deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3992
Published: 2020-10-20
Description: OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi[PII_REDACTED]01-SG, 6.5 before ESXi[PII_REDACTED]01-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1377/; https://www.zerodayinitiative.com/advisories/ZDI-20-1385/
CVE: CVE-2020-3993
Published: 2020-10-20
Description: VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX manager. A malicious actor with MITM positioning may be able to exploit this issue to compromise the transport node.
CVSS Score: 5.9 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html; https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE: CVE-2020-3994
Published: 2020-10-20
Description: VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html; https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE: CVE-2020-3995
Published: 2020-10-20
Description: In VMware ESXi (6.7 before ESXi[PII_REDACTED]01-SG, 6.5 before ESXi[PII_REDACTED]01-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. A malicious actor with access to a virtual machine may be able to trigger a memory leak issue resulting in memory resource exhaustion on the hypervisor if the attack is sustained for extended periods of time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html; https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE: CVE-2020-7363
Published: 2020-10-20
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/; https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html; https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE: CVE-2020-7364
Published: 2020-10-20
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/; https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html; https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE: CVE-2020-7369
Published: 2020-10-20
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version 20.8.4 released October 1, 2020.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451, CWE-306
References: https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/; https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html; https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE: CVE-2020-7370
Published: 2020-10-20
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451, CWE-306
References: https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/; https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html; https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE: CVE-2020-7371
Published: 2020-10-20
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451, CWE-1021
References: https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/; https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html; https://blog.rapid7.com/2020/10/20/vulntober-multiple-mobile-browser-address-bar-spoofing-vulnerabilities/
CVE: CVE-2019-9080
Published: 2020-10-20
Description: DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://domainmod.org/changelog/; https://domainmod.org/changelog/
CVE: CVE-2020-15931
Published: 2020-10-20
Description: Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a Domain Controller.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.netwrix.com/netwrix_reports_vulnerability_in_netwrix_account_lockout_examiner_4_1.html; https://www.optiv.com/explore-optiv-insights/source-zero/netwrix-account-lockout-examiner-41-disclosure-vulnerability; https://www.netwrix.com/netwrix_reports_vulnerability_in_netwrix_account_lockout_examiner_4_1.html
CVE: CVE-2020-24765
Published: 2020-10-20
Description: InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://github.com/trump88/CVE-2020-24765; https://github.com/trump88/CVE-2020-24765
CVE: CVE-2020-15264
Published: 2020-10-20
Description: The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0
CVSS Score: 8.0 (HIGH)
CWE: CWE-73, CWE-668
References: https://github.com/chocolatey/boxstarter/commit/67e[PII_REDACTED]50b48900e87105a34ceefdcf633; https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf; https://www.kb.cert.org/vuls/id/208577
CVE: CVE-2020-15269
Published: 2020-10-20
Description: In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
CVSS Score: 7.4 (HIGH)
CWE: CWE-287, CWE-613, CWE-613
References: https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847; https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh; https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
CVE: CVE-2020-9417
Published: 2020-10-20
Description: The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2020-24409
Published: 2020-10-20
Description: Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read past the end of an allocated memory structure, potentially resulting in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1271/; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24410
Published: 2020-10-20
Description: Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read past the end of an allocated memory structure, potentially resulting in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1272/; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24411
Published: 2020-10-20
Description: Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds write vulnerability when handling crafted PDF files. This could result in a write past the end of an allocated memory structure, potentially resulting in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1270/; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24412
Published: 2020-10-20
Description: Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24413
Published: 2020-10-20
Description: Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24414
Published: 2020-10-20
Description: Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24415
Published: 2020-10-20
Description: Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-53.html; https://helpx.adobe.com/security/products/illustrator/apsb20-53.html
CVE: CVE-2020-24416
Published: 2020-10-20
Description: Marketo Sales Insight plugin version 1.4355 (and earlier) is affected by a blind stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/marketo/apsb20-60.html; https://helpx.adobe.com/security/products/marketo/apsb20-60.html
CVE: CVE-2020-25157
Published: 2020-10-20
Description: The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-289-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-289-02
CVE: CVE-2020-25648
Published: 2020-10-20
Description: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=1887319; https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.58_release_notes; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2020-5790
Published: 2020-10-20
Description: Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2020-58; https://www.tenable.com/security/research/tra-2020-58
CVE: CVE-2020-5791
Published: 2020-10-20
Description: Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/159743/Nagios-XI-5.7.3-Remote-Command-Injection.html; http://packetstormsecurity.com/files/162235/Nagios-XI-5.7.3-Remote-Code-Execution.html; https://www.tenable.com/security/research/tra-2020-58
CVE: CVE-2020-5792
Published: 2020-10-20
Description: Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88
References: http://packetstormsecurity.com/files/162284/Nagios-XI-5.7.3-Remote-Code-Execution.html; https://www.tenable.com/security/research/tra-2020-58; http://packetstormsecurity.com/files/162284/Nagios-XI-5.7.3-Remote-Code-Execution.html
CVE: CVE-2020-26895
Published: 2020-10-21
Description: Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-354
References: https://gist.github.com/ariard/fb432a9d2cd3ba24fdc18ccc8c5c6eb4; https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002856.html; https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002858.html
CVE: CVE-2020-26896
Published: 2020-10-21
Description: Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collision with an invoice, the preimage for an expected payment was instead released. A malicious peer could have deliberately intercepted an HTLC intended for the victim node, probed the preimage through a colluding relayed HTLC, and stolen the intercepted HTLC. The impact is a loss of funds in certain situations, and a weakening of the victim's receiver privacy.
CVSS Score: 8.2 (HIGH)
CWE: CWE-354
References: https://gist.github.com/ariard/6bdeb995565d1cc292753e1ee4ae402d; https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002855.html; https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html
CVE: CVE-2020-25820
Published: 2020-10-21
Description: BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.html; https://github.com/bigbluebutton/bigbluebutton/commit/71fe1eac1e5bd73a2cd44bd79c001086b250e435; https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.26...v2.2.27
CVE: CVE-2020-10138
Published: 2020-10-21
Description: Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-665
References: https://www.kb.cert.org/vuls/id/114757; https://www.kb.cert.org/vuls/id/114757
CVE: CVE-2020-10139
Published: 2020-10-21
Description: Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-665
References: https://www.kb.cert.org/vuls/id/114757; https://www.kb.cert.org/vuls/id/114757
CVE: CVE-2020-10140
Published: 2020-10-21
Description: Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths within C:\ProgramData\Acronis.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.kb.cert.org/vuls/id/114757; https://www.kb.cert.org/vuls/id/114757
CVE: CVE-2020-6648
Published: 2020-10-21
Description: A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://www.fortiguard.com/psirt/FG-IR-20-009; https://www.fortiguard.com/psirt/FG-IR-20-236; https://www.fortiguard.com/psirt/FG-IR-20-009
CVE: CVE-2020-14672
Published: 2020-10-21
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/
CVE: CVE-2020-14731
Published: 2020-10-21
Description: Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). Supported versions that are affected are 18.0 and 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Customer Management and Segmentation Foundation accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 3.1 (LOW)
References: https://www.oracle.com/security-alerts/cpuoct2020.html; https://www.oracle.com/security-alerts/cpuoct2020.html