deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10018
Published: 2020-03-02
Description: WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html; https://bugs.webkit.org/show_bug.cgi?id=204342#c21; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K/
CVE: CVE-2020-9751
Published: 2020-03-03
Description: Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-494, CWE-494
References: https://cve.naver.com/detail/cve-2020-9751; https://cve.naver.com/detail/cve-2020-9751
CVE: CVE-2019-3695
Published: 2020-03-03
Description: A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94, CWE-94
References: https://bugzilla.suse.com/show_bug.cgi?id=1152763; https://bugzilla.suse.com/show_bug.cgi?id=1152763
CVE: CVE-2019-3696
Published: 2020-03-03
Description: A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.
CVSS Score: 8.4 (HIGH)
CWE: CWE-22, CWE-22
References: https://bugzilla.suse.com/show_bug.cgi?id=1153921; https://bugzilla.suse.com/show_bug.cgi?id=1153921
CVE: CVE-2020-4196
Published: 2020-03-03
Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174907.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174907; https://www.ibm.com/support/pages/node/5690828; https://exchange.xforce.ibmcloud.com/vulnerabilities/174907
CVE: CVE-2020-4197
Published: 2020-03-03
Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908.
CVSS Score: 2.4 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174908; https://www.ibm.com/support/pages/node/5690822; https://exchange.xforce.ibmcloud.com/vulnerabilities/174908
CVE: CVE-2020-4198
Published: 2020-03-03
Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174909.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174909; https://www.ibm.com/support/pages/node/5690840; https://exchange.xforce.ibmcloud.com/vulnerabilities/174909
CVE: CVE-2019-12915
Published: 2020-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-12916
Published: 2020-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-17549
Published: 2020-03-03
Description: ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user to stop (kill) ESET processes. An attacker can abuse this bug to stop the protection from ESET and launch his attack.
CVSS Score: 6.5 (MEDIUM)
References: https://danishcyberdefence.dk/blog/esets-cyber-security; https://danishcyberdefence.dk/blog/esets-cyber-security
CVE: CVE-2019-19792
Published: 2020-03-03
Description: A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to root-owned files.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://danishcyberdefence.dk/blog/esets-cyber-security; https://danishcyberdefence.dk/blog/esets-cyber-security
CVE: CVE-2020-1888
Published: 2020-03-03
Description: Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/facebook/hhvm/commit/b3679121bb3c7017ff04b4c08402ffff5cf59b13; https://hhvm.com/blog/2020/02/20/security-update.html; https://github.com/facebook/hhvm/commit/b3679121bb3c7017ff04b4c08402ffff5cf59b13
CVE: CVE-2020-1892
Published: 2020-03-03
Description: Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/facebook/hhvm/commit/dabd48caf74995e605f1700344f1ff4a5d83441d; https://hhvm.com/blog/2020/02/20/security-update.html; https://github.com/facebook/hhvm/commit/dabd48caf74995e605f1700344f1ff4a5d83441d
CVE: CVE-2020-1893
Published: 2020-03-03
Description: Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7; https://hhvm.com/blog/2020/02/20/security-update.html; https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7
CVE: CVE-2020-5404
Published: 2020-03-03
Description: The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://pivotal.io/security/cve-2020-5404; https://pivotal.io/security/cve-2020-5404
CVE: CVE-2020-5403
Published: 2020-03-03
Description: Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-755
References: https://pivotal.io/security/cve-2020-5403; https://pivotal.io/security/cve-2020-5403
CVE: CVE-2020-1734
Published: 2020-03-03
Description: A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734; https://github.com/ansible/ansible/issues/67792; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734
CVE: CVE-2020-5535
Published: 2020-03-04
Description: OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN19666251/index.html; https://www.plathome.co.jp/software/vx2-v4-0-0/; https://jvn.jp/en/jp/JVN19666251/index.html
CVE: CVE-2020-5536
Published: 2020-03-04
Description: OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to bypass authentication and to initialize the device via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN19666251/index.html; https://www.plathome.co.jp/software/vx2-v4-0-0/; https://jvn.jp/en/jp/JVN19666251/index.html
CVE: CVE-2019-3404
Published: 2020-03-04
Description: By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 router P0 and F5C.
CVSS Score: 7.5 (HIGH)
References: https://security.360.cn/News/news/id/218.html; https://security.360.cn/News/news/id/218.html
CVE: CVE-2019-8401
Published: 2020-03-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-10029
Published: 2020-03-04
Description: The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d[PII_REDACTED]41410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/
CVE: CVE-2020-5251
Published: 2020-03-04
Description: In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da[PII_REDACTED]cb767de14de269; https://github.com/parse-community/parse-server/security/advisories/GHSA-h4mf-75hf-67w4; https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da[PII_REDACTED]cb767de14de269
CVE: CVE-2020-9364
Published: 2020-03-04
Description: An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the "Send me a copy" option to receive any files of the filesystem via email.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/156655/Creative-Contact-Form-4.6.2-Directory-Traversal.html; http://seclists.org/fulldisclosure/2020/Mar/13; https://extensions.joomla.org/extension/creative-contact-form/
CVE: CVE-2020-7988
Published: 2020-03-04
Description: An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://pastebin.com/ZPECbgZb; https://phpipam.net/news/phpipam-v1-5-released/; https://pastebin.com/ZPECbgZb
CVE: CVE-2020-9757
Published: 2020-03-04
Description: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt; https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md; https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
CVE: CVE-2020-9761
Published: 2020-03-04
Description: An issue was discovered in UNCTAD ASYCUDA World 2001 through 2020. The Java RMI Server has an Insecure Default Configuration, leading to Java Code Execution from a remote URL because an RMI Distributed Garbage Collector method is called.
CVSS Score: 9.8 (CRITICAL)
References: https://pastebin.com/jP4thzzG; https://unctad.org/en/Pages/DTL/TTL/ASYCUDA-Programme.aspx; https://pastebin.com/jP4thzzG
CVE: CVE-2019-19222
Published: 2020-03-04
Description: A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an authenticated attacker to inject arbitrary JavaScript code into the info.html administration page by sending a crafted Forms/wireless_autonetwork_1 POST request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities; https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19222.md; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-19223
Published: 2020-03-04
Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-444
References: https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities; https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19223.md; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-19224
Published: 2020-03-04
Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (binary file) settings by submitting a rom-0 GET request without being authenticated on the admin interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities; https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19224.md; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-19225
Published: 2020-03-04
Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns_1 POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities; https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19225.md; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-19226
Published: 2020-03-04
Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter_1 POST request without being authenticated on the admin interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities; https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19226.md; https://www.dlink.com/en/security-bulletin
CVE: CVE-2020-10057
Published: 2020-03-04
Description: GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/J3rryBl4nks/GenixCMS/blob/master/CreateAdminBAC.md; https://github.com/J3rryBl4nks/GenixCMS/blob/master/CreateAdminBAC.md
CVE: CVE-2020-3127
Published: 2020-03-04
Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements within a Webex recording that is stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a malicious ARF or WRF file to a user through a link or email attachment and persuading the user to open the file on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200304-webex-player; https://www.zerodayinitiative.com/advisories/ZDI-20-269/; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200304-webex-player
CVE: CVE-2020-3128
Published: 2020-03-04
Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements within a Webex recording that is stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a malicious ARF or WRF file to a user through a link or email attachment and persuading the user to open the file on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200304-webex-player; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200304-webex-player
CVE: CVE-2020-3148
Published: 2020-03-04
Description: A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An attacker could exploit this vulnerability by persuading a targeted user, with an active administrative session on the affected device, to click a malicious link. A successful exploit could allow an attacker to change the device's configuration, which could include the ability to edit or create user accounts of any privilege level. Some changes to the device's configuration could negatively impact the availability of networking services for other devices on networks managed by CPNR.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cpnr-csrf-WWTrDkyL; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cpnr-csrf-WWTrDkyL
CVE: CVE-2020-3155
Published: 2020-03-04
Description: A vulnerability in the SSL implementation of the Cisco Intelligent Proximity solution could allow an unauthenticated, remote attacker to view or alter information shared on Cisco Webex video devices and Cisco collaboration endpoints if the products meet the conditions described in the Vulnerable Products section. The vulnerability is due to a lack of validation of the SSL server certificate received when establishing a connection to a Cisco Webex video device or a Cisco collaboration endpoint. An attacker could exploit this vulnerability by using man in the middle (MITM) techniques to intercept the traffic between the affected client and an endpoint, and then using a forged certificate to impersonate the endpoint. Depending on the configuration of the endpoint, an exploit could allow the attacker to view presentation content shared on it, modify any content being presented by the victim, or have access to call controls. This vulnerability does not affect cloud registered collaboration endpoints.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-proximity-ssl-cert-gBBu3RB; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-proximity-ssl-cert-gBBu3RB