deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-9382
Published: 2020-02-24
Description: An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's {{#widget:}} parser function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://gerrit.wikimedia.org/r/q/I953e060bc6994ffdba9f380c98173f53f8ca1ea8; https://phabricator.wikimedia.org/T245850; https://gerrit.wikimedia.org/r/q/I953e060bc6994ffdba9f380c98173f53f8ca1ea8
CVE: CVE-2020-9385
Published: 2020-02-25
Description: A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://sourceforge.net/p/zint/tickets/181/; https://sourceforge.net/p/zint/tickets/181/
CVE: CVE-2020-8818
Published: 2020-02-25
Description: An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346
References: http://packetstormsecurity.com/files/156505/Magento-WooCommerce-CardGate-Payment-Gateway-2.0.30-Bypass.html; https://github.com/cardgate/magento2/blob/715979e54e1a335d78a8c5586f9e9987c3bf94fd/Controller/Payment/Callback.php#L88-L107; https://github.com/cardgate/magento2/issues/54
CVE: CVE-2020-8819
Published: 2020-02-25
Description: An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346
References: http://packetstormsecurity.com/files/156504/WordPress-WooCommerce-CardGate-Payment-Gateway-3.1.15-Bypass.html; https://github.com/cardgate/woocommerce/blob/f2111af7b1a3fd701c1c5916137f3ac09482feeb/cardgate/cardgate.php#L426-L442; https://github.com/cardgate/woocommerce/issues/18
CVE: CVE-2019-4557
Published: 2020-02-25
Description: IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 166206.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166206; https://www.ibm.com/support/pages/node/3379947; https://exchange.xforce.ibmcloud.com/vulnerabilities/166206
CVE: CVE-2019-4672
Published: 2020-02-25
Description: IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 171438.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171438; https://www.ibm.com/support/pages/node/3379965; https://exchange.xforce.ibmcloud.com/vulnerabilities/171438
CVE: CVE-2019-5136
Published: 2020-02-25
Description: An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0925; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0925
CVE: CVE-2019-5137
Published: 2020-02-25
Description: The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A firmware version 1.13.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0926; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0926
CVE: CVE-2019-5138
Published: 2020-02-25
Description: An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An attacker can send diagnostic while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0927; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0927
CVE: CVE-2019-5139
Published: 2020-02-25
Description: An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts.
CVSS Score: 7.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0928; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0928
CVE: CVE-2019-5140
Published: 2020-02-25
Description: An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0929; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0929
CVE: CVE-2019-5141
Published: 2020-02-25
Description: An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0930; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0930
CVE: CVE-2019-5142
Published: 2020-02-25
Description: An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various authenticated requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0931; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0931
CVE: CVE-2019-5143
Published: 2020-02-25
Description: An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-134
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0932; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0932
CVE: CVE-2019-5148
Published: 2020-02-25
Description: An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-191
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0938; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0938
CVE: CVE-2019-5153
Published: 2020-02-25
Description: An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0944; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0944
CVE: CVE-2019-5162
Published: 2020-02-25
Description: An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0955; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0955
CVE: CVE-2019-5165
Published: 2020-02-25
Description: An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device hostname can cause the device to interpret select remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-288, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0960; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0960
CVE: CVE-2020-9383
Published: 2020-02-25
Description: An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html; https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=2f9ac30a54dc0181ddac3705cdcf4775d863c530; https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd[PII_REDACTED]1e3
CVE: CVE-2019-12863
Published: 2020-02-25
Description: SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-12863-stored-html-injection-vulnerability-in-solarwinds-orion-platform-2018-4-hf3-npm-12-4-netpath-1-1-4/; https://www.solarwinds.com/network-performance-monitor; https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-12863-stored-html-injection-vulnerability-in-solarwinds-orion-platform-2018-4-hf3-npm-12-4-netpath-1-1-4/
CVE: CVE-2020-8793
Published: 2020-02-25
Description: OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367, CWE-426
References: http://seclists.org/fulldisclosure/2020/Feb/28; http://www.openwall.com/lists/oss-security/2020/02/24/4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/
CVE: CVE-2020-8794
Published: 2020-02-25
Description: OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://packetstormsecurity.com/files/156633/OpenSMTPD-Out-Of-Bounds-Read-Local-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2020/Feb/32; http://www.openwall.com/lists/oss-security/2020/02/26/1
CVE: CVE-2020-9017
Published: 2020-02-25
Description: LiteCart through 2.2.1 allows CSV injection via a customer's profile.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://cert.ikiu.ac.ir/public-files/pages/attachments/11/e8e09da3c[PII_REDACTED]810527af5b313.pdf; https://uploadboy.com/7njf43f167is/384/mp4; https://cert.ikiu.ac.ir/public-files/pages/attachments/11/e8e09da3c[PII_REDACTED]810527af5b313.pdf
CVE: CVE-2020-9334
Published: 2020-02-25
Description: A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/envira-gallery-lite/#developers; https://wpvulndb.com/vulnerabilities/10089; https://wordpress.org/plugins/envira-gallery-lite/#developers
CVE: CVE-2020-9335
Published: 2020-02-25
Description: Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/photo-gallery/#developers; https://wpvulndb.com/vulnerabilities/10088; https://wordpress.org/plugins/photo-gallery/#developers
CVE: CVE-2020-9008
Published: 2020-02-25
Description: Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blackboard.com; https://github.com/kyletimmermans/blackboard-xss/blob/master/CVE-2020-9008.md; https://blackboard.com
CVE: CVE-2020-9018
Published: 2020-02-25
Description: LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://cert.ikiu.ac.ir/public-files/pages/attachments/11/5a8ed1c216e1a910e[PII_REDACTED]63845.pdf; https://uploadboy.com/7njf43f167is/384/mp4; https://cert.ikiu.ac.ir/public-files/pages/attachments/11/5a8ed1c216e1a910e[PII_REDACTED]63845.pdf
CVE: CVE-2020-9019
Published: 2020-02-25
Description: The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.ikiu.ac.ir/public-files/pages/attachments/11/a1f0e3e5aa9ba583298d03758b8ae95c.pdf; https://uploadboy.com/uhxq91nuxd6d/423/mp4; https://wpvulndb.com/vulnerabilities/10113
CVE: CVE-2020-9391
Published: 2020-02-25
Description: An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2020/02/25/6; https://bugzilla.redhat.com/show_bug.cgi?id=1797052; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dcde237319e626d1ec3c9d8b7613032f0fd4663a
CVE: CVE-2016-11020
Published: 2020-02-25
Description: Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Kunena/Kunena-Forum/pull/5028; https://www.kunena.org/blog/179-kunena-5-0-4-released; https://www.kunena.org/bugs/changelog
CVE: CVE-2019-3999
Published: 2020-02-25
Description: Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/157493/Druva-inSync-Windows-Client-6.5.2-Privilege-Escalation.html; http://packetstormsecurity.com/files/157680/Druva-inSync-inSyncCPHwnet64.exe-RPC-Type-5-Privilege-Escalation.html; https://www.tenable.com/security/research/tra-2020-12
CVE: CVE-2020-8809
Published: 2020-02-25
Description: Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: https://github.com/seqred-s-a/gxdlmsdirector-cve; https://seqred.pl/en/cve-gurux-gxdlms-director/; https://github.com/seqred-s-a/gxdlmsdirector-cve
CVE: CVE-2020-8810
Published: 2020-02-25
Description: An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/seqred-s-a/gxdlmsdirector-cve; https://seqred.pl/en/cve-gurux-gxdlms-director/; https://github.com/seqred-s-a/gxdlmsdirector-cve
CVE: CVE-2020-9379
Published: 2020-02-25
Description: The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to access sensitive information. A successful exploit could allow unauthorized access to user conversations.
CVSS Score: 6.5 (MEDIUM)
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0003; https://www.mitel.com/support/security-advisories
CVE: CVE-2020-9393
Published: 2020-02-25
Description: An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/pricing-table-by-supsystic/#developers; https://wordpress.org/plugins/pricing-table-by-supsystic/#developers
CVE: CVE-2020-9394
Published: 2020-02-25
Description: An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/pricing-table-by-supsystic/#developers; https://wordpress.org/plugins/pricing-table-by-supsystic/#developers
CVE: CVE-2015-0565
Published: 2020-02-25
Description: NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html; https://www.exploit-db.com/exploits/36310/; https://www.exploit-db.com/exploits/36311/
CVE: CVE-2015-5201
Published: 2020-02-25
Description: VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://access.redhat.com/security/cve/cve-2015-5201; https://bugzilla.redhat.com/show_bug.cgi?id=1253882; https://bugzilla.redhat.com/show_bug.cgi?id=1273144
CVE: CVE-2019-4000
Published: 2020-02-25
Description: Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://www.tenable.com/security/research/tra-2020-12; https://www.tenable.com/security/research/tra-2020-12
CVE: CVE-2020-9398
Published: 2020-02-25
Description: ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.ispconfig.org/blog/ispconfig-3-1-15p3-released-security-bugfix-release/; https://www.ispconfig.org/blog/ispconfig-3-1-15p3-released-security-bugfix-release/
CVE: CVE-2020-9405
Published: 2020-02-26
Description: IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather; https://zigrin.com/advisories/online-weather-reflected-xss-in-redirect-page/; https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather
CVE: CVE-2020-9406
Published: 2020-02-26
Description: IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather; https://zigrin.com/advisories/online-weather-command-injection-in-querybcp-method/; https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather
CVE: CVE-2020-9407
Published: 2020-02-26
Description: IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather; https://zigrin.com/advisories/online-weather-information-disclosure-in-cookie/; https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather
CVE: CVE-2020-9337
Published: 2020-02-26
Description: In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-326
References: https://github.com/0xEmma/CVEs/blob/master/CVEs/CVE-2020-9337-Golf-Buddy-Insecure-Passwords.md; https://help.golfbuddyglobal.com/sList.asp?searchproduct=29&searchcategory=5; https://github.com/0xEmma/CVEs/blob/master/CVEs/CVE-2020-9337-Golf-Buddy-Insecure-Passwords.md