deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6319
Published: 2020-10-15
Description: SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal authentication information of the user, such as data relating to his or her current session and limitedly impact confidentiality and integrity of the application, leading to Reflected Cross Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2956398; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2956398
CVE: CVE-2020-6323
Published: 2020-10-15
Description: SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system, resulting in Cross Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2960329; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2960329
CVE: CVE-2020-6363
Published: 2020-10-15
Description: SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-613
References: https://launchpad.support.sap.com/#/notes/2965287; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2965287
CVE: CVE-2020-6364
Published: 2020-10-15
Description: SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/163153/SAP-Wily-Introscope-Enterprise-OS-Command-Injection.html; http://seclists.org/fulldisclosure/2021/Jun/28; https://launchpad.support.sap.com/#/notes/2969828
CVE: CVE-2020-6368
Published: 2020-10-15
Description: SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2960825; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2960825
CVE: CVE-2020-6371
Published: 2020-10-15
Description: User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP (POWL test application) versions - 710, 711, 730, 731, 740, 750, leading to Information Disclosure.
CVSS Score: 4.3 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2963137; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2963137
CVE: CVE-2020-6372
Published: 2020-10-15
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://launchpad.support.sap.com/#/notes/2973497; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://www.zerodayinitiative.com/advisories/ZDI-20-1264/
CVE: CVE-2020-6373
Published: 2020-10-15
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://launchpad.support.sap.com/#/notes/2973497; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://www.zerodayinitiative.com/advisories/ZDI-20-1263/
CVE: CVE-2020-6374
Published: 2020-10-15
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-125
References: https://launchpad.support.sap.com/#/notes/2973497; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://www.zerodayinitiative.com/advisories/ZDI-20-1266/
CVE: CVE-2020-6375
Published: 2020-10-15
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Computer Graphics Metafile (.cgm) file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2973497; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2973497
CVE: CVE-2020-6376
Published: 2020-10-15
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2973497; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2973497
CVE: CVE-2020-27153
Published: 2020-10-15
Description: In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.
CVSS Score: 8.6 (HIGH)
CWE: CWE-415, CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00036.html; https://bugzilla.redhat.com/show_bug.cgi?id=1884817
CVE: CVE-2020-5642
Published: 2020-10-15
Description: Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN92404841/index.html; https://plugins.trac.wordpress.org/changeset?new=2384440%40onwebchat&old=2364589%40onwebchat; https://wordpress.org/plugins/onwebchat/
CVE: CVE-2020-6365
Published: 2020-10-15
Description: SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. The attacker could execute phishing attacks to steal credentials of the victim or to redirect users to untrusted web pages containing malware or similar malicious exploits.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/2969828; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2969828
CVE: CVE-2020-27156
Published: 2020-10-15
Description: Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.veritas.com/content/support/en_US/security/VTS20-006#issue1; https://www.veritas.com/content/support/en_US/security/VTS20-006#issue1
CVE: CVE-2020-27157
Published: 2020-10-15
Description: Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server. An unauthenticated user could login to the application and gain access to the data and functionality accessible to the targeted user account.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294
References: https://www.veritas.com/content/support/en_US/security/VTS20-006#issue2; https://www.veritas.com/content/support/en_US/security/VTS20-006#issue2
CVE: CVE-2020-7334
Published: 2020-10-15
Description: Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further controls for installation/uninstallation of software.
CVSS Score: 7.7 (HIGH)
CWE: CWE-266, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10333; https://kc.mcafee.com/corporate/index?page=content&id=SB10333
CVE: CVE-2020-7326
Published: 2020-10-15
Description: Improperly implemented security check in McAfee Active Response (MAR) prior to 2.4.4 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MAR failing open rather than closed
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10331; https://kc.mcafee.com/corporate/index?page=content&id=SB10331
CVE: CVE-2020-7327
Published: 2020-10-15
Description: Improperly implemented security check in McAfee MVISION Endpoint Detection and Response Client (MVEDR) prior to 3.2.0 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MVEDR failing open rather than closed
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10331; https://kc.mcafee.com/corporate/index?page=content&id=SB10331
CVE: CVE-2019-4552
Published: 2020-10-15
Description: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 165960.
CVSS Score: 6.1 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165960; https://www.ibm.com/support/pages/node/6348046; https://exchange.xforce.ibmcloud.com/vulnerabilities/165960
CVE: CVE-2020-4499
Published: 2020-10-15
Description: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.
CVSS Score: 9.8 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182216; https://www.ibm.com/support/pages/node/6348046; https://exchange.xforce.ibmcloud.com/vulnerabilities/182216
CVE: CVE-2020-7744
Published: 2020-10-15
Description: This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-319
References: https://snyk.io/blog/remote-code-execution-rce-sourmint/; https://snyk.io/research/sour-mint-malicious-sdk/; https://snyk.io/vuln/SNYK-JAVA-COMMINTEGRALMSDK-1018714
CVE: CVE-2020-11641
Published: 2020-10-15
Description: A local file inclusion vulnerability in B&R SiteManager versions <9.2.620236042 allows authenticated users to read sensitive files from SiteManager instances.
CVSS Score: 7.7 (HIGH)
CWE: CWE-552, CWE-552
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]51-de-original-1.0.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE: CVE-2020-11642
Published: 2020-10-15
Description: The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager instances.
CVSS Score: 7.7 (HIGH)
CWE: CWE-552, CWE-552
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]51-de-original-1.0.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE: CVE-2020-11643
Published: 2020-10-15
Description: An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view information of devices belonging to foreign domains.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]51-de-original-1.0.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE: CVE-2020-11644
Published: 2020-10-15
Description: The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to generate fake audit log messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]51-de-original-1.0.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE: CVE-2020-11645
Published: 2020-10-15
Description: A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to limit availability of GateManager instances.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]51-de-original-1.0.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE: CVE-2020-11646
Published: 2020-10-15
Description: A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view log information reserved for other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]51-de-original-1.0.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03
CVE: CVE-2020-21674
Published: 2020-10-15
Description: Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (out-of-bounds write in heap memory resulting into a crash) via a crafted archive file. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4; https://github.com/libarchive/libarchive/issues/1298; https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4
CVE: CVE-2020-6104
Published: 2020-10-15
Description: An exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause information disclosure resulting in a information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.gentoo.org/glsa/202101-26; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1046; https://security.gentoo.org/glsa/202101-26
CVE: CVE-2020-6105
Published: 2020-10-15
Description: An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://security.gentoo.org/glsa/202101-26; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1047; https://security.gentoo.org/glsa/202101-26
CVE: CVE-2020-6106
Published: 2020-10-15
Description: An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-131, CWE-125, CWE-131
References: https://security.gentoo.org/glsa/202101-26; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1048; https://security.gentoo.org/glsa/202101-26
CVE: CVE-2020-6107
Published: 2020-10-15
Description: An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-253, CWE-125, CWE-754
References: https://security.gentoo.org/glsa/202101-26; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1049; https://security.gentoo.org/glsa/202101-26
CVE: CVE-2020-6108
Published: 2020-10-15
Description: An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause a heap buffer overflow resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131, CWE-131, CWE-787
References: https://security.gentoo.org/glsa/202101-26; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1050; https://security.gentoo.org/glsa/202101-26
CVE: CVE-2019-12411
Published: 2020-10-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-11637
Published: 2020-10-15
Description: A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]96-de-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]96-de-original-1.0.pdf
CVE: CVE-2020-13939
Published: 2020-10-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-25858
Published: 2020-10-15
Description: The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return value of a strstr() or strchr() call in the Tokenizer() function. An attacker who invokes the web interface with a crafted URL can crash the process, causing denial of service. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities; http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities
CVE: CVE-2020-25859
Published: 2020-10-15
Description: The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities; http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities
CVE: CVE-2020-12500
Published: 2020-10-15
Description: Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html; http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html; http://seclists.org/fulldisclosure/2021/Jun/0
CVE: CVE-2020-12501
Published: 2020-10-15
Description: Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html; http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html; http://packetstormsecurity.com/files/167409/Korenix-JetPort-5601V3-Backdoor-Account.html