deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-14437
Published: 2020-06-18
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000061940/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0054; https://kb.netgear.com/000061940/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0054
CVE: CVE-2020-14438
Published: 2020-06-18
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000061941/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0063; https://kb.netgear.com/000061941/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0063
CVE: CVE-2020-14439
Published: 2020-06-18
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000061942/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0064; https://kb.netgear.com/000061942/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0064
CVE: CVE-2020-14440
Published: 2020-06-18
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000061943/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0065; https://kb.netgear.com/000061943/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0065
CVE: CVE-2020-14441
Published: 2020-06-18
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000061946/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0071; https://kb.netgear.com/000061946/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0071
CVE: CVE-2020-14442
Published: 2020-06-18
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000061947/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0103; https://kb.netgear.com/000061947/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0103
CVE: CVE-2019-13033
Published: 2020-06-18
Description: In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://cisofy.com/security/cve/cve-2019-13033/; https://lists.debian.org/debian-lts-announce/2020/06/msg00024.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/
CVE: CVE-2020-13882
Published: 2020-06-18
Description: CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-367
References: https://cisofy.com/security/cve/cve-2020-13882/; https://cwe.mitre.org/data/definitions/367.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/
CVE: CVE-2020-14443
Published: 2020-06-18
Description: A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba; https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba
CVE: CVE-2020-14444
Published: 2020-06-18
Description: An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2020-14444-wso2.html; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0707; https://cybersecurityworks.com/zerodays/cve-2020-14444-wso2.html
CVE: CVE-2020-14445
Published: 2020-06-18
Description: An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2020-14445-wso2.html; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0711; https://cybersecurityworks.com/zerodays/cve-2020-14445-wso2.html
CVE: CVE-2020-14446
Published: 2020-06-18
Description: An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://cybersecurityworks.com/zerodays/cve-2020-14446-wso2.html; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0713; https://cybersecurityworks.com/zerodays/cve-2020-14446-wso2.html
CVE: CVE-2020-12883
Published: 2020-06-18
Description: Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the option delta and option length bytes. The actual input packet length is not verified against the number of bytes read when processing the option extended delta and the option extended length. Moreover, the calculation of the message_left variable, in the case of non-extended option deltas, is incorrect and indicates more data left for processing than provided in the function input. All of these lead to heap-based or stack-based memory location read access that is outside of the intended boundary of the buffer. Depending on the platform-specific memory management mechanisms, it can lead to processing of unintended inputs or system memory access violation errors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/ARMmbed/mbed-coap/pull/116; https://github.com/ARMmbed/mbed-os/issues/12925; https://github.com/ARMmbed/mbed-os/issues/12926
CVE: CVE-2020-12884
Published: 2020-06-18
Description: A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options that may occur multiple consecutive times in a single packet. While processing the options, packet_data_pptr is accessed after being incremented by option_len without a prior out-of-bounds memory check. The temp_parsed_uri_query_ptr is validated for a correct range, but the range valid for temp_parsed_uri_query_ptr is derived from the amount of allocated heap memory, not the actual input size. Therefore the check of temp_parsed_uri_query_ptr may be insufficient for safe access to the area pointed to by packet_data_pptr. As a result, access to a memory area outside of the intended boundary of the packet buffer is made.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/ARMmbed/mbed-coap/pull/116; https://github.com/ARMmbed/mbed-os/issues/12928; https://github.com/ARMmbed/mbed-coap/pull/116
CVE: CVE-2020-12885
Published: 2020-06-18
Description: An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options in a while loop. This loop's exit condition is computed using the previously allocated heap memory required for storing the result of parsing multiple options. If the input heap memory calculation results in zero bytes, the loop exit condition is never met and the loop is not terminated. As a result, the packet parsing function never exits, leading to resource consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/ARMmbed/mbed-coap/pull/116; https://github.com/ARMmbed/mbed-os/issues/12929; https://github.com/ARMmbed/mbed-coap/pull/116
CVE: CVE-2020-12886
Published: 2020-06-18
Description: A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP packet header starting from the message token. The length of the token in the received message is provided in the first byte parsed by the sn_coap_parser_options_parse() function. The length encoded in the message is not validated against the actual input buffer length before accessing the token. As a result, memory access outside of the intended boundary of the buffer may occur.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/ARMmbed/mbed-coap/pull/116; https://github.com/ARMmbed/mbed-os/issues/12948; https://github.com/ARMmbed/mbed-coap/pull/116
CVE: CVE-2020-12887
Published: 2020-06-18
Description: Memory leaks were discovered in the CoAP library in Arm Mbed OS 5.15.3 when using the Arm mbed-coap library 5.1.5. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP option number field of all options present in the input packet. Each option number is calculated as a sum of the previous option number and a delta of the current option. The delta and the previous option number are expressed as unsigned 16-bit integers. Due to lack of overflow detection, it is possible to craft a packet that wraps the option number around and results in the same option number being processed again in a single packet. Certain options allocate memory by calling a memory allocation function. In the cases of COAP_OPTION_URI_QUERY, COAP_OPTION_URI_PATH, COAP_OPTION_LOCATION_QUERY, and COAP_OPTION_ETAG, there is no check on whether memory has already been allocated, which in conjunction with the option number integer overflow may lead to multiple assignments of allocated memory to a single pointer. This has been demonstrated to lead to memory leak by buffer orphaning. As a result, the memory is never freed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-401
References: https://github.com/ARMmbed/mbed-coap/pull/116; https://github.com/ARMmbed/mbed-os/issues/12930; https://github.com/ARMmbed/mbed-os/issues/12957
CVE: CVE-2020-4059
Published: 2020-06-18
Description: In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in npm. As a workaround, make sure to escape git commit messages when using the commitMessage option for the update function.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/mikaelbr/mversion/commit/6c76c9efd27c7ff5a5c6f187e8b7a435c4722338; https://github.com/mikaelbr/mversion/security/advisories/GHSA-qjg4-w4c6-f6c6; https://github.com/mikaelbr/mversion/commit/6c76c9efd27c7ff5a5c6f187e8b7a435c4722338
CVE: CVE-2020-5590
Published: 2020-06-19
Description: Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN77458946/index.html; https://www.ec-cube.net/info/weakness/weakness.php?id=73; https://www.ec-cube.net/info/weakness/weakness.php?id=74
CVE: CVE-2020-14019
Published: 2020-06-19
Description: Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html; https://github.com/open-iscsi/rtslib-fb/pull/162; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH/
CVE: CVE-2020-7679
Published: 2020-06-19
Description: In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/casperjs/casperjs/blob/master/modules/utils.js%23L680; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-572804; https://snyk.io/vuln/SNYK-JS-CASPERJS-572803
CVE: CVE-2020-14462
Published: 2020-06-19
Description: CALDERA 2.7.0 allows XSS via the Operation Name box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mitre/caldera/issues/1755; https://github.com/mitre/caldera/issues/1755
CVE: CVE-2019-20841
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20842
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20843
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20844
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-924
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20845
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20846
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20847
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.
CVSS Score: 5.3 (MEDIUM)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20848
Published: 2020-06-19
Description: An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20849
Published: 2020-06-19
Description: An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20850
Published: 2020-06-19
Description: An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14447
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14448
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14449
Published: 2020-06-19
Description: An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018.
CVSS Score: 7.5 (HIGH)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14450
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017.
CVSS Score: 7.5 (HIGH)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14451
Published: 2020-06-19
Description: An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14452
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14453
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14454
Published: 2020-06-19
Description: An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14455
Published: 2020-06-19
Description: An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14456
Published: 2020-06-19
Description: An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006.
CVSS Score: 7.3 (HIGH)
CWE: CWE-346
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14457
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.
CVSS Score: 5.3 (MEDIUM)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14458
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.
CVSS Score: 7.5 (HIGH)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14459
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14460
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.
CVSS Score: 6.5 (MEDIUM)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2019-20851
Published: 2020-06-19
Description: An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/