deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-35111
Published: 2021-01-07
Description: When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1657916; https://www.mozilla.org/security/advisories/mfsa2020-54/; https://www.mozilla.org/security/advisories/mfsa2020-55/
CVE: CVE-2020-35112
Published: 2021-01-07
Description: If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1661365; https://www.mozilla.org/security/advisories/mfsa2020-54/; https://www.mozilla.org/security/advisories/mfsa2020-55/
CVE: CVE-2020-35113
Published: 2021-01-07
Description: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664831%2C1673589; https://www.mozilla.org/security/advisories/mfsa2020-54/; https://www.mozilla.org/security/advisories/mfsa2020-55/
CVE: CVE-2020-35114
Published: 2021-01-07
Description: Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1607449%2C1640416%2C1656459%2C1669914%2C1673567; https://www.mozilla.org/security/advisories/mfsa2020-54/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1607449%2C1640416%2C1656459%2C1669914%2C1673567
CVE: CVE-2021-3029
Published: 2021-01-07
Description: EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://shoxxdj.fr/ecsimaging-os-injection-cve-2021-3029/; https://www.evolucare.com; https://shoxxdj.fr/ecsimaging-os-injection-cve-2021-3029/
CVE: CVE-2020-26773
Published: 2021-01-07
Description: Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker to execute arbitrary SQL commands via the date parameter in includes/reservation.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://packetstormsecurity.com/files/159475/Restaurant-Reservation-System-1.0-SQL-Injection.html; https://www.sourcecodester.com/php/14482/restaurant-reservation-system-php-full-source-code-2020.html; https://packetstormsecurity.com/files/159475/Restaurant-Reservation-System-1.0-SQL-Injection.html
CVE: CVE-2020-28672
Published: 2021-01-07
Description: MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. At monofiles/category.php:27, user input can be saved to category/[foldername]/index.php causing RCE.
CVSS Score: 7.2 (HIGH)
References: https://github.com/fortest-1/vuln/blob/main/MonoCMS%20Blog/MonoCMS%20Blog%201.0_remote_code_execution.md; https://github.com/fortest-1/vuln/blob/main/MonoCMS%20Blog/MonoCMS%20Blog%201.0_remote_code_execution.md
CVE: CVE-2021-3011
Published: 2021-01-07
Description: An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-670
References: https://ninjalab.io/a-side-journey-to-titan/; https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf; https://ninjalab.io/a-side-journey-to-titan/
CVE: CVE-2018-19418
Published: 2021-01-07
Description: Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://vimeo.com/302125302; https://www.foxitsoftware.com/support/security-bulletins.html; https://vimeo.com/302125302
CVE: CVE-2018-20309
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20310
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20311
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20312
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-25476
Published: 2021-01-07
Description: Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch; https://github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119318646
CVE: CVE-2018-18688
Published: 2021-01-07
Description: The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or annotations, Body Updates are displayed to the user without any action by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects LibreOffice, Master PDF Editor, Nitro Pro, Nitro Reader, Nuance Power PDF Standard, PDF Editor 6 Pro, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, Perfect PDF 10 Premium, and Perfect PDF Reader.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://pdf-insecurity.org/signature/evaluation_2018.html; https://pdf-insecurity.org/signature/signature.html; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-18689
Published: 2021-01-07
Description: The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://pdf-insecurity.org/signature/evaluation_2018.html; https://pdf-insecurity.org/signature/signature.html; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20313
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20314
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20315
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-20316
Published: 2021-01-07
Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-362, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-13573
Published: 2021-01-07
Description: A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-823, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1184; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1184
CVE: CVE-2020-25680
Published: 2021-01-07
Description: A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from this vulnerability is to data integrity.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=1892703; https://bugzilla.redhat.com/show_bug.cgi?id=1892703
CVE: CVE-2020-27835
Published: 2021-01-07
Description: A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1901709; https://bugzilla.redhat.com/show_bug.cgi?id=1901709
CVE: CVE-2020-4892
Published: 2021-01-07
Description: IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190979; https://www.ibm.com/support/pages/node/6398274; https://exchange.xforce.ibmcloud.com/vulnerabilities/190979
CVE: CVE-2020-4893
Published: 2021-01-07
Description: IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190984; https://www.ibm.com/support/pages/node/6398282; https://exchange.xforce.ibmcloud.com/vulnerabilities/190984
CVE: CVE-2020-4895
Published: 2021-01-07
Description: IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190986; https://www.ibm.com/support/pages/node/6398286; https://exchange.xforce.ibmcloud.com/vulnerabilities/190986
CVE: CVE-2020-4896
Published: 2021-01-07
Description: IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190987; https://www.ibm.com/support/pages/node/6398284; https://exchange.xforce.ibmcloud.com/vulnerabilities/190987
CVE: CVE-2020-4897
Published: 2021-01-07
Description: IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190988.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190988; https://www.ibm.com/support/pages/node/6398276; https://www.ibm.com/support/pages/node/6398280
CVE: CVE-2020-4898
Published: 2021-01-07
Description: IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190989.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190989; https://www.ibm.com/support/pages/node/6398278; https://exchange.xforce.ibmcloud.com/vulnerabilities/190989
CVE: CVE-2020-6655
Published: 2021-01-07
Description: The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-1443/
CVE: CVE-2020-6656
Published: 2021-01-07
Description: Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-843, CWE-843
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-1441/
CVE: CVE-2019-18642
Published: 2021-01-07
Description: Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lack of validation and use of sequential user IDs allows any user to change account details of any other user. This vulnerability could be used to change the email address of another account, even the administrator account. Upon changing another account's email address, performing a password reset to the new email address could allow an attacker to take over any account.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html; http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html
CVE: CVE-2019-18643
Published: 2021-01-07
Description: Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. This could allow an attacker to upload ASPX code and gain remote code execution on the application. The application typically runs as LocalSystem as mandated in the installation guide. Patched in versions 8.10 and 9.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html; http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html
CVE: CVE-2020-17500
Published: 2021-01-07
Description: Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result in unauthenticated remote code execution in the username and password fields of the logon prompt. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.barco.com/en/support/cms; https://www.barco.com/en/support/knowledge-base/kb11588; https://www.barco.com/en/support/transform-n-management-server
CVE: CVE-2020-35745
Published: 2021-01-07
Description: PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://medium.com/%40ashketchum/privilege-escalation-unauthenticated-access-to-admin-portal-cve-2020-35745-bb5d5dca97a0; https://www.phpgurukul.com/hospital-management-system-in-php/; https://www.youtube.com/watch?v=vnSsg6iwV9Y&feature=youtu.be&ab_channel=ashketchum
CVE: CVE-2021-23241
Published: 2021-01-07
Description: MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.md; https://www.mercurycom.com.cn/product-521-1.html; https://www.mercusys.com/en/
CVE: CVE-2021-23242
Published: 2021-01-07
Description: MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Upnp%20Server%20Directory%20Traversal.md; https://www.mercurycom.com.cn/product-521-1.html; https://www.mercusys.com/en/
CVE: CVE-2020-13449
Published: 2021-01-07
Description: A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html; https://github.com/thecodingmachine/gotenberg/issues/199; http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
CVE: CVE-2020-13450
Published: 2021-01-07
Description: A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html; https://github.com/thecodingmachine/gotenberg/issues/199; http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
CVE: CVE-2020-13451
Published: 2021-01-07
Description: An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-459
References: http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html; https://github.com/thecodingmachine/gotenberg/issues/199; http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html