deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11527
Published: 2020-04-04
Description: In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
CVSS Score: 7.5 (HIGH)
References: https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181
CVE: CVE-2020-11528
Published: 2020-04-04
Description: bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/14isnot40/vul_discovery/blob/06d04dbbc6f792a82321c00376d4dbf3add00f4f/poc/bit2spr%20vulnerability%20discovery.md.pdf; https://github.com/14isnot40/vul_discovery/blob/14isnot40-patch-1/README.md; https://github.com/14isnot40/vul_discovery/blob/06d04dbbc6f792a82321c00376d4dbf3add00f4f/poc/bit2spr%20vulnerability%20discovery.md.pdf
CVE: CVE-2020-11529
Published: 2020-04-04
Description: Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://getgrav.org/#changelog; https://github.com/getgrav/grav/commit/2eae104c7a4bf32bc26cb8073d5c40464bfda3f7; https://github.com/getgrav/grav/issues/3134
CVE: CVE-2020-11533
Published: 2020-04-04
Description: Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVSS Score: 5.5 (MEDIUM)
References: https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-recover-keying-material-due-to-an-unspecified-attack-vector; https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-recover-keying-material-due-to-an-unspecified-attack-vector
CVE: CVE-2020-11542
Published: 2020-04-04
Description: 3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-319
References: https://www.criticalstart.com/authentication-bypass-vulnerability-discovered-in-infinias-eidc32-webserver/; https://www.criticalstart.com/authentication-bypass-vulnerability-discovered-in-infinias-eidc32-webserver/
CVE: CVE-2020-11547
Published: 2020-04-05
Description: PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure; https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure
CVE: CVE-2020-11548
Published: 2020-04-05
Description: The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://wordpress.org/plugins/search-meter/#developers; https://www.exploit-db.com/exploits/48197; https://wordpress.org/plugins/search-meter/#developers
CVE: CVE-2020-11558
Published: 2020-04-05
Description: An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/gpac/gpac/commit/6063b1a011c3f80cee25daade18154e15e4c058c; https://github.com/gpac/gpac/issues/1440; https://github.com/gpac/gpac/commit/6063b1a011c3f80cee25daade18154e15e4c058c
CVE: CVE-2020-11565
Published: 2020-04-06
Description: An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd; https://github.com/torvalds/linux/commit/aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd; https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
CVE: CVE-2020-10264
Published: 2020-04-06
Description: CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows setting registers, the speed slider fraction as well as digital and analog Outputs. Additionally unautheticated reading of robot data is also possible
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-306
References: https://www.universal-robots.com/how-tos-and-faqs/how-to/ur-how-tos/real-time-data-exchange-rtde-guide/; https://www.universal-robots.com/how-tos-and-faqs/how-to/ur-how-tos/real-time-data-exchange-rtde-guide/
CVE: CVE-2020-10265
Published: 2020-04-06
Description: Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.universal-robots.com/how-tos-and-faqs/how-to/ur-how-tos/real-time-data-exchange-rtde-guide/; https://www.universal-robots.com/how-tos-and-faqs/how-to/ur-how-tos/real-time-data-exchange-rtde-guide/
CVE: CVE-2020-10266
Published: 2020-04-06
Description: UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots (e.g. in the UR10), no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universal Robots. An attacker could exploit this flaw by crafting a custom component with the SDK, performing Person-In-The-Middle attacks (PITM) and shipping the maliciously-crafted component on demand.
CVSS Score: 8.1 (HIGH)
CWE: CWE-353, CWE-345
References: https://github.com/aliasrobotics/RVD/issues/1487; https://github.com/aliasrobotics/RVD/issues/1487
CVE: CVE-2020-10267
Published: 2020-04-06
Description: Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components (URCaps). These files (*.urcaps) are stored under '/root/.urcaps' as plain zip files containing all the logic to add functionality to the UR3, UR5 and UR10 robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-312
References: https://github.com/aliasrobotics/RVD/issues/1489; https://github.com/aliasrobotics/RVD/issues/1489
CVE: CVE-2020-7631
Published: 2020-04-06
Description: diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/iximiuz/node-diskusage-ng/blob/master/lib/posix.js#L11; https://snyk.io/vuln/SNYK-JS-DISKUSAGENG-564425; https://github.com/iximiuz/node-diskusage-ng/blob/master/lib/posix.js#L11
CVE: CVE-2020-7632
Published: 2020-04-06
Description: node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/j-holub/Node-MPV/blob/master/lib/util.js#L34; https://snyk.io/vuln/SNYK-JS-NODEMPV-564426; https://github.com/j-holub/Node-MPV/blob/master/lib/util.js#L34
CVE: CVE-2020-7633
Published: 2020-04-06
Description: apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://openbase.io/js/apiconnect-cli-plugins; https://snyk.io/vuln/SNYK-JS-APICONNECTCLIPLUGINS-564427; https://openbase.io/js/apiconnect-cli-plugins
CVE: CVE-2020-7634
Published: 2020-04-06
Description: heroku-addonpool through 0.1.15 is vulnerable to Command Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/nodef/heroku-addonpool/blob/master/index.js; https://snyk.io/vuln/SNYK-JS-HEROKUADDONPOOL-564428; https://github.com/nodef/heroku-addonpool/blob/master/index.js
CVE: CVE-2020-7635
Published: 2020-04-06
Description: compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/quaertym/compass-compile/blob/master/lib/compass.js#L25; https://snyk.io/vuln/SNYK-JS-COMPASSCOMPILE-564429; https://github.com/quaertym/compass-compile/blob/master/lib/compass.js#L25
CVE: CVE-2020-7636
Published: 2020-04-06
Description: adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-ADBDRIVER-564430; https://www.npmjs.com/package/adb-driver; https://snyk.io/vuln/SNYK-JS-ADBDRIVER-564430
CVE: CVE-2020-7637
Published: 2020-04-06
Description: class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/typestack/class-transformer/commit/8f04eb9db02de708f1a20f6f2d2bb309b2fed01e; https://snyk.io/vuln/SNYK-JS-CLASSTRANSFORMER-564431; https://github.com/typestack/class-transformer/commit/8f04eb9db02de708f1a20f6f2d2bb309b2fed01e
CVE: CVE-2020-7638
Published: 2020-04-06
Description: confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab; https://snyk.io/vuln/SNYK-JS-CONFINIT-564433; https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab
CVE: CVE-2020-7639
Published: 2020-04-06
Description: eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b; https://snyk.io/vuln/SNYK-JS-EIVIFJDOT-564435; https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b
CVE: CVE-2020-8004
Published: 2020-04-06
Description: STMicroelectronics STM32F1 devices have Incorrect Access Control.
CVSS Score: 7.5 (HIGH)
References: https://blog.zapb.de/stm32f1-exceptional-failure/; https://blog.zapb.de/stm32f1-exceptional-failure/
CVE: CVE-2020-1728
Published: 2020-04-06
Description: A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-358, CWE-1021
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1728; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1728
CVE: CVE-2020-7622
Published: 2020-04-06
Description: This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/jooby-project/jooby/commit/b66e3342cf[PII_REDACTED]3cfdf2cb5811e8a6dcf4; https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j; https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249
CVE: CVE-2020-9473
Published: 2020-04-06
Description: The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-306
References: https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/; https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE: CVE-2019-19699
Published: 2020-04-06
Description: There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability, someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://download.centreon.com/; https://github.com/SpengeSec/CVE-2019-19699; https://spenge.pw/cves/
CVE: CVE-2020-11102
Published: 2020-04-06
Description: hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2020/04/06/1; http://www.openwall.com/lists/oss-security/2020/04/06/1; https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg08322.html
CVE: CVE-2020-11507
Published: 2020-04-06
Description: An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://forums.malwarebytes.com/topic/258140-release-adwcleaner-804/; https://forums.malwarebytes.com/topic/258140-release-adwcleaner-804/
CVE: CVE-2020-11544
Published: 2020-04-06
Description: An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the upload section on the file-manager page contains an arbitrary file upload vulnerability via add_cars.php. There are no upload restrictions for executable files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://frostylabs.net/writeups/cve-2020-11544/; https://frostylabs.net/writeups/cve-2020-11544/
CVE: CVE-2020-11545
Published: 2020-04-06
Description: Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters (login.php), and id parameter (book_car.php) This allows an attacker to dump the MySQL database and to bypass the login authentication prompt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://frostylabs.net/writeups/cve-2020-11545/; https://frostylabs.net/writeups/cve-2020-11545/
CVE: CVE-2020-5300
Published: 2020-04-06
Description: In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3; https://github.com/ory/hydra/releases/tag/v1.4.0; https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66
CVE: CVE-2020-5832
Published: 2020-04-06
Description: Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
References: https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1750; https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1750
CVE: CVE-2020-11580
Published: 2020-04-06
Description: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: https://git.lsd.cat/g/pulse-host-checker-rce; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426; https://git.lsd.cat/g/pulse-host-checker-rce
CVE: CVE-2020-11581
Published: 2020-04-06
Description: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://git.lsd.cat/g/pulse-host-checker-rce; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426; https://git.lsd.cat/g/pulse-host-checker-rce
CVE: CVE-2020-11582
Published: 2020-04-06
Description: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://git.lsd.cat/g/pulse-host-checker-rce; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426; https://git.lsd.cat/g/pulse-host-checker-rce
CVE: CVE-2020-11585
Published: 2020-04-06
Description: There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-330, CWE-639
References: https://neff.blog/2020/04/04/dotnetnuke-9-5-file-path-information-disclosure/; https://neff.blog/2020/04/04/dotnetnuke-9-5-file-path-information-disclosure/
CVE: CVE-2020-11588
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an HTTP GET request to two files that contain customer data and application paths.
CVSS Score: 5.3 (MEDIUM)
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11589
Published: 2020-04-06
Description: An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11590
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
CVSS Score: 5.3 (MEDIUM)
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11591
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.
CVSS Score: 5.3 (MEDIUM)
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11592
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database.
CVSS Score: 7.5 (HIGH)
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11593
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE: CVE-2020-11594
Published: 2020-04-06
Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build[PII_REDACTED]. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/; https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/