deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13464
Published: 2020-08-31
Description: The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmware via the debug interface by utilizing the CPU or DMA module.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13465
Published: 2020-08-31
Description: The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via the debug interface.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13466
Published: 2020-08-31
Description: STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration.
CVSS Score: 6.8 (MEDIUM)
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13467
Published: 2020-08-31
Description: The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmware via the debug interface and exception handling.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-755
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13468
Published: 2020-08-31
Description: Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding wires (which have insufficient physical protection).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-276
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13469
Published: 2020-08-31
Description: The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface by utilizing the CPU.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-668
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13470
Published: 2020-08-31
Description: Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de-obfuscation of the observed data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-668
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13471
Published: 2020-08-31
Description: Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration.
CVSS Score: 6.8 (MEDIUM)
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13472
Published: 2020-08-31
Description: The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the debug interface by utilizing the DMA module.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-668
References: https://www.usenix.org/system/files/woot20-paper-obermaier.pdf; https://www.usenix.org/system/files/woot20-paper-obermaier.pdf
CVE: CVE-2020-13828
Published: 2020-08-31
Description: Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with the alias or barcode parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-002; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-002
CVE: CVE-2020-15687
Published: 2020-08-31
Description: Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root access in the Service VM userspace, to abuse the PCIe assign/de-assign Hypercalls via crafted ioctls and payloads. This attack results in a corrupt state and Denial of Service (DoS) for previously assigned PCIe devices to the Service VM at runtime.
CVSS Score: 7.5 (HIGH)
References: https://projectacrn.github.io/2.1/asa.html#addressed-in-acrn-v2-1; https://projectacrn.github.io/latest/; https://projectacrn.github.io/latest/developer-guides/hld/split-dm.html
CVE: CVE-2020-17465
Published: 2020-08-31
Description: Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/gajendkmr/261f45e06c41656131a651c920c7f406; https://www.nccgroup.com/us/our-research/?research=Technical+advisories; https://gist.github.com/gajendkmr/261f45e06c41656131a651c920c7f406
CVE: CVE-2020-20625
Published: 2020-08-31
Description: Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://blog.nintechnet.com/multiple-vulnerabilities-in-sliced-invoices-plugin/; https://blog.nintechnet.com/multiple-vulnerabilities-in-sliced-invoices-plugin/
CVE: CVE-2020-20626
Published: 2020-08-31
Description: lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.nintechnet.com/zero-day-vulnerability-exploited-in-wordpress-lara-google-analytics-plugin/; https://blog.nintechnet.com/zero-day-vulnerability-exploited-in-wordpress-lara-google-analytics-plugin/
CVE: CVE-2020-20627
Published: 2020-08-31
Description: The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-wordpress-givewp-plugin/; https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-wordpress-givewp-plugin/
CVE: CVE-2020-24363
Published: 2020-08-31
Description: TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/; https://pastebin.com/VjHM4UiA; https://www.tp-link.com/us/support/download/tl-wa855re/#Firmware
CVE: CVE-2020-24699
Published: 2020-08-31
Description: The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://l0l.xyz/sec/2020/08/31/1-wordpress-crm-xss.html; https://wordpress.org/plugins/chamber-dashboard-business-directory/#developers; https://l0l.xyz/sec/2020/08/31/1-wordpress-crm-xss.html
CVE: CVE-2020-20628
Published: 2020-08-31
Description: controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/; https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/
CVE: CVE-2020-7521
Published: 2020-08-31
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earlier) when accessing a vulnerable method of `FileUploadServlet` which may lead to uploading executable files to non-specified directories.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-04/; https://www.se.com/ww/en/download/document/SEVD-2020-224-04/
CVE: CVE-2020-7522
Published: 2020-08-31
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earlier) when accessing a vulnerable method of `SoundUploadServlet` which may lead to uploading executable files to non-specified directories.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-04/; https://www.se.com/ww/en/download/document/SEVD-2020-224-04/
CVE: CVE-2020-7523
Published: 2020-08-31
Description: Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-01/; https://www.se.com/ww/en/download/document/SEVD-2020-224-01/
CVE: CVE-2020-7524
Published: 2020-08-31
Description: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when sending specific crafted IPV4 packet to the controller: Sending a specific IPv4 protocol package to Schneider Electric Modicon M218 Logic Controller can cause IPv4 devices to go down. The device does not work properly and must be powered back on to return to normal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-03/; https://www.se.com/ww/en/download/document/SEVD-2020-224-03/
CVE: CVE-2020-7525
Published: 2020-08-31
Description: Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) which could allow an attacker to guess a password when brute force is used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-02/; https://www.se.com/ww/en/download/document/SEVD-2020-224-02/
CVE: CVE-2020-7526
Published: 2020-08-31
Description: Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could cause remote code execution when a script is executed during a shutdown event.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-05/; https://www.se.com/ww/en/download/document/SEVD-2020-224-05/
CVE: CVE-2020-7527
Published: 2020-08-31
Description: Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full access control to local system users to SoMove component and services when a SoMove installer script is launched.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.se.com/ww/en/download/document/SEVD-2020-224-07/; https://www.se.com/ww/en/download/document/SEVD-2020-224-07/
CVE: CVE-2020-14364
Published: 2020-08-31
Description: An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html; https://bugzilla.redhat.com/show_bug.cgi?id=1869201; https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html
CVE: CVE-2020-24354
Published: 2020-08-31
Description: Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B; https://www.zyxel.com/support/security_advisories.shtml; https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
CVE: CVE-2020-2075
Published: 2020-08-31
Description: Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703, CWE-755
References: https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE: CVE-2020-25046
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks address information via kernel logging. The Samsung IDs are SVE-2020-17602, SVE-2020-17603, SVE-2020-17604 (August 2020).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25047
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software. The S Secure application does not enforce the intended password requirement for a locked application. The Samsung IDs are SVE-2020-16746, SVE-2020-16764 (August 2020).
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25048
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software. In the Lockscreen state, the Quick Share feature allows unauthenticated downloads, aka file injection. The Samsung ID is SVE-2020-17760 (August 2020).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25049
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService has insufficient DEX access control. The Samsung ID is SVE-2020-17797 (August 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25050
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The CMC service allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 (August 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25051
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via AppInfo. The Samsung ID is SVE-2020-17758 (August 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25052
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. H-Arx allows attackers to execute arbitrary code or cause a denial of service (memory corruption) because indexes are mishandled. The Samsung ID is SVE-2020-17426 (August 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25053
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-17435 (August 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25054
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shannon baseband. The Samsung ID is SVE-2020-17239 (August 2020).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25055
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged SecureFolder process) to bypass admin restrictions in KnoxContainer. The Samsung ID is SVE-2020-18133 (August 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25056
Published: 2020-08-31
Description: An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software. Because HAL improperly checks versions, bootloading by the S.LSI NFC chipset is mishandled. The Samsung ID is SVE-2020-16169 (August 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-25057
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 10 software. MDMService does not properly restrict APK installations. The LG ID is LVE-SMP-200011 (July 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25058
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management service does not properly restrict configuration changes. The LG ID is LVE-SMP-200012 (July 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25059
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A service crash may occur because of incorrect input validation. The LG ID is LVE-SMP-200013 (July 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25060
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Local users can gain privileges because of LAF and SBL1 flaws. The LG ID is LVE-SMP-200015 (July 2020).
CVSS Score: 7.8 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25061
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. lge_property allows property overwrites. The LG ID is LVE-SMP-200016 (July 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25062
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 9 and 10 software. LGTelephonyProvider allows a bypass of intended privilege restrictions. The LG ID is LVE-SMP-200017 (July 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25063
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. An application crash can occur because of incorrect application-level input validation. The LG ID is LVE-SMP-200018 (July 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25064
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Certain automated testing is mishandled. The LG ID is LVE-SMP-200019 (August 2020).
CVSS Score: 7.5 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25065
Published: 2020-08-31
Description: An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Key logging may occur because of an obsolete API. The LG ID is LVE-SMP-170010 (August 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-15704
Published: 2020-09-01
Description: The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2, 2.4.7-1+2ubuntu1.16.04.3, 2.4.7-2+2ubuntu1.3, 2.4.7-2+4.1ubuntu5.1, 2.4.7-2+4.1ubuntu6. Was ZDI-CAN-11504.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-20
References: https://ubuntu.com/security/notices/USN-4451-1; https://ubuntu.com/security/notices/USN-4451-2; https://ubuntu.com/security/notices/USN-4451-1
CVE: CVE-2020-25067
Published: 2020-09-01
Description: NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000062158/Security-Advisory-for-Pre-Authentication-Command-Injection-on-R8300-PSV-2020-0211; https://kb.netgear.com/000062158/Security-Advisory-for-Pre-Authentication-Command-Injection-on-R8300-PSV-2020-0211
CVE: CVE-2020-14178
Published: 2020-09-01
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.
CVSS Score: 7.5 (HIGH)
References: https://jira.atlassian.com/browse/JRASERVER-71498; https://jira.atlassian.com/browse/JRASERVER-71498
CVE: CVE-2020-12776
Published: 2020-09-01
Description: Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.
CVSS Score: 6.6 (MEDIUM)
References: https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html; https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html
CVE: CVE-2020-7713
Published: 2020-09-01
Description: All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-ARRFLATTENUNFLATTEN-598396; https://snyk.io/vuln/SNYK-JS-ARRFLATTENUNFLATTEN-598396
CVE: CVE-2020-7714
Published: 2020-09-01
Description: All versions of package confucious are vulnerable to Prototype Pollution via the set function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-CONFUCIOUS-598665; https://snyk.io/vuln/SNYK-JS-CONFUCIOUS-598665