deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-16237
Published: 2020-08-21
Description: Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
CVSS Score: 2.1 (LOW)
CWE: CWE-20, CWE-20
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01; https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive; https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01
CVE: CVE-2020-16239
Published: 2020-08-21
Description: When an actor claims to have a given identity, 

Philips SureSigns VS4, A.07.107 and prior 
does not prove or insufficiently proves the claim is correct.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01; https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive; https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01
CVE: CVE-2020-16241
Published: 2020-08-21
Description: Philips SureSigns VS4, A.07.107 and prior 
does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01; https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive; https://us-cert.cisa.gov/ics/advisories/icsma-20-233-01
CVE: CVE-2020-3976
Published: 2020-08-21
Description: VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://www.vmware.com/security/advisories/VMSA-2020-0018.html; https://www.vmware.com/security/advisories/VMSA-2020-0018.html
CVE: CVE-2020-5774
Published: 2020-08-21
Description: Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: https://www.tenable.com/security/tns-2020-06; https://www.tenable.com/security/tns-2020-06
CVE: CVE-2020-12457
Published: 2020-08-21
Description: An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends ChangeCipherSpec messages in a crafted way involving more than one in a row, the server becomes stuck in the ProcessReply() loop, i.e., a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/wolfSSL/wolfssl/pull/2927; https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable; https://github.com/wolfSSL/wolfssl/pull/2927
CVE: CVE-2020-15309
Published: 2020-08-21
Description: An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for private key operations (e.g., signing with a private key).
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://arxiv.org/abs/2008.12188; https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable; https://arxiv.org/abs/2008.12188
CVE: CVE-2020-24585
Published: 2020-08-21
Description: An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/wolfSSL/wolfssl/pull/3219; https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable; https://github.com/wolfSSL/wolfssl/pull/3219
CVE: CVE-2020-9095
Published: 2020-08-21
Description: HUAWEI P30 Pro smartphone with Versions earlier than 10.1.0.160(C00E160R2P8) has an integer overflow vulnerability. Some functions are lack of verification when they process some messages sent from other module. Attackers can exploit this vulnerability by send malicious message to cause integer overflow. This can compromise normal service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-03-smartphone-en
CVE: CVE-2020-9096
Published: 2020-08-21
Description: HUAWEI P30 Pro smartphones with Versions earlier than 10.1.0.160(C00E160R2P8) have an out of bound read vulnerability. Some functions are lack of verification when they process some messages sent from other module. Attackers can exploit this vulnerability by send malicious message to cause out-of-bound read. This can compromise normal service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-02-smartphone-en
CVE: CVE-2020-9104
Published: 2020-08-21
Description: HUAWEI P30 smartphones with Versions earlier than 10.1.0.123(C431E22R2P5),Versions earlier than 10.1.0.123(C432E22R2P5),Versions earlier than 10.1.0.126(C10E7R5P1),Versions earlier than 10.1.0.126(C185E4R7P1),Versions earlier than 10.1.0.126(C461E7R3P1),Versions earlier than 10.1.0.126(C605E19R1P3),Versions earlier than 10.1.0.126(C636E7R3P4),Versions earlier than 10.1.0.128(C635E3R2P4),Versions earlier than 10.1.0.160(C00E160R2P11),Versions earlier than 10.1.0.160(C01E160R2P11) have a denial of service vulnerability. In specific scenario, due to the improper resource management and memory leak of some feature, the attacker could exploit this vulnerability to cause the device reset.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-401
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-01-smartphonedos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-01-smartphonedos-en
CVE: CVE-2020-9246
Published: 2020-08-21
Description: FusionCompute 8.0.0 has an information leak vulnerability. A module does not launch strict access control and information protection. Attackers with low privilege can get some extra information. This can lead to information leak.
CVSS Score: 6.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-01-fc-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200819-01-fc-en
CVE: CVE-2020-10290
Published: 2020-08-21
Description: Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-250, CWE-269
References: https://github.com/aliasrobotics/RVD/issues/1495; https://github.com/aliasrobotics/RVD/issues/1495
CVE: CVE-2020-20634
Published: 2020-08-21
Description: Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-safe-mode-privilege-escalation-vulnerability/; https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-safe-mode-privilege-escalation-vulnerability/
CVE: CVE-2020-24051
Published: 2020-08-21
Description: The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issue to execute privileged operations without authentication, for instance, to create a new Administrator user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://ioac.tv/3hy1xu6; https://ioactive.com/moog-exo-series-multiple-vulnerabilities/; https://ioac.tv/3hy1xu6
CVE: CVE-2020-24052
Published: 2020-08-21
Description: Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition (DTD) in an XML request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://ioac.tv/3hy1xu6; https://ioactive.com/moog-exo-series-multiple-vulnerabilities/; https://ioac.tv/3hy1xu6
CVE: CVE-2020-24053
Published: 2020-08-21
Description: Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://ioac.tv/3hy1xu6; https://ioactive.com/moog-exo-series-multiple-vulnerabilities/; https://ioac.tv/3hy1xu6
CVE: CVE-2020-24054
Published: 2020-08-21
Description: The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments; however, this can be circumvented using special shell variables, such as '${IFS}'. As a result, an attacker can execute arbitrary commands as 'root' on the units.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://ioac.tv/3hy1xu6; https://ioactive.com/moog-exo-series-multiple-vulnerabilities/; https://ioac.tv/3hy1xu6
CVE: CVE-2020-24055
Published: 2020-08-21
Description: Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service implemented in the binary executable '/usr/sbin/DM' that listens on port TCP 6666. The service is vulnerable to a stack buffer overflow. It is worth noting that this service does not require any authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://ioac.tv/2Nbc40h; https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/; https://ioac.tv/2Nbc40h
CVE: CVE-2020-24056
Published: 2020-08-21
Description: A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD Verint_FW_0_42units. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://ioac.tv/2Nbc40h; https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/; https://ioac.tv/2Nbc40h
CVE: CVE-2020-24057
Published: 2020-08-21
Description: The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on the unit. This endpoint is vulnerable to a command injection. An authenticated attacker can leverage this issue to execute arbitrary commands as 'root'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://ioac.tv/2Nbc40h; https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities/; https://ioac.tv/2Nbc40h
CVE: CVE-2020-7923
Published: 2020-08-21
Description: A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://jira.mongodb.org/browse/SERVER-47773; https://jira.mongodb.org/browse/SERVER-47773
CVE: CVE-2020-20633
Published: 2020-08-21
Description: ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.nintechnet.com/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability/; https://blog.nintechnet.com/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability/
CVE: CVE-2019-19120
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19121
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19123
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19173
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19178
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19179
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19181
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19183
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-19184
Published: 2020-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-15140
Published: 2020-08-21
Description: In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
CVSS Score: 8.2 (HIGH)
CWE: CWE-74, CWE-74
References: https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81; https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4; https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81
CVE: CVE-2020-15147
Published: 2020-08-21
Description: Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94, CWE-74
References: https://github.com/Cog-Creators/Red-DiscordBot/pull/4183; https://github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18431b1df38a9be92bfc; https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x
CVE: CVE-2020-3975
Published: 2020-08-21
Description: VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting (XSS) vulnerability. A malicious actor with access to create and edit applications or create storage groups, may be able to inject malicious script which will be executed by a victim's browser when viewing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2020-0019.html; https://www.vmware.com/security/advisories/VMSA-2020-0019.html
CVE: CVE-2020-5775
Published: 2020-08-21
Description: Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://www.tenable.com/security/research/tra-2020-49; https://www.tenable.com/security/research/tra-2020-49
CVE: CVE-2019-11847
Published: 2020-08-21
Description: An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11848
Published: 2020-08-21
Description: An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-787
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11849
Published: 2020-08-21
Description: A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11850
Published: 2020-08-21
Description: A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11852
Published: 2020-08-21
Description: An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACEviewservice, accessible by default on the LAN.
CVSS Score: 3.7 (LOW)
CWE: CWE-125
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11853
Published: 2020-08-21
Description: Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.
CVSS Score: 3.9 (LOW)
CWE: CWE-77
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11855
Published: 2020-08-21
Description: An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.
CVSS Score: 8.1 (HIGH)
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11856
Published: 2020-08-21
Description: A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.
CVSS Score: 3.3 (LOW)
CWE: CWE-294
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11857
Published: 2020-08-21
Description: Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11858
Published: 2020-08-21
Description: Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11859
Published: 2020-08-21
Description: A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-120
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE: CVE-2019-11862
Published: 2020-08-21
Description: The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.
CVSS Score: 8.1 (HIGH)
References: https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-004/; https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-004/
CVE: CVE-2020-14201
Published: 2020-08-21
Description: Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-011; https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog
CVE: CVE-2020-24589
Published: 2020-08-21
Description: The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0742; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0742