deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3320
Published: 2020-10-08
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by first entering input within the web-based management interface and then persuading a user of the interface to view the crafted input within the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-yLrjqqU; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-yLrjqqU
CVE: CVE-2020-3467
Published: 2020-10-08
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. The vulnerability is due to improper enforcement of role-based access control (RBAC) within the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to modify parts of the configuration. The modified configuration could either allow unauthorized devices onto the network or prevent authorized devices from accessing the network. To exploit this vulnerability, an attacker would need valid Read-Only Administrator credentials.
CVSS Score: 7.7 (HIGH)
CWE: CWE-863, CWE-863
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-uJWqLTZM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-uJWqLTZM
CVE: CVE-2020-3535
Published: 2020-10-08
Description: A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credentials on the Windows system. The vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file in a specific location on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with the privileges of another user&rsquo;s account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-dll-drsnH5AN; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-dll-drsnH5AN
CVE: CVE-2020-3536
Published: 2020-10-08
Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-xss-xXeLFpC3; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-xss-xXeLFpC3
CVE: CVE-2020-3543
Published: 2020-10-08
Description: A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of certain Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending certain Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DOS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdp-memleak-heyebx9; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdp-memleak-heyebx9
CVE: CVE-2020-3544
Published: 2020-10-08
Description: A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute arbitrary code on an affected device or cause the device to reload. This vulnerability is due to missing checks when an IP camera processes a Cisco Discovery Protocol packet. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected IP camera or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdp-rcedos-mAHR8vNx; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdp-rcedos-mAHR8vNx
CVE: CVE-2020-3567
Published: 2020-10-08
Description: A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remote attacker to cause the CPU utilization to increase to 100 percent, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of requests sent to the REST API. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to cause a permanent DoS condition that is due to high CPU utilization. Manual intervention may be required to recover the Cisco IND.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-dos-BwG634zn; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-dos-BwG634zn
CVE: CVE-2020-3568
Published: 2020-10-08
Description: A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-zZtugtg3; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-zZtugtg3
CVE: CVE-2020-3589
Published: 2020-10-08
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have valid administrative credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxs-mf5cbYx5; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxs-mf5cbYx5
CVE: CVE-2020-3596
Published: 2020-10-08
Description: A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handling of incoming SIP traffic. An attacker could exploit this vulnerability by sending a series of SIP packets to an affected device. A successful exploit could allow the attacker to exhaust memory on an affected device, causing it to crash and leading to a DoS condition.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-789, CWE-670
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-vcs-dos-n6xxTMZB; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-vcs-dos-n6xxTMZB
CVE: CVE-2020-3597
Published: 2020-10-08
Description: A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated, remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due to insufficient validation of configuration backup files. An attacker could exploit this vulnerability by persuading an administrator to restore a crafted configuration backup file. A successful exploit could allow the attacker to overwrite arbitrary files that are accessible through the affected software on an affected device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-path-traversal-wVDyXZPy; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-path-traversal-wVDyXZPy
CVE: CVE-2020-3598
Published: 2020-10-08
Description: A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to read confidential information or make configuration changes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvdsd-missing-auth-rQO88rnj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvdsd-missing-auth-rQO88rnj
CVE: CVE-2020-3601
Published: 2020-10-08
Description: A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. The vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user. To exploit this vulnerability, an attacker would need to have valid administrative credentials on an affected device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-priv-esc-gGCUMFxv; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-priv-esc-gGCUMFxv
CVE: CVE-2020-3602
Published: 2020-10-08
Description: A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. The vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user on the affected device. To exploit this vulnerability, an attacker would need to have valid credentials on an affected device and know the password for the cli test-commands command.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-privilege-esc-pyb7YTd; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-privilege-esc-pyb7YTd
CVE: CVE-2020-25262
Published: 2020-10-08
Description: PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/farid007/2af454d909fa5a60a07e4e547e99964e; https://github.com/pyrocms/pyrocms; https://pyrocms.com/
CVE: CVE-2020-25263
Published: 2020-10-08
Description: PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://gist.github.com/farid007/df51b0666643ec01d5571cbcc1e966e7; https://github.com/pyrocms/pyrocms; https://pyrocms.com/
CVE: CVE-2020-25270
Published: 2020-10-08
Description: PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/159614/Hostel-Management-System-2.1-Cross-Site-Scripting.html; https://github.com/Ko-kn3t/CVE-2020-25270; https://phpgurukul.com
CVE: CVE-2020-25271
Published: 2020-10-08
Description: PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/appointment-history.php, or admin/appointment-history.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Ko-kn3t/CVE-2020-25271; https://phpgurukul.com; https://github.com/Ko-kn3t/CVE-2020-25271
CVE: CVE-2020-25272
Published: 2020-10-08
Description: In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Ko-kn3t/CVE-2020-25272; https://www.sourcecodester.com; https://github.com/Ko-kn3t/CVE-2020-25272
CVE: CVE-2020-25273
Published: 2020-10-08
Description: In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Ko-kn3t/CVE-2020-25273; https://www.sourcecodester.com; https://github.com/Ko-kn3t/CVE-2020-25273
CVE: CVE-2020-26567
Published: 2020-10-08
Description: An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access reboots the device, rendering it therefore unusable for several minutes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-306
References: http://packetstormsecurity.com/files/159516/D-Link-DSR-250N-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2020/Oct/14; https://www.redteam-pentesting.de/advisories/rt-sa-2020-002
CVE: CVE-2020-2286
Published: 2020-10-08
Description: Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1767; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2287
Published: 2020-10-08
Description: Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for dispatching requests, which allows attackers to craft URLs that bypass request logging of any target URL.
CVSS Score: 5.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1815; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2288
Published: 2020-10-08
Description: In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.
CVSS Score: 5.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1846; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2289
Published: 2020-10-08
Description: Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1954; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2290
Published: 2020-10-08
Description: Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2008; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2291
Published: 2020-10-08
Description: Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 3.3 (LOW)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2065; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2292
Published: 2020-10-08
Description: Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1928; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2293
Published: 2020-10-08
Description: Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2046; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2294
Published: 2020-10-08
Description: Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2049; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2295
Published: 2020-10-08
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2049; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2296
Published: 2020-10-08
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2052; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2297
Published: 2020-10-08
Description: Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 3.3 (LOW)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2054; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2020-2298
Published: 2020-10-08
Description: Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/10/08/5; https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2097; http://www.openwall.com/lists/oss-security/2020/10/08/5
CVE: CVE-2019-4545
Published: 2020-10-08
Description: IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attacks. IBM X-Force ID: 165877.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165877; https://www.ibm.com/support/pages/node/6344077; https://exchange.xforce.ibmcloud.com/vulnerabilities/165877
CVE: CVE-2020-12400
Published: 2020-10-08
Description: When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1623116; https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html; https://www.mozilla.org/security/advisories/mfsa2020-36/
CVE: CVE-2020-12401
Published: 2020-10-08
Description: During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1631573; https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html; https://www.mozilla.org/security/advisories/mfsa2020-36/