deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-0987
Published: 2020-04-15
Description: An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Component Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0982, CVE-2020-1005.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0987; https://www.zerodayinitiative.com/advisories/ZDI-20-647/; https://www.zerodayinitiative.com/advisories/ZDI-20-876/
CVE: CVE-2020-0988
Published: 2020-04-15
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0992, CVE-2020-0994, CVE-2020-0995, CVE-2020-0999, CVE-2020-1008.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0988; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0988
CVE: CVE-2020-0991
Published: 2020-04-15
Description: A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0760.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0991; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0991
CVE: CVE-2020-0992
Published: 2020-04-15
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0988, CVE-2020-0994, CVE-2020-0995, CVE-2020-0999, CVE-2020-1008.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0992; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0992
CVE: CVE-2020-0993
Published: 2020-04-15
Description: A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, aka 'Windows DNS Denial of Service Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0993; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0993
CVE: CVE-2020-0994
Published: 2020-04-15
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0988, CVE-2020-0992, CVE-2020-0995, CVE-2020-0999, CVE-2020-1008.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0994; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0994
CVE: CVE-2020-0995
Published: 2020-04-15
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0988, CVE-2020-0992, CVE-2020-0994, CVE-2020-0999, CVE-2020-1008.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0995; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0995
CVE: CVE-2020-0996
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0985.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0996; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0996
CVE: CVE-2020-0999
Published: 2020-04-15
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0988, CVE-2020-0992, CVE-2020-0994, CVE-2020-0995, CVE-2020-1008.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0999; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0999
CVE: CVE-2020-11534
Published: 2020-04-15
Description: An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely execute code on a victim's server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0; https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551; https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0
CVE: CVE-2020-11535
Published: 2020-04-15
Description: An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0; https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551; https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0
CVE: CVE-2020-11536
Published: 2020-04-15
Description: An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0; https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551; https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0
CVE: CVE-2020-11537
Published: 2020-04-15
Description: A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0; https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551; https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0
CVE: CVE-2020-11747
Published: 2020-04-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-8497. Reason: This candidate is a reservation duplicate of CVE-2020-8497. Notes: All CVE users should reference CVE-2020-8497 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-1000
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1003, CVE-2020-1027.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1000; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1000
CVE: CVE-2020-1001
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0940, CVE-2020-1006, CVE-2020-1017.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1001; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1001
CVE: CVE-2020-1002
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1002; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1002
CVE: CVE-2020-1003
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1027.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1003; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1003
CVE: CVE-2020-1004
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1004; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1004
CVE: CVE-2020-1005
Published: 2020-04-15
Description: An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Component Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0982, CVE-2020-0987.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1005; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1005
CVE: CVE-2020-1006
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0940, CVE-2020-1001, CVE-2020-1017.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1006; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1006
CVE: CVE-2020-1007
Published: 2020-04-15
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0821.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1007; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1007
CVE: CVE-2020-1008
Published: 2020-04-15
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0988, CVE-2020-0992, CVE-2020-0994, CVE-2020-0995, CVE-2020-0999.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1008; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1008
CVE: CVE-2020-1009
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the way that the Microsoft Store Install Service handles file operations in protected locations, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0934, CVE-2020-0983, CVE-2020-1011, CVE-2020-1015.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1009; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1009
CVE: CVE-2020-1011
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the Windows System Assessment Tool improperly handles file operations, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0934, CVE-2020-0983, CVE-2020-1009, CVE-2020-1015.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1011; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1011
CVE: CVE-2020-1014
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1014; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1014
CVE: CVE-2020-1015
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0934, CVE-2020-0983, CVE-2020-1009, CVE-2020-1011.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1015; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1015
CVE: CVE-2020-1016
Published: 2020-04-15
Description: An information disclosure vulnerability exists when the Windows Push Notification Service improperly handles objects in memory, aka 'Windows Push Notification Service Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1016; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1016
CVE: CVE-2020-1017
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0940, CVE-2020-1001, CVE-2020-1006.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1017; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1017
CVE: CVE-2020-1018
Published: 2020-04-15
Description: An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018
CVE: CVE-2020-1019
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries, aka 'Microsoft RMS Sharing App for Mac Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1019; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1019
CVE: CVE-2020-1020
Published: 2020-04-15
Description: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1020
CVE: CVE-2020-1022
Published: 2020-04-15
Description: A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
CVSS Score: 8.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022
CVE: CVE-2020-1026
Published: 2020-04-15
Description: A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the libraryâ€™s Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a serverâ€™s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka 'MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-347
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1026; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1026
CVE: CVE-2020-1027
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1003.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/168068/Windows-sxs-CNodeFactory-XMLParser_Element_doc_assembly_assemblyIdentity-Heap-Buffer-Overflow.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1027; http://packetstormsecurity.com/files/168068/Windows-sxs-CNodeFactory-XMLParser_Element_doc_assembly_assemblyIdentity-Heap-Buffer-Overflow.html
CVE: CVE-2020-1029
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0942, CVE-2020-0944.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1029; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1029
CVE: CVE-2020-1049
Published: 2020-04-15
Description: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'. This CVE ID is unique from CVE-2020-1050.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1049; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1049
CVE: CVE-2020-1050
Published: 2020-04-15
Description: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'. This CVE ID is unique from CVE-2020-1049.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1050; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1050
CVE: CVE-2020-1094
Published: 2020-04-15
Description: An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1094; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1094
CVE: CVE-2019-4593
Published: 2020-04-15
Description: IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167743; https://www.ibm.com/support/pages/node/6189729; https://exchange.xforce.ibmcloud.com/vulnerabilities/167743
CVE: CVE-2019-4594
Published: 2020-04-15
Description: IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-ForceID: 167810.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167810; https://www.ibm.com/support/pages/node/6189735; https://exchange.xforce.ibmcloud.com/vulnerabilities/167810
CVE: CVE-2019-4654
Published: 2020-04-15
Description: IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-ForceID: 170965.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170965; https://www.ibm.com/support/pages/node/6189723; https://exchange.xforce.ibmcloud.com/vulnerabilities/170965
CVE: CVE-2020-11728
Published: 2020-04-15
Description: An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650; https://gitlab.com/davical-project/awl/-/issues/19; https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html
CVE: CVE-2020-11729
Published: 2020-04-15
Description: An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650; https://gitlab.com/davical-project/awl/-/issues/18; https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html
CVE: CVE-2020-11779
Published: 2020-04-15
Description: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, XR500 before 2.3.2.56, and XR700 before 1.0.1.10.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000061751/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2018-0527; https://kb.netgear.com/000061751/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2018-0527