deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-20398
Published: 2020-01-22
Description: A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793935; https://github.com/CESNET/libyang/commit/7852b272ef77f8098c35deea6c6f09cb78176f08; https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3
CVE: CVE-2020-7915
Published: 2020-01-22
Description: An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sku11army.blogspot.com/2020/01/eaton-authenticated-stored-cross-site.html; https://sku11army.blogspot.com/2020/01/eaton-authenticated-stored-cross-site.html
CVE: CVE-2019-20399
Published: 2020-01-23
Description: A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/paritytech/libsecp256k1/commit/11ba23a9766a5079918cd9f515bc100bc8164b50; https://github.com/paritytech/libsecp256k1/commit/11ba23a9766a5079918cd9f515bc100bc8164b50
CVE: CVE-2020-5223
Published: 2020-01-23
Description: In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrivateBin/PrivateBin/commit/8d0ac336d23cd8c98e71d5f21cdadcae9c8a26e6; https://github.com/PrivateBin/PrivateBin/issues/554; https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-8j72-p2wm-6738
CVE: CVE-2020-5216
Published: 2020-01-23
Description: In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-113, CWE-74
References: https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0; https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg; https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0
CVE: CVE-2020-5217
Published: 2020-01-23
Description: In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-95, CWE-74
References: https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3; https://github.com/twitter/secure_headers/issues/418; https://github.com/twitter/secure_headers/pull/421
CVE: CVE-2019-19835
Published: 2020-01-23
Description: SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-19837
Published: 2020-01-23
Description: Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
CVSS Score: 5.3 (MEDIUM)
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2020-7210
Published: 2020-01-23
Description: Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/156062/Umbraco-CMS-8.2.2-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2020/Jan/33; https://sec-consult.com/en/blog/advisories/cross-site-request-forgery-csrf-in-umbraco-cms/
CVE: CVE-2019-18898
Published: 2020-01-23
Description: UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-59, CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00066.html; https://bugzilla.suse.com/show_bug.cgi?id=1157651; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00066.html
CVE: CVE-2008-7314
Published: 2020-01-23
Description: mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.mirc.com/news.html; https://www.mirc.com/versions.txt; http://www.mirc.com/news.html
CVE: CVE-2012-2087
Published: 2020-01-23
Description: ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://www.openwall.com/lists/oss-security/2012/04/08/3; http://www.openwall.com/lists/oss-security/2012/04/09/4; https://exchange.xforce.ibmcloud.com/vulnerabilities/74739
CVE: CVE-2012-4863
Published: 2020-01-23
Description: IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/79920; https://www.tenable.com/plugins/nessus/63099; https://exchange.xforce.ibmcloud.com/vulnerabilities/79920
CVE: CVE-2012-4900
Published: 2020-01-23
Description: Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/58384; http://www.securitytracker.com/id/1028257; https://exchange.xforce.ibmcloud.com/vulnerabilities/82674
CVE: CVE-2012-4981
Published: 2020-01-23
Description: Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/55643; https://exchange.xforce.ibmcloud.com/vulnerabilities/78800; http://www.securityfocus.com/bid/55643
CVE: CVE-2012-5698
Published: 2020-01-23
Description: BabyGekko before 1.2.4 has SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/56523; https://exchange.xforce.ibmcloud.com/vulnerabilities/80085; http://www.securityfocus.com/bid/56523
CVE: CVE-2012-5699
Published: 2020-01-23
Description: BabyGekko before 1.2.4 allows PHP file inclusion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/56523; https://exchange.xforce.ibmcloud.com/vulnerabilities/80086; http://www.securityfocus.com/bid/56523
CVE: CVE-2012-5867
Published: 2020-01-23
Description: HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2012/11/14/15; http://www.securityfocus.com/bid/47095; http://www.openwall.com/lists/oss-security/2012/11/14/15
CVE: CVE-2013-4175
Published: 2020-01-23
Description: MySecureShell 1.31 has a Local Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2013/07/27/5; http://www.securityfocus.com/bid/61410; http://www.openwall.com/lists/oss-security/2013/07/27/5
CVE: CVE-2013-4176
Published: 2020-01-23
Description: mysecureshell 1.31: Local Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2013/07/27/6; http://www.securityfocus.com/bid/61409; http://www.openwall.com/lists/oss-security/2013/07/27/6
CVE: CVE-2013-6358
Published: 2020-01-23
Description: PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://web.archive.org/web/[PII_REDACTED]1900/http://labs.davidsopas.com/2013/10/how-salesman-could-hack-prestashop.html; https://web.archive.org/web/[PII_REDACTED]1900/http://labs.davidsopas.com/2013/10/how-salesman-could-hack-prestashop.html
CVE: CVE-2013-6772
Published: 2020-01-23
Description: Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://www.splunk.com/view/SP-CAAAH32; http://www.splunk.com/view/SP-CAAAH32
CVE: CVE-2013-6773
Published: 2020-01-23
Description: Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.splunk.com/view/SP-CAAAHXG; http://www.splunk.com/view/SP-CAAAHXG
CVE: CVE-2013-6785
Published: 2020-01-23
Description: Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://blog.rapid7.com/2013/11/06/supermicro-ipmi-firmware-vulnerabilities/; https://www.tenable.com/cve/CVE-2013-6785; https://blog.rapid7.com/2013/11/06/supermicro-ipmi-firmware-vulnerabilities/
CVE: CVE-2013-6792
Published: 2020-01-23
Description: Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/64529; http://www.securityfocus.com/bid/64529
CVE: CVE-2014-7238
Published: 2020-01-23
Description: The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8235; https://wpvulndb.com/vulnerabilities/8235
CVE: CVE-2[PII_REDACTED]
Published: 2020-01-23
Description: sanitize-html before 1.4.3 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://nodesecurity.io/advisories/135; https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2[PII_REDACTED].json; https://nodesecurity.io/advisories/135
CVE: CVE-2019-17201
Published: 2020-01-23
Description: FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service (Audckq32.exe) using a .NET named pipe. If the underlying service responds that a user is permitted access to the elevation feature, the client then reinitiates communication with the underlying service and requests elevation. This elevation request has no local checks in the service, and depends on client-side validation in the AdminByRequest.exe interface, i.e., it is a vulnerable exposed functionality in the service. By communicating directly with the underlying service, any user can request elevation and obtain Administrator privilege regardless of group policies or permissions.
CVSS Score: 7.8 (HIGH)
References: https://improsec.com/en/responsible-disclosure; https://www.adminbyrequest.com/en/releasenotes; https://improsec.com/en/responsible-disclosure
CVE: CVE-2019-17202
Published: 2020-01-23
Description: FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a challenge-response manner upon attempting to elevate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and device name) available to all users, and thus any user can elevate to Administrator privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://improsec.com/en/responsible-disclosure; https://www.adminbyrequest.com/en/releasenotes; https://improsec.com/en/responsible-disclosure
CVE: CVE-2019-18899
Published: 2020-01-23
Description: The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-269, CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html; https://bugzilla.suse.com/show_bug.cgi?id=1157703
CVE: CVE-2019-19838
Published: 2020-01-23
Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-19839
Published: 2020-01-23
Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/_cmdstat.jsp via the uploadFile attribute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2020-6843
Published: 2020-01-23
Description: Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156050/ZOHO-ManageEngine-ServiceDeskPlus-11.0-Build-11007-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2020/Jan/32; https://sec-consult.com/en/vulnerability-lab/advisories/index.html
CVE: CVE-2020-7931
Published: 2020-01-23
Description: In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.
CVSS Score: 8.8 (HIGH)
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md; https://www.jfrog.com/confluence/display/RTF/Release+Notes; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md
CVE: CVE-2007-6758
Published: 2020-01-23
Description: Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: http://attrition.org/pipermail/vim/2007-April/001545.html; http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://attrition.org/pipermail/vim/2007-April/001545.html
CVE: CVE-2010-3295
Published: 2020-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-3691
Published: 2020-01-23
Description: A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE Factory munge versions prior to 0.5.13-6.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-59, CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1155075; https://bugzilla.suse.com/show_bug.cgi?id=1155075
CVE: CVE-2014-3606
Published: 2020-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2019-14888
Published: 2020-01-23
Description: A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2020:0729; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-16153
Published: 2020-01-23
Description: A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://fortiguard.com/advisory/FG-IR-19-195; https://fortiguard.com/advisory/FG-IR-19-195
CVE: CVE-2019-18222
Published: 2020-01-23
Description: The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/
CVE: CVE-2019-5593
Published: 2020-01-23
Description: Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded local certificates via setting an empty password in FortiOS 6.2.1, 6.2.0, 6.0.6 and below.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://fortiguard.com/psirt/FG-IR-19-134; https://fortiguard.com/psirt/FG-IR-19-134
CVE: CVE-2012-6083
Published: 2020-01-23
Description: Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2012/12/31/2; https://freeciv.fandom.com/wiki/NEWS-2.3.3; http://www.openwall.com/lists/oss-security/2012/12/31/2
CVE: CVE-2019-15707
Published: 2020-01-23
Description: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.
CVSS Score: 4.9 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-19-237; https://fortiguard.com/advisory/FG-IR-19-237
CVE: CVE-2019-15712
Published: 2020-01-23
Description: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.
CVSS Score: 7.2 (HIGH)
References: https://fortiguard.com/advisory/FG-IR-19-237; https://fortiguard.com/advisory/FG-IR-19-237
CVE: CVE-2019-16512
Published: 2020-01-23
Description: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34; https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/connectwise-control
CVE: CVE-2019-16513
Published: 2020-01-23
Description: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34; https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/connectwise-control
CVE: CVE-2019-16514
Published: 2020-01-23
Description: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34; https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/connectwise-control
CVE: CVE-2019-16515
Published: 2020-01-23
Description: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34; https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/connectwise-control
CVE: CVE-2019-16516
Published: 2020-01-23
Description: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://packetstormsecurity.com/files/165432/ConnectWise-Control-19.2.24707-Username-Enumeration.html; https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34; https://know.bishopfox.com/advisories
CVE: CVE-2019-16517
Published: 2020-01-23
Description: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34; https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/connectwise-control