deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6865
Published: 2020-04-30
Description: ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of failure to the request, the caller can directly view the internal error code location of the component. Attackers could exploit this vulnerability to obtain sensitive information. This affects: OSCP versions V16.19.10 and V16.19.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012782; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012782
CVE: CVE-2020-6866
Published: 2020-04-30
Description: A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to cause a denial of service by issuing a specific command. This affects: ZXCTN 6500 version V2.10.00R3B87.
CVSS Score: 4.9 (MEDIUM)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012803; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012803
CVE: CVE-2020-6867
Published: 2020-04-30
Description: ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the case of mass traffic data in the system, it will result in no response for a long time and memory overflow risk. This affects: ZENIC ONE R22b versions V16.19.10P02SP002 and V16.19.10P02SP005.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012842; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012842
CVE: CVE-2020-9098
Published: 2020-04-30
Description: Huawei OceanStor 5310 product with version of V500R007C60SPC100 has an invalid pointer access vulnerability. The software system access an invalid pointer when attacker malformed packet. Due to the insufficient validation of some parameter, successful exploit could cause device reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-763
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200429-01-invalidpointer-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200429-01-invalidpointer-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200429-01-invalidpointer-en
CVE: CVE-2020-11016
Published: 2020-04-30
Description: IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/certtools/intelmq-manager/commit/b9a2ac43a4f99d764b827108f6a99dc4a9faa013; https://github.com/certtools/intelmq-manager/releases/tag/2.1.1; https://github.com/certtools/intelmq-manager/security/advisories/GHSA-rrhh-rcgp-q2m2
CVE: CVE-2020-11026
Published: 2020-04-30
Description: In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS Score: 8.7 (HIGH)
CWE: CWE-707, CWE-79
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-3gw2-4656-pfr2; https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html; https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
CVE: CVE-2020-11027
Published: 2020-04-30
Description: In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-672, CWE-640
References: http://packetstormsecurity.com/files/173034/WordPress-Theme-Medic-1.0.0-Weak-Password-Recovery-Mechanism.html; https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ww7v-jg8c-q6jw; https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html
CVE: CVE-2020-11028
Published: 2020-04-30
Description: In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284, CWE-306
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w; https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html; https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
CVE: CVE-2020-11029
Published: 2020-04-30
Description: In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c; https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html; https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
CVE: CVE-2020-11030
Published: 2020-04-30
Description: In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjh; https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates; https://www.debian.org/security/2020/dsa-4677
CVE: CVE-2020-11037
Published: 2020-04-30
Description: In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ).

Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.

This has been patched in 2.7.3, 2.8.2, 2.9.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-208, CWE-362
References: https://github.com/wagtail/wagtail/commit/3c030490ed575bb9cd01dfb3a890477dcaeb2edf; https://github.com/wagtail/wagtail/commit/b76ab57ee859732b9cf9287d380493ab24061090; https://github.com/wagtail/wagtail/commit/ba9d424bd1ca5ce1910d3de74f5cc07214fbfb11
CVE: CVE-2020-12117
Published: 2020-05-01
Description: Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 4800. NOTE: Moxa Service is an unauthenticated service that runs upon a first-time installation but can be disabled without ill effect.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://blog.scadafence.com/technical-blog-cve-2020-12117-industrial-iot-insecure-default-configurations; https://www.moxa.com/en/support/support/security-advisory/nport-5100a-series-serial-device-servers-vulnerability; https://blog.scadafence.com/technical-blog-cve-2020-12117-industrial-iot-insecure-default-configurations
CVE: CVE-2020-12474
Published: 2020-05-01
Description: Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474; https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474
CVE: CVE-2020-7351
Published: 2020-05-01
Description: An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html; https://github.com/rapid7/metasploit-framework/pull/13353; http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html
CVE: CVE-2019-4209
Published: 2020-05-01
Description: HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0077954; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0077954
CVE: CVE-2020-10683
Published: 2020-05-01
Description: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html; https://bugzilla.redhat.com/show_bug.cgi?id=1694235; https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
CVE: CVE-2020-5727
Published: 2020-05-02
Description: Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an armed system.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://www.tenable.com/security/research/tra-2020-29; https://www.tenable.com/security/research/tra-2020-29
CVE: CVE-2020-7645
Published: 2020-05-02
Description: All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://snyk.io/vuln/SNYK-JS-CHROMELAUNCHER-537575; http://snyk.io/vuln/SNYK-JS-CHROMELAUNCHER-537575
CVE: CVE-2020-8157
Published: 2020-05-02
Description: UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and Cloud Key gen2 Plus contains a vulnerability that allows unrestricted root access through the serial interface (UART).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://community.ui.com/releases/Security-advisory-bulletin-008-008/5f66ca4c-10d6-4ca5-9620-37d5a4f22413; https://community.ui.com/releases/UniFi-Cloud-Key-Firmware-1-1-11/a24e55e1-6d90-46d7-92e2-01539ec8c79d; https://community.ui.com/releases/Security-advisory-bulletin-008-008/5f66ca4c-10d6-4ca5-9620-37d5a4f22413
CVE: CVE-2020-12624
Published: 2020-05-03
Description: The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://push32.com/post/dating-app-fail/; https://push32.com/post/dating-app-fail/
CVE: CVE-2020-12625
Published: 2020-05-04
Description: An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube; https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0
CVE: CVE-2020-12626
Published: 2020-05-04
Description: An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6; https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4; https://github.com/roundcube/roundcubemail/pull/7302
CVE: CVE-2020-12627
Published: 2020-05-04
Description: Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/janeczku/calibre-web/pull/1337; https://github.com/janeczku/calibre-web/pull/1337
CVE: CVE-2019-11823
Published: 2020-05-04
Description: CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.synology.com/security/advisory/Synology_SA_20_11; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1051; https://www.synology.com/security/advisory/Synology_SA_20_11
CVE: CVE-2020-12114
Published: 2020-05-04
Description: A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html; http://www.openwall.com/lists/oss-security/2020/05/04/2
CVE: CVE-2020-8018
Published: 2020-05-04
Description: A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux Enterprise Server 15 SP1 SLES15-SP1-CAP-Deployment-BYOS version 1.0.1 and prior versions; SLES15-SP1-CHOST-BYOS versions prior to 1.0.3 and prior versions;
CVSS Score: 8.4 (HIGH)
CWE: CWE-276, CWE-276
References: https://bugzilla.suse.com/show_bug.cgi?id=1163813; https://bugzilla.suse.com/show_bug.cgi?id=1163813
CVE: CVE-2019-17557
Published: 2020-05-04
Description: It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://syncope.apache.org/security; http://syncope.apache.org/security
CVE: CVE-2020-11842
Published: 2020-05-04
Description: Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 (7.8.49 or 7.8.0.49). The vulnerability allows an unauthenticated attackers to view information they may not have been authorized to view.
CVSS Score: 7.5 (HIGH)
References: https://support.microfocus.com/kb/doc.php?id=7024567; https://support.microfocus.com/kb/doc.php?id=7024567
CVE: CVE-2020-12629
Published: 2020-05-04
Description: include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/osTicket/osTicket/compare/v1.14.1...v1.14.2; https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884; https://www.exploit-db.com/exploits/48413
CVE: CVE-2020-1959
Published: 2020-05-04
Description: A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: http://syncope.apache.org/security; http://syncope.apache.org/security
CVE: CVE-2020-1961
Published: 2020-05-04
Description: Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://syncope.apache.org/security; http://syncope.apache.org/security
CVE: CVE-2019-12864
Published: 2020-05-04
Description: SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209
References: https://www.esecforte.com/network-performance-monitor-india-esec-forte-technologies/; https://www.solarwinds.com/network-performance-monitor; https://www.esecforte.com/network-performance-monitor-india-esec-forte-technologies/
CVE: CVE-2019-13285
Published: 2020-05-04
Description: CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://www.endpointprotector.com/products/endpoint-protector; https://www.esecforte.com/endpoint-protector-india-cososys-dlp/; https://www.endpointprotector.com/products/endpoint-protector
CVE: CVE-2020-10187
Published: 2020-05-04
Description: Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6; https://github.com/doorkeeper-gem/doorkeeper/releases; https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
CVE: CVE-2020-10876
Published: 2020-05-04
Description: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-613
References: https://apps.apple.com/us/app/oklok/id[PII_REDACTED]; https://github.com/fierceoj/ownklok; https://apps.apple.com/us/app/oklok/id[PII_REDACTED]
CVE: CVE-2020-11443
Published: 2020-05-04
Description: The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer runs with SYSTEM privileges and follows these links, a user can cause the installer to delete files that otherwise cannot be deleted by the user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-59, CWE-732
References: https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-Windows; https://support.zoom.us/hc/en-us/articles/[PII_REDACTED]51; https://support.zoom.us/hc/en-us/articles/[PII_REDACTED]51-Security-CVE-2020-11443
CVE: CVE-2020-11462
Published: 2020-05-04
Description: An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: https://openvpn.net/vpn-server-resources/release-notes/#Release_notes_for_OpenVPN_Access_Server_283; https://openvpn.net/vpn-server-resources/release-notes/#Release_notes_for_OpenVPN_Access_Server_283
CVE: CVE-2020-11671
Published: 2020-05-04
Description: Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/nilsteampassnet/TeamPass/issues/2765; https://github.com/nilsteampassnet/TeamPass/issues/2765
CVE: CVE-2020-12110
Published: 2020-05-04
Description: Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/157532/TP-LINK-Cloud-Cameras-NCXXX-Hardcoded-Encryption-Key.html; https://seclists.org/fulldisclosure/2020/May/3; http://packetstormsecurity.com/files/157532/TP-LINK-Cloud-Cameras-NCXXX-Hardcoded-Encryption-Key.html
CVE: CVE-2020-12475
Published: 2020-05-04
Description: TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.portal.PortalController.getAdvertiseFile in /opt/tplink/EAPController/lib/eap-web-3.2.6.jar.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://sovietw0rm.wordpress.com/2020/04/29/tp-link-omada-controller-directory-traversal-vulnerability/; https://sovietw0rm.wordpress.com/2020/04/29/tp-link-omada-controller-directory-traversal-vulnerability/