deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26561
Published: 2020-10-23
Description: Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create_dir in mini_httpd. Successful exploitation leads to arbitrary code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://research.nccgroup.com/2020/10/20/wrt160nl-cve-2020-26561-bof/; https://research.nccgroup.com/2020/10/20/wrt160nl-cve-2020-26561-bof/
CVE: CVE-2020-27216
Published: 2020-10-23
Description: In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-378, CWE-379
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921; https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053; https://lists.apache.org/thread.html/r0259b14ae69b87821e27fed1f5333ea86018294fd31aab16b1fac84e%40%3Cissues.beam.apache.org%3E
CVE: CVE-2020-3997
Published: 2020-10-23
Description: VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2020-0024.html; https://www.vmware.com/security/advisories/VMSA-2020-0024.html
CVE: CVE-2020-3998
Published: 2020-10-23
Description: VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes.
CVSS Score: 6.5 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2020-0024.html; https://www.vmware.com/security/advisories/VMSA-2020-0024.html
CVE: CVE-2020-25466
Published: 2020-10-23
Description: A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://crmeb.com; https://github.com/crmeb/CRMEB; https://github.com/crmeb/CRMEB/issues/22
CVE: CVE-2020-25483
Published: 2020-10-23
Description: An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://sunian19.github.io/2020/09/08/UCMS%20v.1.4.8%20Command%20execution/; https://sunian19.github.io/2020/09/08/UCMS%20v.1.4.8%20Command%20execution/
CVE: CVE-2020-5977
Published: 2020-10-23
Description: NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5076; https://nvidia.custhelp.com/app/answers/detail/a_id/5076
CVE: CVE-2020-5978
Published: 2020-10-23
Description: NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder is created by nvcontainer.exe under normal user login with LOCAL_SYSTEM privileges which may lead to a denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5076; https://nvidia.custhelp.com/app/answers/detail/a_id/5076
CVE: CVE-2020-5990
Published: 2020-10-23
Description: NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5076; https://nvidia.custhelp.com/app/answers/detail/a_id/5076
CVE: CVE-2020-24847
Published: 2020-10-23
Description: A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/xtr4nge/FruityWifi/issues/277; https://github.com/xtr4nge/FruityWifi/issues/277
CVE: CVE-2020-24848
Published: 2020-10-23
Description: FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-287
References: https://gist.github.com/harsh-bothra/5be73cfd53f1c5bea307c702ae83ff42; https://github.com/xtr4nge/FruityWifi/issues/278; https://gist.github.com/harsh-bothra/5be73cfd53f1c5bea307c702ae83ff42
CVE: CVE-2020-27388
Published: 2020-10-23
Description: Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://yourls.com; https://github.com/YOURLS/YOURLS/pull/2761; https://johnjhacking.com/blog/cve-2020-27388/
CVE: CVE-2020-27678
Published: 2020-10-26
Description: An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452; https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452
CVE: CVE-2020-7751
Published: 2020-10-26
Description: pathval before version 1.1.1 is vulnerable to prototype pollution.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-1321
References: https://github.com/chaijs/pathval/pull/58/files; https://snyk.io/vuln/SNYK-JS-PATHVAL-596926; https://github.com/chaijs/pathval/pull/58/files
CVE: CVE-2020-25470
Published: 2020-10-26
Description: AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AntSwordProject/antSword/issues/256; https://github.com/AntSwordProject/antSword/issues/256
CVE: CVE-2020-13100
Published: 2020-10-26
Description: Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and restart) in the ControllerOob agent via a malformed control-plane packet.
CVSS Score: 7.5 (HIGH)
References: https://www.arista.com/en/support/advisories-notices/security-advisories/11758-security-advisory-52; https://www.arista.com/en/support/advisories-notices/security-advisories/11758-security-advisory-52
CVE: CVE-2020-15897
Published: 2020-10-26
Description: Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state PDU to the IS-IS router.
CVSS Score: 7.5 (HIGH)
References: https://www.arista.com/en/support/advisories-notices/security-advisories/11760-security-advisory-54; https://www.arista.com/en/support/advisories-notices/security-advisories/11760-security-advisory-54
CVE: CVE-2020-18766
Published: 2020-10-26
Description: A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/AntSwordProject/antSword/issues/147; https://github.com/AntSwordProject/antSword/issues/147
CVE: CVE-2020-24631
Published: 2020-10-26
Description: A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVSS Score: 7.2 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us
CVE: CVE-2020-24632
Published: 2020-10-26
Description: A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVSS Score: 7.2 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us
CVE: CVE-2020-6876
Published: 2020-10-26
Description: A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker could trigger an XSS attack when the user browses the web page. Then the attacker could use the vulnerability to steal user cookies or destroy the page structure. This affects: eVDC ZXCLOUD-iROSV6.03.04
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013782; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013782
CVE: CVE-2020-7124
Published: 2020-10-26
Description: A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us
CVE: CVE-2020-7125
Published: 2020-10-26
Description: A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us
CVE: CVE-2020-7126
Published: 2020-10-26
Description: A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us
CVE: CVE-2020-7127
Published: 2020-10-26
Description: A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04051en_us
CVE: CVE-2020-7196
Published: 2020-10-26
Description: The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the url "/bdswebui/assignusers/".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04049en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04049en_us
CVE: CVE-2020-7197
Published: 2020-10-26
Description: SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* Upgrade to HPE 3PAR StoreServ Management Console 3.7.1.1 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04045en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04045en_us
CVE: CVE-2020-27187
Published: 2020-10-26
Description: An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related commands, while KDE Partition Manager is running. the mount command can then be used to gain full root privileges.
CVSS Score: 7.8 (HIGH)
References: https://bugzilla.redhat.com/show_bug.cgi?id=1890199; https://github.com/KDE/partitionmanager/compare/v4.1.0...v4.2.0; https://kde.org/info/security/advisory-20201017-1.txt
CVE: CVE-2020-7752
Published: 2020-10-26
Description: This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js; https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61; https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909
CVE: CVE-2017-18925
Published: 2020-10-26
Description: opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://github.com/OpenRC/opentmpfiles/issues/4; https://github.com/OpenRC/opentmpfiles/issues/4
CVE: CVE-2020-15271
Published: 2020-10-26
Description: In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84; https://github.com/d0c-s4vage/lookatme/pull/110; https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0
CVE: CVE-2020-26161
Published: 2020-10-26
Description: In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/OctopusDeploy; https://github.com/OctopusDeploy/Issues/issues/6622; https://github.com/OctopusDeploy/Issues/issues/6627
CVE: CVE-2020-26566
Published: 2020-10-26
Description: A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/Motion-Project/motion/issues/1227#issuecomment-715927776; https://github.com/Motion-Project/motion/releases; https://motion-project.github.io/index.html
CVE: CVE-2020-15272
Published: 2020-10-26
Description: In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version 1.0.1. If you don't use the `tag` input you are most likely safe. The `GITHUB_REF` environment variable is protected by the GitHub Actions environment so attacks from there should be impossible. If you must use the `tag` input and cannot upgrade to `> 1.0.0` make sure that the value is not controlled by another Action.
CVSS Score: 8.7 (HIGH)
CWE: CWE-78
References: https://github.com/ericcornelissen/git-tag-annotation-action/commit/9f30756375cc4b1b6c66f274fc9c591fa901455a; https://github.com/ericcornelissen/git-tag-annotation-action/releases/tag/v1.0.1; https://github.com/ericcornelissen/git-tag-annotation-action/security/advisories/GHSA-hgx2-4pp9-357g
CVE: CVE-2020-15274
Published: 2020-10-26
Description: In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://docs.requarks.io/releases; https://github.com/Requarks/wiki/commit/a57d9af34c15adbf460dde6553d964efddf433de; https://github.com/Requarks/wiki/security/advisories/GHSA-pgjv-84m7-62q7
CVE: CVE-2020-25034
Published: 2020-10-26
Description: eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, search{URL], or search[attachment] parameter to the email search feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-031.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-031.txt
CVE: CVE-2020-26878
Published: 2020-10-26
Description: Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://adepts.of0x.cc; https://adepts.of0x.cc/ruckus-vriot-rce/; https://support.ruckuswireless.com/documents
CVE: CVE-2020-26879
Published: 2020-10-26
Description: Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://adepts.of0x.cc; https://adepts.of0x.cc/ruckus-vriot-rce/; https://support.ruckuswireless.com/documents
CVE: CVE-2020-1915
Published: 2020-10-26
Description: An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0; https://www.facebook.com/security/advisories/cve-2020-1915; https://github.com/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0
CVE: CVE-2020-27743
Published: 2020-10-26
Description: libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://github.com/kravietz/pam_tacplus/pull/163; https://tools.ietf.org/html/rfc8907; https://github.com/kravietz/pam_tacplus/pull/163
CVE: CVE-2018-21269
Published: 2020-10-27
Description: checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://github.com/OpenRC/openrc/issues/201; https://github.com/OpenRC/openrc/issues/201
CVE: CVE-2020-15352
Published: 2020-10-27
Description: An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
CVE: CVE-2020-27179
Published: 2020-10-27
Description: konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/; https://seclists.org/fulldisclosure/2020/Oct/28; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE: CVE-2020-27180
Published: 2020-10-27
Description: konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/; https://seclists.org/fulldisclosure/2020/Oct/28; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE: CVE-2020-27181
Published: 2020-10-27
Description: A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/; https://seclists.org/fulldisclosure/2020/Oct/28; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE: CVE-2020-27182
Published: 2020-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/; https://seclists.org/fulldisclosure/2020/Oct/28; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/
CVE: CVE-2020-27183
Published: 2020-10-27
Description: A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
References: https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/; https://seclists.org/fulldisclosure/2020/Oct/28; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone/