deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6982
Published: 2020-03-24
Description: In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-644, CWE-74
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-05; https://www.us-cert.gov/ics/advisories/icsa-20-056-05
CVE: CVE-2020-6991
Published: 2020-03-24
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE: CVE-2020-6997
Published: 2020-03-24
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE: CVE-2020-7001
Published: 2020-03-24
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to be disclosed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE: CVE-2020-7007
Published: 2020-03-24
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE: CVE-2020-8984
Published: 2020-03-24
Description: lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: http://jul.es/pipermail/zendto/2020-January/003845.html; https://zend.to/changelog.php; http://jul.es/pipermail/zendto/2020-January/003845.html
CVE: CVE-2020-8985
Published: 2020-03-24
Description: ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://zend.to/changelog.php; https://zend.to/changelog.php
CVE: CVE-2020-8986
Published: 2020-03-24
Description: lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-754
References: https://zend.to/changelog.php; https://zend.to/changelog.php
CVE: CVE-2019-4001
Published: 2020-03-24
Description: Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.tenable.com/security/research/tra-2020-12; https://www.tenable.com/security/research/tra-2020-12
CVE: CVE-2020-10942
Published: 2020-03-24
Description: In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html; http://www.openwall.com/lists/oss-security/2020/04/15/4; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8
CVE: CVE-2020-6802
Published: 2020-03-24
Description: In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://advisory.checkmarx.net/advisory/CX-2020-4276; https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI/
CVE: CVE-2020-6816
Published: 2020-03-24
Description: In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://advisory.checkmarx.net/advisory/CX-2020-4277; https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/
CVE: CVE-2020-5261
Published: 2020-03-25
Description: Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.
CVSS Score: 8.2 (HIGH)
CWE: CWE-294, CWE-294
References: https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241; https://github.com/Sustainsys/Saml2/issues/711; https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv
CVE: CVE-2020-5552
Published: 2020-03-25
Description: Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN85942151/index.html; https://jvn.jp/en/jp/JVN85942151/index.html
CVE: CVE-2020-5553
Published: 2020-03-25
Description: mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://jvn.jp/en/jp/JVN77634892/index.html; https://jvn.jp/en/jp/JVN77634892/index.html
CVE: CVE-2020-5554
Published: 2020-03-25
Description: Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN32415420/index.html; https://jvn.jp/en/jp/JVN32415420/index.html
CVE: CVE-2020-5555
Published: 2020-03-25
Description: Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unspecified vector due to the improper input validation issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN32415420/index.html; https://jvn.jp/en/jp/JVN32415420/index.html
CVE: CVE-2020-5556
Published: 2020-03-25
Description: Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN63834780/index.html; https://jvn.jp/en/jp/JVN63834780/index.html
CVE: CVE-2020-5557
Published: 2020-03-25
Description: Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN29095127/index.html; https://jvn.jp/en/jp/JVN29095127/index.html
CVE: CVE-2020-5558
Published: 2020-03-25
Description: CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://jvn.jp/en/jp/JVN58176087/index.html; https://jvn.jp/en/jp/JVN58176087/index.html
CVE: CVE-2020-5559
Published: 2020-03-25
Description: Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN88033799/index.html; https://jvn.jp/en/jp/JVN88033799/index.html
CVE: CVE-2020-5560
Published: 2020-03-25
Description: WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN27951364/index.html; https://jvn.jp/en/jp/JVN27951364/index.html
CVE: CVE-2020-5561
Published: 2020-03-25
Description: Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN88277644/index.html; https://jvn.jp/en/jp/JVN88277644/index.html
CVE: CVE-2020-10789
Published: 2020-03-25
Description: openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/it-novum/openITCOCKPIT/commit/73b5b34afa8bd82ff26c[PII_REDACTED]214c768cfc; https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/; https://github.com/it-novum/openITCOCKPIT/commit/73b5b34afa8bd82ff26c[PII_REDACTED]214c768cfc
CVE: CVE-2020-10790
Published: 2020-03-25
Description: openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/it-novum/openITCOCKPIT/commit/3838d98d35ececc7e83cf0f7cf785c9a7729cdbf; https://github.com/it-novum/openITCOCKPIT/commit/6c9bb1d7cf5f24683e704cee8c84b8b6d850d8bf; https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
CVE: CVE-2020-10791
Published: 2020-03-25
Description: app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/it-novum/openITCOCKPIT/commit/50722befae4cfedd0103f9b0ec2a7e22530b2385; https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/; https://github.com/it-novum/openITCOCKPIT/commit/50722befae4cfedd0103f9b0ec2a7e22530b2385
CVE: CVE-2019-19127
Published: 2020-03-25
Description: An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This occurs because the Uniface TLS Driver is not enabled by default. This vulnerability allows attackers to gain access to credentials or execute arbitrary SQL queries on the SITS backend as long as they have access to the client executable or can intercept traffic from a user who does.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/156903/SITS-Vision-9.7.0-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/26; http://seclists.org/fulldisclosure/2020/Mar/26
CVE: CVE-2020-10788
Published: 2020-03-25
Description: openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a[PII_REDACTED]1e API key rather than generating a random API Key for WebSocket connections.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee; https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/; https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee
CVE: CVE-2020-9375
Published: 2020-03-25
Description: TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://packetstormsecurity.com/files/156928/TP-Link-Archer-C50-V3-Denial-of-Service.html; https://thewhiteh4t.github.io/2020/02/27/CVE-2020-9375-TP-Link-Archer-C50-v3-Denial-of-Service.html; https://thewhiteh4t.github.io/blog/cve-2020-9375-tplink/
CVE: CVE-2020-1957
Published: 2020-03-25
Description: Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.apache.org/thread.html/r17f371fc89d34df2d0c8131473fbc68154290e1be238895648f5a1e6%40%3Cdev.shiro.apache.org%3E; https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E; https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3%40%3Ccommits.shiro.apache.org%3E
CVE: CVE-2020-3792
Published: 2020-03-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]0 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-13.html; https://helpx.adobe.com/security/products/acrobat/apsb20-13.html
CVE: CVE-2020-3793
Published: 2020-03-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]0 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-13.html; https://helpx.adobe.com/security/products/acrobat/apsb20-13.html
CVE: CVE-2020-3795
Published: 2020-03-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-13.html; https://helpx.adobe.com/security/products/acrobat/apsb20-13.html
CVE: CVE-2020-3797
Published: 2020-03-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-13.html; https://helpx.adobe.com/security/products/acrobat/apsb20-13.html
CVE: CVE-2020-3799
Published: 2020-03-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]0 and earlier have a stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-13.html; https://helpx.adobe.com/security/products/acrobat/apsb20-13.html
CVE: CVE-2019-20633
Published: 2020-03-25
Description: GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://savannah.gnu.org/bugs/index.php?56683; https://savannah.gnu.org/bugs/index.php?56683
CVE: CVE-2019-7240
Published: 2020-03-25
Description: An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x9C402088 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-665
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0004/FEYE-2019-0004.md; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0004/FEYE-2019-0004.md
CVE: CVE-2019-7244
Published: 2020-03-25
Description: An issue was discovered in kerneld.sys in AIDA64 before 5.99. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x80112084 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-665
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0010/FEYE-2019-0010.md; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0010/FEYE-2019-0010.md
CVE: CVE-2019-7245
Published: 2020-03-25
Description: An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. The vulnerable driver exposes a wrmsr instruction via an IOCTL and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-665
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0002/FEYE-2019-0002.md; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0002/FEYE-2019-0002.md
CVE: CVE-2019-7630
Published: 2020-03-25
Description: An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does not properly filter the target Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-665
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0003/FEYE-2019-0003.md; https://www.gigabyte.com/Support/Security/1801; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0003/FEYE-2019-0003.md
CVE: CVE-2020-10649
Published: 2020-03-25
Description: DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://drive.google.com/file/d/1Ap293b7bZLen6DmheppR1IUFEAsCSORC/view?usp=sharing; https://www.asus.com/Laptops/ASUS-TUF-Gaming-FX504/HelpDesk_Download/; https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/
CVE: CVE-2020-2160
Published: 2020-03-25
Description: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2161
Published: 2020-03-25
Description: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2162
Published: 2020-03-25
Description: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1793; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2163
Published: 2020-03-25
Description: Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1796; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2164
Published: 2020-03-25
Description: Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20%281%29; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2165
Published: 2020-03-25
Description: Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20%282%29; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2166
Published: 2020-03-25
Description: Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1741; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2167
Published: 2020-03-25
Description: Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1739; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2168
Published: 2020-03-25
Description: Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732; http://www.openwall.com/lists/oss-security/2020/03/25/2
CVE: CVE-2020-2169
Published: 2020-03-25
Description: A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/25/2; https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724; http://www.openwall.com/lists/oss-security/2020/03/25/2