
Published: 2020-11-16
Description: The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.syss.de/pentest-blog/; https://www.syss.de/pentest-blog/
CVE: CVE-2020-26509
Published: 2020-11-16
Description: Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt
CVE: CVE-2020-26510
Published: 2020-11-16
Description: Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resultant remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt
CVE: CVE-2020-5424
Published: 2020-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-26217
Published: 2020-11-16
Description: XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a; https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2; https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b[PII_REDACTED]f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E
CVE: CVE-2020-27483
Published: 2020-11-16
Description: Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided for the stack value duplication instruction, DUP. The offset is unchecked and memory prior to the start of the execution stack can be read and treated as a TVM object. A successful exploit could use the vulnerability to leak runtime information such as the heap handle or pointer for a number of TVM context variables. Some reachable values may be controlled enough to forge a TVM object on the stack, leading to possible remote code execution.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-129
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0007.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0007.md
CVE: CVE-2020-27484
Published: 2020-11-16
Description: Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction. This a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-190
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md
CVE: CVE-2020-27485
Published: 2020-11-16
Description: Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check the index provided when accessing the local variable in the LGETV and LPUTV instructions. This provides the ability to both read and write memory outside the bounds of the TVM context allocation. It can be leveraged to construct a use-after-free scenario, leading to a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-129
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0005.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0005.md
CVE: CVE-2020-27486
Published: 2020-11-16
Description: Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the string length provided in the data section of the PRG file. It allocates memory for the string immediately, and then copies the string into the TVM object by using a function similar to strcpy. This copy can exceed the length of the allocated string data and overwrite heap data. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0006.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0006.md
CVE: CVE-2020-28693
Published: 2020-11-16
Description: An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/<php_file_name>
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/jkana/HorizontCMS-1.0.0-beta-shell-upload; https://github.com/ttimot24/HorizontCMS/issues/21; https://github.com/jkana/HorizontCMS-1.0.0-beta-shell-upload
CVE: CVE-2020-26224
Published: 2020-11-16
Description: In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m; https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909
CVE: CVE-2020-26225
Published: 2020-11-16
Description: In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/PrestaShop/productcomments/commit/c56e3e9495c4a0a9c1e7dc43e1bb0fcad2796dbf; https://github.com/PrestaShop/productcomments/security/advisories/GHSA-58w4-w77w-qv3w; https://github.com/PrestaShop/productcomments/commit/c56e3e9495c4a0a9c1e7dc43e1bb0fcad2796dbf
CVE: CVE-2020-11860
Published: 2020-11-17
Description: Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600; https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600
CVE: CVE-2020-13352
Published: 2020-11-17
Description: Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
CVSS Score: 3.7 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13352.json; https://gitlab.com/gitlab-org/gitlab/-/issues/38281; https://hackerone.com/reports/748315
CVE: CVE-2020-13353
Published: 2020-11-17
Description: When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
CVSS Score: 2.5 (LOW)
CWE: CWE-613
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13353.json; https://gitlab.com/gitlab-org/gitaly/-/issues/2882; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13353.json
CVE: CVE-2020-13354
Published: 2020-11-17
Description: A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13354.json; https://gitlab.com/gitlab-org/gitlab/-/issues/220019; https://hackerone.com/reports/869875
CVE: CVE-2020-13358
Published: 2020-11-17
Description: A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.
CVSS Score: 4.7 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13358.json; https://gitlab.com/gitlab-org/gitlab/-/issues/241674; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13358.json
CVE: CVE-2020-25834
Published: 2020-11-17
Description: Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600; https://www.cybereagle.io/blog/cve-2020-25834/; https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600
CVE: CVE-2020-26406
Published: 2020-11-17
Description: Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26406.json; https://gitlab.com/gitlab-org/gitlab/-/issues/244921; https://hackerone.com/reports/965602
CVE: CVE-2020-10776
Published: 2020-11-17
Description: A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1847428; https://bugzilla.redhat.com/show_bug.cgi?id=1847428
CVE: CVE-2020-11851
Published: 2020-11-17
Description: Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in the execution of arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600; https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600
CVE: CVE-2020-14389
Published: 2020-11-17
Description: It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
CVSS Score: 8.1 (HIGH)
CWE: CWE-916, CWE-916
References: https://bugzilla.redhat.com/show_bug.cgi?id=1875843%2C; https://access.redhat.com/security/cve/cve-2020-14389; https://bugzilla.redhat.com/show_bug.cgi?id=1875843%2C
CVE: CVE-2020-15349
Published: 2020-11-17
Description: BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process (copy, move, delete) as root and changing permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://binarynights.com/blog/posts/forklift-3-4-security-update.html; https://insinuator.net/2020/11/forklift-lpe/; https://binarynights.com/blog/posts/forklift-3-4-security-update.html