deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-2148
Published: 2020-03-09
Description: A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1761; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2149
Published: 2020-03-09
Description: Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1520; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2150
Published: 2020-03-09
Description: Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1523; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2151
Published: 2020-03-09
Description: Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1519; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2152
Published: 2020-03-09
Description: Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1727; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2153
Published: 2020-03-09
Description: Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1510; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2154
Published: 2020-03-09
Description: Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1550; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2155
Published: 2020-03-09
Description: Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1518; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2156
Published: 2020-03-09
Description: Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1511; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2157
Published: 2020-03-09
Description: Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1522; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2158
Published: 2020-03-09
Description: Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1750; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2159
Published: 2020-03-09
Description: Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1635; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-5256
Published: 2020-03-09
Description: BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
CVSS Score: 7.9 (HIGH)
CWE: CWE-95, CWE-434
References: https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3; https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4; https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5
CVE: CVE-2020-9386
Published: 2020-03-09
Description: In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://bugs.launchpad.net/mahara/+bug/1840201; https://mahara.org/interaction/forum/topic.php?id=8589; https://bugs.launchpad.net/mahara/+bug/1840201
CVE: CVE-2020-9517
Published: 2020-03-09
Description: There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 and 9.60. The vulnerability may result in the ability of malicious users to perform UI redress attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://softwaresupport.softwaregrp.com/doc/KM03604692; https://softwaresupport.softwaregrp.com/doc/KM03604692
CVE: CVE-2014-1634
Published: 2020-03-09
Description: SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://labs.integrity.pt/advisories/cve-2014-1634/; https://labs.integrity.pt/advisories/cve-2014-1634/
CVE: CVE-2015-7338
Published: 2020-03-09
Description: SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://labs.integrity.pt/advisories/cve-2015-7338/; https://labs.integrity.pt/advisories/cve-2015-7338/
CVE: CVE-2015-7339
Published: 2020-03-09
Description: JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://labs.integrity.pt/advisories/cve-2015-7339/; https://labs.integrity.pt/advisories/cve-2015-7339/
CVE: CVE-2015-7340
Published: 2020-03-09
Description: JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://labs.integrity.pt/advisories/cve-2015-7340/; https://labs.integrity.pt/advisories/cve-2015-7340/
CVE: CVE-2015-7341
Published: 2020-03-09
Description: JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://labs.integrity.pt/advisories/cve-2015-7341/; https://labs.integrity.pt/advisories/cve-2015-7341/
CVE: CVE-2015-7342
Published: 2020-03-09
Description: JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://labs.integrity.pt/advisories/cve-2015-7342/; https://labs.integrity.pt/advisories/cve-2015-7342/
CVE: CVE-2016-1159
Published: 2020-03-09
Description: In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password history) via a vulnerable hidden service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/vu/JVNVU90405898/index.html; https://excellium-services.com/cert-xlm-advisory/cve-2016-1159/; https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html
CVE: CVE-2016-6918
Published: 2020-03-09
Description: Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files. (
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://support.lexmark.com/index?page=content&id=TE828&locale=EN&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE828&locale=EN&userlocale=EN_US
CVE: CVE-2020-4084
Published: 2020-03-09
Description: HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0076649; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0076649
CVE: CVE-2020-8987
Published: 2020-03-09
Description: Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.)
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast; https://www.davideade.com/2020/03/avast-antitrack.html; https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast
CVE: CVE-2011-3269
Published: 2020-03-09
Description: Lexmark X, W, T, E, C, 6500e, and 25xxN devices before 2011-11-15 allow attackers to obtain sensitive information via a hidden email address in a Scan To Email shortcut.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://contentdelivery.lexmark.com/webcontent/Email_shortcut_vulnerability.pdf; http://contentdelivery.lexmark.com/webcontent/Email_shortcut_vulnerability.pdf
CVE: CVE-2011-4538
Published: 2020-03-09
Description: Lexmark X, W, T, E, and C devices before 2012-02-09 allow attackers to obtain sensitive information by reading passwords within exported settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://contentdelivery.lexmark.com/webcontent/CVE-2011-4538.pdf; http://contentdelivery.lexmark.com/webcontent/CVE-2011-4538.pdf
CVE: CVE-2016-1487
Published: 2020-03-09
Description: Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://support.lexmark.com/index?page=content&id=TE747&locale=EN&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE747&locale=EN&userlocale=EN_US
CVE: CVE-2019-19614
Published: 2020-03-09
Description: An issue was discovered in Halvotec RAQuest 10.23.10801.0. The login page is vulnerable to wildcard injection, allowing an attacker to enumerate the list of users sharing an identical password. Fixed in Release 10.24.11206.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://excellium-services.com/cert-xlm-advisory/; https://excellium-services.com/cert-xlm-advisory/cve-2019-19614/; https://excellium-services.com/cert-xlm-advisory/
CVE: CVE-2020-10190
Published: 2020-03-09
Description: An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by crafting a special payload on the /datatables/data endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/wiki/20200309-Authenticated-SQL-injection; https://github.com/munkireport/munkireport-php/releases
CVE: CVE-2020-10191
Published: 2020-03-09
Description: An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/wiki/20200309-Authenticated-Comment-XSS; https://github.com/munkireport/munkireport-php/releases
CVE: CVE-2020-10192
Published: 2020-03-09
Description: An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/wiki/20200309-XSS-vulnerability; https://github.com/munkireport/munkireport-php/releases
CVE: CVE-2020-10244
Published: 2020-03-09
Description: JPaseto before 0.3.0 generates weak hashes when using v2.local tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/paseto-toolkit/jpaseto/releases/tag/jpaseto-0.3.0; https://github.com/paseto-toolkit/jpaseto/releases/tag/jpaseto-0.3.0
CVE: CVE-2020-10246
Published: 2020-03-09
Description: MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/43a0757fb33769d9ad4ca09e8f2ac572f9f6a491; https://github.com/MISP/MISP/releases/tag/v2.4.123; https://github.com/MISP/MISP/commit/43a0757fb33769d9ad4ca09e8f2ac572f9f6a491
CVE: CVE-2020-10247
Published: 2020-03-09
Description: MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/e24a9eb44c1306adb02c1508e8f266ac6b95b4ed; https://github.com/MISP/MISP/releases/tag/v2.4.123; https://github.com/MISP/MISP/commit/e24a9eb44c1306adb02c1508e8f266ac6b95b4ed
CVE: CVE-2020-10248
Published: 2020-03-09
Description: BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://sku11army.blogspot.com/2020/03/bwa-multiple-vulnerabilities-in-direx.html; https://sku11army.blogspot.com/2020/03/bwa-multiple-vulnerabilities-in-direx.html
CVE: CVE-2020-10249
Published: 2020-03-09
Description: BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to val_soft.php3.
CVSS Score: 5.3 (MEDIUM)
References: https://sku11army.blogspot.com/2020/03/bwa-multiple-vulnerabilities-in-direx.html; https://sku11army.blogspot.com/2020/03/bwa-multiple-vulnerabilities-in-direx.html
CVE: CVE-2020-10250
Published: 2020-03-09
Description: BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninstall.php3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://sku11army.blogspot.com/2020/03/bwa-multiple-vulnerabilities-in-direx.html; https://sku11army.blogspot.com/2020/03/bwa-multiple-vulnerabilities-in-direx.html
CVE: CVE-2020-9758
Published: 2020-03-09
Description: An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/ari034/CVE-2020-9758; https://github.com/ari034/CVE-2020-9758
CVE: CVE-2020-5342
Published: 2020-03-09
Description: Dell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions vulnerability. A locally authenticated low-privileged malicious user could exploit this vulnerability to run an arbitrary executable with administrative privileges on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.dell.com/support/article/SLN320561; https://www.dell.com/support/article/SLN320561
CVE: CVE-2020-10257
Published: 2020-03-10
Description: The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-862
References: https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/; https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
CVE: CVE-2020-10251
Published: 2020-03-10
Description: In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c. It can be triggered via an image with a width or height value that exceeds the actual size of the image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/1859; https://github.com/ImageMagick/ImageMagick/issues/1859
CVE: CVE-2019-4608
Published: 2020-03-10
Description: IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168508.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168508; https://www.ibm.com/support/pages/node/5694189; https://exchange.xforce.ibmcloud.com/vulnerabilities/168508
CVE: CVE-2020-4162
Published: 2020-03-10
Description: IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174342.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174342; https://www.ibm.com/support/pages/node/5690451; https://exchange.xforce.ibmcloud.com/vulnerabilities/174342
CVE: CVE-2017-10992
Published: 2020-03-10
Description: In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvokerServlet, aka PSRT110461.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://labs.integrity.pt/advisories/cve-2017-10992/; https://labs.integrity.pt/advisories/cve-2017-10992/
CVE: CVE-2018-14502
Published: 2020-03-10
Description: controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/chained-quiz/#developers; https://wpvulndb.com/vulnerabilities/9112; https://wordpress.org/plugins/chained-quiz/#developers
CVE: CVE-2018-18894
Published: 2020-03-10
Description: Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://support.lexmark.com/alerts; http://support.lexmark.com/index?page=content&id=TE906&locale=EN&userlocale=EN_US; http://support.lexmark.com/alerts
CVE: CVE-2019-10065
Published: 2020-03-10
Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search result screens to disclose information from internal FAQ articles, a different vulnerability than CVE-2019-9753.
CVSS Score: 4.3 (MEDIUM)
References: https://community.otrs.com/category/release-and-security-notes-en/; https://otrs.com/release-notes/otrs-security-advisory-2019-07/; https://community.otrs.com/category/release-and-security-notes-en/
CVE: CVE-2019-10706
Published: 2020-03-10
Description: Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522
References: https://support.wdc.com/cat_products.aspx?ID=6&lang=en; https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd; https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssd
CVE: CVE-2019-11686
Published: 2020-03-10
Description: Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive parameters (such as data encryption keys) to remain on the drive media after their intended erasure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://support.wdc.com/downloads.aspx?g=907&lang=en; https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd; https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-s