deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4544
Published: 2021-01-08
Description: IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 183189.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183189; https://www.ibm.com/support/pages/node/6398742; https://exchange.xforce.ibmcloud.com/vulnerabilities/183189
CVE: CVE-2020-4691
Published: 2021-01-08
Description: IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186698.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186698; https://www.ibm.com/support/pages/node/6398742; https://exchange.xforce.ibmcloud.com/vulnerabilities/186698
CVE: CVE-2020-4697
Published: 2021-01-08
Description: IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186790.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186790; https://www.ibm.com/support/pages/node/6398742; https://exchange.xforce.ibmcloud.com/vulnerabilities/186790
CVE: CVE-2020-4733
Published: 2021-01-08
Description: IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188127; https://www.ibm.com/support/pages/node/6398742; https://exchange.xforce.ibmcloud.com/vulnerabilities/188127
CVE: CVE-2020-5146
Published: 2021-01-09
Description: A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0022; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0022
CVE: CVE-2020-5147
Published: 2021-01-09
Description: SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client version 10.2.300 and earlier.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-428, CWE-428
References: http://packetstormsecurity.com/files/163857/SonicWall-NetExtender-10.2.0.300-Unquoted-Service-Path.html; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023; http://packetstormsecurity.com/files/163857/SonicWall-NetExtender-10.2.0.300-Unquoted-Service-Path.html
CVE: CVE-2020-35203
Published: 2021-01-11
Description: Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35204
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35205
Published: 2021-01-11
Description: Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35206
Published: 2021-01-11
Description: Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35719
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35720
Published: 2021-01-11
Description: Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when creating or modifying a user via the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35721
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseAssets.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35722
Published: 2021-01-11
Description: CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35723
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportPreview.do file via the referer parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35724
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter (or indirectly via the cpr, tcp, or abs parameter). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35725
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35726
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2020-35727
Published: 2021-01-11
Description: Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseDirs.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications; https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
CVE: CVE-2021-3116
Published: 2021-01-11
Description: before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication/; https://github.com/abhinavsingh/proxy.py/pull/482/commits/9b[PII_REDACTED]7f5073c403f2c4f62acfdfa8ed46; https://pypi.org/project/proxy.py/2.3.1/#history
CVE: CVE-2021-3118
Published: 2021-01-11
Description: EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (such as /req_password_user.php?email=). This allows an attacker to steal data in the database and obtain access to the application. (The database component runs as root.) NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49392; https://www.exploit-db.com/exploits/49392
CVE: CVE-2021-3121
Published: 2021-01-11
Description: An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-129
References: https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025; https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc; https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
CVE: CVE-2020-11995
Published: 2021-01-11
Description: A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2020-13922
Published: 2021-01-11
Description: Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264, CWE-276
References: https://www.mail-archive.com/announce%40apache.org/msg06076.html; https://www.mail-archive.com/announce%40apache.org/msg06076.html
CVE: CVE-2020-17508
Published: 2021-01-11
Description: The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.
CVSS Score: 7.5 (HIGH)
References: https://lists.apache.org/thread.html/r65434f7acca3aebf81b[PII_REDACTED]c893fe9f8f9f159eaa7364a70ff%40%3Cannounce.trafficserver.apache.org%3E; https://lists.apache.org/thread.html/r65434f7acca3aebf81b[PII_REDACTED]c893fe9f8f9f159eaa7364a70ff%40%3Cannounce.trafficserver.apache.org%3E
CVE: CVE-2020-17509
Published: 2021-01-11
Description: ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://lists.apache.org/thread.html/raa9f0589c26c4d146646425e51e2a33e1457492df9f7ea2019daa6d3%40%3Cannounce.trafficserver.apache.org%3E; https://lists.apache.org/thread.html/raa9f0589c26c4d146646425e51e2a33e1457492df9f7ea2019daa6d3%40%3Cannounce.trafficserver.apache.org%3E
CVE: CVE-2020-26800
Published: 2021-01-11
Description: A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://ethereum.org/en/about/; https://github.com/ethereum/aleth; https://github.com/ethereum/aleth/issues/5917
CVE: CVE-2020-23643
Published: 2021-01-11
Description: XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cherry-toto/jizhicms/issues/29; https://github.com/Cherry-toto/jizhicms/issues/29
CVE: CVE-2020-23644
Published: 2021-01-11
Description: XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cherry-toto/jizhicms/issues/28; https://github.com/Cherry-toto/jizhicms/issues/28
CVE: CVE-2020-23849
Published: 2021-01-11
Description: Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/josdejong/jsoneditor/issues/1029; https://github.com/josdejong/jsoneditor/issues/1029
CVE: CVE-2020-23630
Published: 2021-01-11
Description: A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://zzcms.com; https://github.com/Pandora1m2/; https://github.com/Pandora1m2/zzcms201910/issues/1
CVE: CVE-2020-26118
Published: 2021-01-11
Description: In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://support.smartbear.com/collaborator/docs/general-info/version-history/ver-13/ver-13-0.html; https://support.smartbear.com/collaborator/docs/general-info/whats-new.html; https://support.smartbear.com/collaborator/docs/server/index.html
CVE: CVE-2020-2508
Published: 2021-01-11
Description: A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later)
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-01; https://www.qnap.com/zh-tw/security-advisory/qsa-21-01
CVE: CVE-2020-35483
Published: 2021-01-11
Description: AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, allows this attacker to compromise a local user account via a read-only setting for a Trojan horse gcapi.dll file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://anydesk.com/cve/2020-35483/; https://anydesk.com/cve/2020-35483/
CVE: CVE-2018-11005
Published: 2021-01-11
Description: A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-11006
Published: 2021-01-11
Description: An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-11007
Published: 2021-01-11
Description: A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-11008
Published: 2021-01-11
Description: An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-11009
Published: 2021-01-11
Description: A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-11010
Published: 2021-01-11
Description: A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-11246
Published: 2021-01-11
Description: K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021; https://www.k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE: CVE-2018-8044
Published: 2021-01-11
Description: K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K7Sentry.sys.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-863
References: http://k7antivirus.com; http://k7computing.com; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021