deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3157
Published: 2020-03-04
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by crafting a malicious configuration and saving it to the targeted system. An exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information when an administrator views the configuration. An attacker would need write permissions to exploit this vulnerability successfully.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-BR7nEDjG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-BR7nEDjG
CVE: CVE-2020-3164
Published: 2020-03-04
Description: A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific HTTP request headers. An attacker could exploit this vulnerability by sending a malformed HTTP request to an affected device. A successful exploit could allow the attacker to trigger a prolonged status of high CPU utilization relative to the GUI process(es). Upon successful exploitation of this vulnerability, an affected device will still be operative, but its response time and overall performance may be degraded.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cont-sec-gui-dos-nJ625dXb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cont-sec-gui-dos-nJ625dXb
CVE: CVE-2020-3176
Published: 2020-03-04
Description: A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not properly sanitize user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying certain CLI commands with crafted arguments. A successful exploit could allow the attacker to run arbitrary commands as the root user, which could result in a complete system compromise.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rphy-cmdinject-DpEjeTgF; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rphy-cmdinject-DpEjeTgF
CVE: CVE-2020-3181
Published: 2020-03-04
Description: A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated remote attacker to exhaust resources on an affected device. The vulnerability is due to insufficient control over system memory allocation. An attacker could exploit this vulnerability by sending a crafted email through the targeted device. A successful exploit could allow the attacker to cause an email attachment that contains malware to be delivered to a user and cause email processing delays.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-resource-exhaust-D7RQAhnD; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-resource-exhaust-D7RQAhnD
CVE: CVE-2020-3182
Published: 2020-03-04
Description: A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow an unauthenticated adjacent attacker to obtain sensitive information about the device on which the Webex client is running. The vulnerability exists because sensitive information is included in the mDNS reply. An attacker could exploit this vulnerability by doing an mDNS query for a particular service against an affected device. A successful exploit could allow the attacker to gain access to sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-info-disc-OHqg982; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-info-disc-OHqg982
CVE: CVE-2020-3185
Published: 2020-03-04
Description: A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web-based management interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-xss-4VXKdLO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-xss-4VXKdLO
CVE: CVE-2020-3190
Published: 2020-03-04
Description: A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition for IPsec sessions to an affected device. The vulnerability is due to improper handling of packets by the IPsec packet processor. An attacker could exploit this vulnerability by sending malicious ICMP error messages to an affected device that get punted to the IPsec packet processor. A successful exploit could allow the attacker to deplete IPsec memory, resulting in all future IPsec packets to an affected device being dropped by the device. Manual intervention is required to recover from this situation.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipsec-dos-q8UPX6m; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipsec-dos-q8UPX6m
CVE: CVE-2020-3192
Published: 2020-03-04
Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-collab-xss-RjRCe9n7; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-collab-xss-RjRCe9n7
CVE: CVE-2020-3193
Published: 2020-03-04
Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to obtain sensitive information about an affected device. The vulnerability exists because replies from the web-based management interface include unnecessary server information. An attacker could exploit this vulnerability by inspecting replies received from the web-based management interface. A successful exploit could allow the attacker to obtain details about the operating system, including the web server version that is running on the device, which could be used to perform further attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prim-collab-disclo-FAnX4DKB; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prim-collab-disclo-FAnX4DKB
CVE: CVE-2020-9371
Published: 2020-03-04
Description: Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html; https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9; https://wordpress.org/plugins/appointment-booking-calendar/#developers
CVE: CVE-2020-9372
Published: 2020-03-04
Description: The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html; https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9; https://wordpress.org/plugins/appointment-booking-calendar/#developers
CVE: CVE-2020-9476
Published: 2020-03-04
Description: ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://arris.secure.force.com/consumers/ConsumerProductSupport; https://medium.com/%40rsantos_14778/info-disclosure-cve-2020-9476-494a08298c6b; https://arris.secure.force.com/consumers/ConsumerProductSupport
CVE: CVE-2020-9477
Published: 2020-03-04
Description: An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interface could allow an unauthenticated remote attacker to capture packets at the time of authentication and gain access to the cleartext password. An attacker could use this access to create a new user account or control the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://medium.com/%40rsantos_14778/info-disclosure-cve-2020-9477-29d0ca48d4fa; https://uk.humaxdigital.com/network/hga12r-02/; https://medium.com/%40rsantos_14778/info-disclosure-cve-2020-9477-29d0ca48d4fa
CVE: CVE-2020-9550
Published: 2020-03-04
Description: Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://pastebin.com/CckKKJcM; https://rubetek.com/; https://pastebin.com/CckKKJcM
CVE: CVE-2020-9054
Published: 2020-03-04
Description: Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78, CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://kb.cert.org/artifacts/cve-2020-9054.html; https://kb.cert.org/vuls/id/498544/
CVE: CVE-2020-7130
Published: 2020-03-04
Description: HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. HPE OneView Global Dashboard - After Upgrade or Install of OVGD Version 1.9, Appliance Firewall May Leave Ports Open. This is resolved in OVGD 1.91 or later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf03987en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf03987en_us
CVE: CVE-2020-8659
Published: 2020-03-04
Description: CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://access.redhat.com/errata/RHSA-2020:0734; https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv; https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html
CVE: CVE-2020-8661
Published: 2020-03-04
Description: CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2020:0734; https://github.com/envoyproxy/envoy/security/advisories/GHSA-36cq-ww7h-p4j7; https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history
CVE: CVE-2020-8664
Published: 2020-03-04
Description: CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://access.redhat.com/errata/RHSA-2020:0734; https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8; https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history
CVE: CVE-2019-17643
Published: 2020-03-04
Description: An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
CVE: CVE-2019-17644
Published: 2020-03-04
Description: An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
CVE: CVE-2020-8660
Published: 2020-03-04
Description: CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://access.redhat.com/errata/RHSA-2020:0734; https://github.com/envoyproxy/envoy/security/advisories/GHSA-c4g8-7grc-5wvx; https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history
CVE: CVE-2020-10096
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains physical access to a user's workstation can browse the browser cache contents and obtain sensitive information. The attacker does not need to be authenticated with the application to view this information, as it would be available via the browser cache.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://zammad.com/news/security-advisory-zaa-2020-11; https://zammad.com/news/security-advisory-zaa-2020-11
CVE: CVE-2020-10097
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabilities.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://zammad.com/news/security-advisory-zaa-2020-10; https://zammad.com/news/security-advisory-zaa-2020-10
CVE: CVE-2020-10098
Published: 2020-03-05
Description: An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/news/security-advisory-zaa-2020-03; https://zammad.com/news/security-advisory-zaa-2020-03
CVE: CVE-2020-10099
Published: 2020-03-05
Description: An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens the ticket or has the ticket within the Toolbar.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/news/security-advisory-zaa-2020-01; https://zammad.com/news/security-advisory-zaa-2020-01
CVE: CVE-2020-10100
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies.
CVSS Score: 6.5 (MEDIUM)
References: https://zammad.com/news/security-advisory-zaa-2020-05; https://zammad.com/news/security-advisory-zaa-2020-05
CVE: CVE-2020-10101
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-755
References: https://zammad.com/news/security-advisory-zaa-2020-06; https://zammad.com/news/security-advisory-zaa-2020-06
CVE: CVE-2020-10102
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the current implementation, the application responds differently depending on whether the input supplied was recognized as associated with a valid user. This behavior could be used as part of a two-stage automated attack. During the first stage, an attacker would iterate through a list of account names to determine which correspond to valid accounts. During the second stage, the attacker would use a list of common passwords to attempt to brute force credentials for accounts that were recognized by the system in the first stage.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://zammad.com/news/security-advisory-zaa-2020-07; https://zammad.com/news/security-advisory-zaa-2020-07
CVE: CVE-2020-10103
Published: 2020-03-05
Description: An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/news/security-advisory-zaa-2020-02; https://zammad.com/news/security-advisory-zaa-2020-02
CVE: CVE-2020-10104
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://zammad.com/news/security-advisory-zaa-2020-04; https://zammad.com/news/security-advisory-zaa-2020-04
CVE: CVE-2020-10105
Published: 2020-03-05
Description: An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/public/404.html)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://zammad.com/news/security-advisory-zaa-2020-09; https://zammad.com/news/security-advisory-zaa-2020-09
CVE: CVE-2018-11838
Published: 2020-03-05
Description: Possible double free issue in WLAN due to lack of checking memory free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, MDM9640, SDA660, SDM636, SDM660, SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin