deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-14248
Published: 2020-12-16
Description: BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085735; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085735
CVE: CVE-2020-14254
Published: 2020-12-16
Description: TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085733; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085733
CVE: CVE-2020-25620
Published: 2020-12-16
Description: An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or the regular web interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://ernw.de/en/publications.html; https://insinuator.net/2020/12/security-advisories-for-solarwinds-n-central/; https://support.solarwinds.com/SuccessCenter/s/
CVE: CVE-2020-25621
Published: 2020-12-16
Description: An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords.
CVSS Score: 8.4 (HIGH)
CWE: CWE-306
References: https://ernw.de/en/publications.html; https://insinuator.net/2020/12/security-advisories-for-solarwinds-n-central/; https://support.solarwinds.com/SuccessCenter/s/
CVE: CVE-2020-25622
Published: 2020-12-16
Description: An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://ernw.de/en/publications.html; https://insinuator.net/2020/12/security-advisories-for-solarwinds-n-central/; https://support.solarwinds.com/SuccessCenter/s/
CVE: CVE-2020-29607
Published: 2020-12-16
Description: A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/162785/Pluck-CMS-4.7.13-Remote-Shell-Upload.html; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2020-29607-Exploit; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-29607.md
CVE: CVE-2020-4008
Published: 2020-12-16
Description: The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which a macOS sensor is going to be installed, may overwrite a limited number of files with output from the sensor installation.
CVSS Score: 3.6 (LOW)
References: https://www.vmware.com/security/advisories/VMSA-2020-0028.html; https://www.vmware.com/security/advisories/VMSA-2020-0028.html
CVE: CVE-2019-14477
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://compass-security.com/fileadmin/Research/Advisories/2020-11_CSNC-2019-012_AdRem_NetCrunch_Improper_Credential_Storage.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-11_CSNC-2019-012_AdRem_NetCrunch_Improper_Credential_Storage.txt
CVE: CVE-2019-14480
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-311, CWE-338, CWE-522, CWE-732
References: https://compass-security.com/fileadmin/Research/Advisories/2020-14_CSNC-2019-015_AdRem_NetCrunch_Improper_Session_Handling.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-14_CSNC-2019-015_AdRem_NetCrunch_Improper_Session_Handling.txt
CVE: CVE-2019-14482
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://compass-security.com/fileadmin/Research/Advisories/2020-16_CSNC-2019-017_AdRem_NetCrunch_Hardcoded_SSL_Private_Key.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-16_CSNC-2019-017_AdRem_NetCrunch_Hardcoded_SSL_Private_Key.txt
CVE: CVE-2019-14483
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys' passwords, and root passwords stored in the credential manager. Every administrator can read the ESX and Windows passwords stored in the credential manager.
CVSS Score: 8.8 (HIGH)
References: https://compass-security.com/fileadmin/Research/Advisories/2020-17_CSNC-2019-018_AdRem_NetCrunch_Credentials_Disclosure.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-17_CSNC-2019-018_AdRem_NetCrunch_Credentials_Disclosure.txt
CVE: CVE-2020-26198
Published: 2020-12-16
Description: Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000181088/dsa-2020-268-dell-emc-idrac9-reflected-xss-vulnerability; https://www.dell.com/support/kbdoc/en-us/000181088/dsa-2020-268-dell-emc-idrac9-reflected-xss-vulnerability
CVE: CVE-2020-5359
Published: 2020-12-16
Description: Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to modify and corrupt the encrypted data.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-544, CWE-252
References: https://www.dell.com/support/kbdoc/en-us/000181098/dsa-2020-114-dell-bsafe-micro-edition-suite-multiple-security-vulnerabilities; https://www.oracle.com/security-alerts/cpuApr2021.html; https://www.dell.com/support/kbdoc/en-us/000181098/dsa-2020-114-dell-bsafe-micro-edition-suite-multiple-security-vulnerabilities
CVE: CVE-2020-5360
Published: 2020-12-16
Description: Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability resulting in undefined behaviour, or a crash of the affected systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-127, CWE-125
References: https://www.dell.com/support/kbdoc/en-us/000181098/dsa-2020-114-dell-bsafe-micro-edition-suite-multiple-security-vulnerabilities; https://www.oracle.com/security-alerts/cpuApr2021.html; https://www.dell.com/support/kbdoc/en-us/000181098/dsa-2020-114-dell-bsafe-micro-edition-suite-multiple-security-vulnerabilities
CVE: CVE-2019-14476
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://compass-security.com/fileadmin/Research/Advisories/2020-10_CSNC-2019-011_AdRem_NetCrunch_Server-Side_Request_Forgery_SSRF.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-10_CSNC-2019-011_AdRem_NetCrunch_Server-Side_Request_Forgery_SSRF.txt
CVE: CVE-2019-14478
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://compass-security.com/fileadmin/Research/Advisories/2020-12_CSNC-2019-013_AdRem_NetCrunch_Cross-Site_Scripting_XSS.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-12_CSNC-2019-013_AdRem_NetCrunch_Cross-Site_Scripting_XSS.txt
CVE: CVE-2019-14479
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server running the NetCrunch server software.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://compass-security.com/fileadmin/Research/Advisories/2020-13_CSNC-2019-014_AdRem_NetCrunch_Remote_Code_Execution.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-13_CSNC-2019-014_AdRem_NetCrunch_Remote_Code_Execution.txt
CVE: CVE-2019-14481
Published: 2020-12-16
Description: AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://compass-security.com/fileadmin/Research/Advisories/2020-15_CSNC-2019-016_AdRem_NetCrunch_Cross-Site_Request_Forgery_CSRF.txt; https://www.adremsoft.com/support/; https://compass-security.com/fileadmin/Research/Advisories/2020-15_CSNC-2019-016_AdRem_NetCrunch_Cross-Site_Request_Forgery_CSRF.txt
CVE: CVE-2020-7837
Published: 2020-12-16
Description: An issue was discovered in ML Report Program. There is a stack-based buffer overflow in function sub_41EAF0 at MLReportDeamon.exe. The function will call vsprintf without checking the length of strings in parameters given by attacker. And it finally leads to a stack-based buffer overflow via access to crafted web page. This issue affects: Infraware ML Report 2.19.312.0000.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35849; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35849
CVE: CVE-2020-35133
Published: 2020-12-16
Description: irfanView 4.56 contains an error processing parsing files of type .pcx. Which leads to out-of-bounds writing at i_view32+0xdb60.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/DmitryMeD/pentesting/blob/main/IrfanView%204.56.md; https://twitter.com/DmitriyMelikov; https://github.com/DmitryMeD/pentesting/blob/main/IrfanView%204.56.md
CVE: CVE-2020-7781
Published: 2020-12-16
Description: This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/skoranga/node-connection-tester/pull/10; https://snyk.io/vuln/SNYK-JS-CONNECTIONTESTER-1048337; https://github.com/skoranga/node-connection-tester/pull/10
CVE: CVE-2020-26274
Published: 2020-12-16
Description: In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99; https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-m57p-p67h-mq74; https://www.npmjs.com/package/systeminformation
CVE: CVE-2020-28929
Published: 2020-12-16
Description: Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-1; https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-1
CVE: CVE-2020-28930
Published: 2020-12-16
Description: A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-2; https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-2
CVE: CVE-2020-28931
Published: 2020-12-16
Description: Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-3; https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-3
CVE: CVE-2020-4657
Published: 2020-12-16
Description: IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186094.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186094; https://www.ibm.com/support/pages/node/6382414; https://exchange.xforce.ibmcloud.com/vulnerabilities/186094
CVE: CVE-2020-4658
Published: 2020-12-16
Description: IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186095.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186095; https://www.ibm.com/support/pages/node/6382416; https://exchange.xforce.ibmcloud.com/vulnerabilities/186095
CVE: CVE-2020-4904
Published: 2020-12-16
Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191106; https://www.ibm.com/support/pages/node/6371260; https://exchange.xforce.ibmcloud.com/vulnerabilities/191106
CVE: CVE-2020-4905
Published: 2020-12-16
Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an remote attacker to obtain sensitive information, caused by a man in the middle attack. By SSL striping, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Score: 5.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191109; https://www.ibm.com/support/pages/node/6371260; https://exchange.xforce.ibmcloud.com/vulnerabilities/191109
CVE: CVE-2020-4906
Published: 2020-12-16
Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191110; https://www.ibm.com/support/pages/node/6371260; https://exchange.xforce.ibmcloud.com/vulnerabilities/191110
CVE: CVE-2020-4907
Published: 2020-12-16
Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191112; https://www.ibm.com/support/pages/node/6371260; https://exchange.xforce.ibmcloud.com/vulnerabilities/191112
CVE: CVE-2020-4908
Published: 2020-12-16
Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191113; https://www.ibm.com/support/pages/node/6371260; https://exchange.xforce.ibmcloud.com/vulnerabilities/191113
CVE: CVE-2020-35185
Published: 2020-12-17
Description: The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35185; https://github.com/koharin/koharin2/blob/main/CVE-2020-35185
CVE: CVE-2020-35187
Published: 2020-12-17
Description: The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35187; https://github.com/koharin/koharin2/blob/main/CVE-2020-35187
CVE: CVE-2020-35189
Published: 2020-12-17
Description: The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35189; https://github.com/koharin/koharin2/blob/main/CVE-2020-35189
CVE: CVE-2020-29436
Published: 2020-12-17
Description: Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]82-CVE-2020-29436-Nexus-Repository-Manager-3-XML-External-Entities-injection-2020-12-15; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]82-CVE-2020-29436-Nexus-Repository-Manager-3-XML-External-Entities-injection-2020-12-15
CVE: CVE-2020-35184
Published: 2020-12-17
Description: The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35184; https://github.com/koharin/koharin2/blob/main/CVE-2020-35184
CVE: CVE-2020-35186
Published: 2020-12-17
Description: The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35186; https://github.com/koharin/koharin2/blob/main/CVE-2020-35186
CVE: CVE-2020-35188
Published: 2020-12-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-5021. Reason: This candidate is a reservation duplicate of CVE-2019-5021. Notes: All CVE users should reference CVE-2019-5021 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usag
CVE: CVE-2020-35190
Published: 2020-12-17
Description: The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35190; https://github.com/koharin/koharin2/blob/main/CVE-2020-35190
CVE: CVE-2020-35191
Published: 2020-12-17
Description: The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35191; https://github.com/koharin/koharin2/blob/main/CVE-2020-35191
CVE: CVE-2020-35192
Published: 2020-12-17
Description: The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35192; https://github.com/koharin/koharin2/blob/main/CVE-2020-35192
CVE: CVE-2020-35194
Published: 2020-12-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-5021. Reason: This candidate is a reservation duplicate of CVE-2019-5021. Notes: All CVE users should reference CVE-2019-5021 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-35195
Published: 2020-12-17
Description: The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35195; https://github.com/koharin/koharin2/blob/main/CVE-2020-35195
CVE: CVE-2020-35196
Published: 2020-12-17
Description: The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-35196; https://github.com/koharin/koharin2/blob/main/CVE-2020-35196