deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-20474
Published: 2020-02-17
Description: An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port scan operations of the localhost or the hosts on the same network segment, aka SSRF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://excellium-services.com/cert-xlm-advisory/cve-2019-20474/; https://www.manageengine.com/remote-desktop-management/knowledge-base/authorization-failure.html; https://excellium-services.com/cert-xlm-advisory/cve-2019-20474/
CVE: CVE-2020-7597
Published: 2020-02-17
Description: codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/codecov/codecov-node/commit/02cf13d8b93ac547b5b4c2cfe186b7d874fd234f; https://snyk.io/vuln/SNYK-JS-CODECOV-548879; https://github.com/codecov/codecov-node/commit/02cf13d8b93ac547b5b4c2cfe186b7d874fd234f
CVE: CVE-2019-10790
Published: 2020-02-17
Description: taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://security.snyk.io/vuln/SNYK-JS-TAFFYDB-2992450; https://snyk.io/vuln/SNYK-JS-TAFFY-546521; https://security.snyk.io/vuln/SNYK-JS-TAFFYDB-2992450
CVE: CVE-2019-19325
Published: 2020-02-17
Description: SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.silverstripe.org/download/security-releases/cve-2019-19325; https://www.silverstripe.org/download/security-releases/cve-2019-19325
CVE: CVE-2020-1693
Published: 2020-02-17
Description: A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
CVSS Score: 8.6 (HIGH)
CWE: CWE-611, CWE-611
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1693; https://github.com/spacewalkproject/spacewalk/commit/74e28ec61d916c42061ef[PII_REDACTED]a1c962b0c; https://zeroauth.ltd/blog/2020/02/18/proof-of-concept-exploit-for-cve-2020-1693-spacewalk/
CVE: CVE-2020-1828
Published: 2020-02-17
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. Attackers can send specific message to cause out-of-bound read, compromising normal service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-ipsec-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-ipsec-en
CVE: CVE-2020-1857
Published: 2020-02-17
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. Due to improper processing of some data, a local authenticated attacker can exploit this vulnerability through a series of operations. Successful exploitation may cause information leakage.
CVSS Score: 5.5 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-leakage-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-leakage-en
CVE: CVE-2020-1858
Published: 2020-02-17
Description: Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability. Attackers need to perform a series of operations in a special scenario to exploit this vulnerability. Successful exploit may cause the new connections can't be established, result in a denial of service.
CVSS Score: 7.5 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-dos-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200219-04-dos-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-dos-en
CVE: CVE-2014-1947
Published: 2020-02-17
Description: Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2014/02/12/13; http://www.openwall.com/lists/oss-security/2014/02/12/2; http://www.openwall.com/lists/oss-security/2014/02/13/2
CVE: CVE-2020-1827
Published: 2020-02-17
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. An attacker can exploit this vulnerability by sending specific request packets to affected devices. Successful exploit may lead to information leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-02-ipsec-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-02-ipsec-en
CVE: CVE-2020-1829
Published: 2020-02-17
Description: Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, and V500R001C60SPC500 have a vulnerability that the IPSec module handles a message improperly. Attackers can send specific message to cause double free memory. This may compromise normal service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-03-ipsec-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-03-ipsec-en
CVE: CVE-2020-1841
Published: 2020-02-17
Description: Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C10, V600R019C00, and V600R019C00SPC100 have an information leak vulnerability. An unauthenticated, remote attacker can make a large number of attempts to guess information. Successful exploitation may cause information leak.
CVSS Score: 7.5 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200207-01-te-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200207-01-te-en
CVE: CVE-2020-1853
Published: 2020-02-17
Description: GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an authenticated attacker can traverse directories and download files to a specific directory. Successful exploit may cause information leakage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200120-01-path-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200120-01-path-en
CVE: CVE-2020-1856
Published: 2020-02-17
Description: Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00 have an information leakage vulnerability. An attacker can exploit this vulnerability by sending specific request packets to affected devices. Successful exploit may lead to information leakage.
CVSS Score: 7.5 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-firewall-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-firewall-en
CVE: CVE-2020-7959
Published: 2020-02-17
Description: LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognized Database exception message if the database does not exist.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/websecnl/LabVantage8.3-Exploit; https://www.exploit-db.com/exploits/48090; https://github.com/websecnl/LabVantage8.3-Exploit
CVE: CVE-2020-8768
Published: 2020-02-17
Description: An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure mechanism for read and write access to the configuration of the device. The mechanism can be discovered by examining a link on the website of the device.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-732
References: https://cert.vde.com/de-de/advisories/vde-2020-001; https://www.us-cert.gov/ics/advisories/icsa-20-063-02; https://cert.vde.com/de-de/advisories/vde-2020-001
CVE: CVE-2012-2412
Published: 2020-02-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-4531. Reason: This candidate is a duplicate of CVE-2012-4531. Notes: All CVE users should reference CVE-2012-4531 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-4981
Published: 2020-02-17
Description: LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://ocert.org/advisories/ocert-2014-005.html; http://packetstormsecurity.com/files/127593/LPAR2RRD-3.5-4.53-Command-Injection.html; http://www.lpar2rrd.com/note453-01.htm
CVE: CVE-2014-7236
Published: 2020-02-17
Description: Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-74
References: http://packetstormsecurity.com/files/128623/Twiki-Perl-Code-Execution.html; http://seclists.org/fulldisclosure/2014/Oct/44; http://www.securityfocus.com/bid/70372
CVE: CVE-2014-8089
Published: 2020-02-17
Description: SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://framework.zend.com/security/advisory/ZF2014-06; http://seclists.org/oss-sec/2014/q4/276; http://www.securityfocus.com/bid/70011
CVE: CVE-2015-8751
Published: 2020-02-17
Description: Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/01/07/10; http://www.openwall.com/lists/oss-security/2016/01/08/2; http://www.openwall.com/lists/oss-security/2016/01/11/3
CVE: CVE-2020-1811
Published: 2020-02-18
Description: GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exploit this vulnerability by sending crafted commands to the affected device. Successful exploit could allow an attacker to execute commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200120-01-gaussdb200-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200120-01-gaussdb200-en
CVE: CVE-2020-1815
Published: 2020-02-18
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a memory leak vulnerability. The software does not sufficiently track and release allocated memory while parse certain message, the attacker sends the message continuously that could consume remaining memory. Successful exploit could cause memory exhaust.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-02-firewall-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-02-firewall-en
CVE: CVE-2020-1816
Published: 2020-02-18
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Denial of Service (DoS) vulnerability. Due to improper processing of specific IPSEC packets, remote attackers can send constructed IPSEC packets to affected devices to exploit this vulnerability. Successful exploit could cause the IPSec function of the affected device abnormal.
CVSS Score: 7.5 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-03-firewall-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-03-firewall-en
CVE: CVE-2020-1830
Published: 2020-02-18
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a vulnerability that a memory management error exists when IPSec Module handing a specific message. This causes 1 byte out-of-bound read, compromising normal service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-04-ipsec-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-04-ipsec-en
CVE: CVE-2020-1882
Published: 2020-02-18
Description: Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C636E5R2P3); HUAWEI Mate 20 RS versions earlier than 10.0.0.175(C786E70R3P8); HUAWEI Mate 20 X versions earlier than 10.0.0.176(C00E70R2P8); and Honor Magic2 versions earlier than 10.0.0.175(C00E59R2P11) have an improper authorization vulnerability. Due to improper authorization of some function, attackers can bypass the authorization to perform some operations.
CVSS Score: 4.6 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-phone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-phone-en
CVE: CVE-2020-1814
Published: 2020-02-18
Description: Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in the affected products in some special scenarios to exploit the vulnerability. Due to improper race conditions of different operations, successful exploit will lead to Dangling pointer dereference, causing some service abnormal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-362
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-firewall-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-firewall-en
CVE: CVE-2020-1872
Published: 2020-02-18
Description: Huawei smart phones P10 Plus with versions earlier than 9.1.0.201(C01E75R1P12T8), earlier than 9.1.0.252(C185E2R1P9T8), earlier than 9.1.0.252(C432E4R1P9T8), and earlier than 9.1.0.255(C576E6R1P8T8) have a digital balance bypass vulnerability. When re-configuring the mobile phone at the digital balance mode, an attacker can perform some operations to bypass the startup wizard, and then open some switch. As a result, the digital balance function is bypassed.
CVSS Score: 4.6 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-digitalbalance-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-digitalbalance-en
CVE: CVE-2020-1789
Published: 2020-02-18
Description: Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. The software does not require a strong credential when the user trying to do certain operations. Successful exploit could allow an attacker to pass the authentication and do certain operations by a weak credential.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200121-01-osca-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200121-01-osca-en
CVE: CVE-2020-1790
Published: 2020-02-18
Description: GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-gauss-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-gauss-en
CVE: CVE-2020-1791
Published: 2020-02-18
Description: HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode.
CVSS Score: 2.4 (LOW)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-smartphone-en
CVE: CVE-2020-1812
Published: 2020-02-18
Description: HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to perform unauthorized operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200120-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200120-01-smartphone-en
CVE: CVE-2020-1843
Published: 2020-02-18
Description: Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), and OSCA-550X version 1.0.0.71(SP2) have an insufficient verification vulnerability. An attacker can perform specific operations to exploit this vulnerability by physical access methods. Successful exploitation may cause the attacker perform an illegal operation.
CVSS Score: 6.8 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-02-osca-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-02-osca-en
CVE: CVE-2020-1855
Published: 2020-02-18
Description: Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal.
CVSS Score: 6.1 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en
CVE: CVE-2020-1842
Published: 2020-02-18
Description: Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker obtain high privilege.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-osca-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-01-osca-en
CVE: CVE-2020-8010
Published: 2020-02-18
Description: CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/158693/CA-Unified-Infrastructure-Management-Nimsoft-7.80-Buffer-Overflow.html; https://support.broadcom.com/external/content/security-advisories/CA20200205-01-Security-Notice-for-CA-Unified-Infrastructure-Management/7832; https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2019/ca20200205-01-security-notice-for-ca-unified-infrastructure-management.html
CVE: CVE-2020-8011
Published: 2020-02-18
Description: CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://support.broadcom.com/external/content/security-advisories/CA20200205-01-Security-Notice-for-CA-Unified-Infrastructure-Management/7832; https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2019/ca20200205-01-security-notice-for-ca-unified-infrastructure-management.html; https://support.broadcom.com/external/content/security-advisories/CA20200205-01-Security-Notice-for-CA-Unified-Infrastructure-Management/7832
CVE: CVE-2020-8012
Published: 2020-02-18
Description: CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://packetstormsecurity.com/files/156577/Nimsoft-nimcontroller-7.80-Remote-Code-Execution.html; http://packetstormsecurity.com/files/158693/CA-Unified-Infrastructure-Management-Nimsoft-7.80-Buffer-Overflow.html; https://support.broadcom.com/external/content/security-advisories/CA20200205-01-Security-Notice-for-CA-Unified-Infrastructure-Management/7832