deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12256
Published: 2020-05-18
Description: rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8; https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
CVE: CVE-2020-12801
Published: 2020-05-18
Description: If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4 series versions prior to 6.4.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311, CWE-312
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00011.html; https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html; https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12801
CVE: CVE-2020-8035
Published: 2020-05-18
Description: The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/horde/base/blob/c00f2fdb222055fb2ccb6d53b5b5240c0a7d2a75/docs/CHANGES; https://lists.debian.org/debian-lts-announce/2020/05/msg00035.html; https://lists.horde.org/archives/announce/2020/001290.html
CVE: CVE-2019-7246
Published: 2020-05-18
Description: An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driver exposes a wrmsr instruction and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
CVSS Score: 6.7 (MEDIUM)
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0015/FEYE-2019-0015.md; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0015/FEYE-2019-0015.md
CVE: CVE-2019-7247
Published: 2020-05-18
Description: An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0014/FEYE-2019-0014.md; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0014/FEYE-2019-0014.md
CVE: CVE-2020-11549
Published: 2020-05-18
Description: An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The root account has the same password as the Web-admin component. Thus, by exploiting CVE-2020-11551, it is possible to achieve remote code execution with root privileges on the embedded Linux system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://github.com/modzero/MZ-20-02-NETGEAR-Orbi-Security; https://www.modzero.com/advisories/MZ-20-02-Netgear-Orbi-Pro-Security.txt; https://www.modzero.com/modlog/archives/2020/05/18/how_netgear_meshed_up_wifi_for_business/index.html
CVE: CVE-2020-11550
Published: 2020-05-18
Description: An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote leak of sensitive/arbitrary Wi-Fi information, such as SSIDs and Pre-Shared-Keys (PSK).
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/modzero/MZ-20-02-NETGEAR-Orbi-Security; https://www.modzero.com/advisories/MZ-20-02-Netgear-Orbi-Pro-Security.txt; https://www.modzero.com/modlog/archives/2020/05/18/how_netgear_meshed_up_wifi_for_business/index.html
CVE: CVE-2020-11551
Published: 2020-05-18
Description: An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi configuration data such as authentication details (e.g., the Web-admin password), network settings, DNS settings, system administration interface configuration, etc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-330
References: https://github.com/modzero/MZ-20-02-NETGEAR-Orbi-Security; https://www.modzero.com/advisories/MZ-20-02-Netgear-Orbi-Pro-Security.txt; https://www.modzero.com/modlog/archives/2020/05/18/how_netgear_meshed_up_wifi_for_business/index.html
CVE: CVE-2019-19454
Published: 2020-05-18
Description: An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0.
CVSS Score: 7.5 (HIGH)
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-19454.txt; https://www.gruppotim.it/redteam; https://www.wowza.com/docs/wowza-streaming-engine-4-8-0-release-notes
CVE: CVE-2019-19456
Published: 2020-05-18
Description: A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-19456.txt; https://www.gruppotim.it/redteam; https://www.wowza.com/docs/wowza-streaming-engine-4-8-0-release-notes
CVE: CVE-2020-13135
Published: 2020-05-18
Description: D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10172; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10172
CVE: CVE-2020-13136
Published: 2020-05-18
Description: D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer.
CVSS Score: 7.5 (HIGH)
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10172; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10172
CVE: CVE-2020-6074
Published: 2020-05-18
Description: An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155. A specially crafted PDF document can cause a use-after-free which can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-0997; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0997
CVE: CVE-2020-6092
Published: 2020-05-18
Description: An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects. A specially crafted PDF file can trigger an integer overflow that can lead to arbitrary code execution. In order to trigger this vulnerability, victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1013; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1013
CVE: CVE-2020-6093
Published: 2020-05-18
Description: An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability, victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1014; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1014
CVE: CVE-2020-8034
Published: 2020-05-18
Description: Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/horde/gollem/blob/95b2a4212d734f1b27aaa7a221d2fa1370d2631f/docs/CHANGES; https://github.com/horde/gollem/commits/master; https://lists.debian.org/debian-lts-announce/2020/05/msg00033.html
CVE: CVE-2020-13143
Published: 2020-05-18
Description: gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html; https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=d126cf46f829d146dde3e6a8963e095ac6cfcd1c
CVE: CVE-2020-13144
Published: 2020-05-18
Description: Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-862
References: http://packetstormsecurity.com/files/157785/OpenEDX-Ironwood-2.5-Remote-Code-Execution.html; https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/architecture.html; https://stark0de.com/2020/05/17/openedx-vulnerabilities.html
CVE: CVE-2020-13145
Published: 2020-05-18
Description: Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://stark0de.com/2020/05/17/openedx-vulnerabilities.html; https://stark0de.com/2020/05/17/openedx-vulnerabilities.html
CVE: CVE-2020-13146
Published: 2020-05-18
Description: Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://stark0de.com/2020/05/17/openedx-vulnerabilities.html; https://stark0de.com/2020/05/17/openedx-vulnerabilities.html
CVE: CVE-2020-13149
Published: 2020-05-18
Description: Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite system files and gain escalated privileges. One attack method is to change the Recommended App binary within App.json. Another attack method is to use this part of %PROGRAMDATA% for mounting an RPC Control directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/rishaldwivedi/Public_Disclosure/blob/master/README.md#msi-dragon-center-eop; https://github.com/rishaldwivedi/Public_Disclosure/blob/master/README.md#msi-dragon-center-eop
CVE: CVE-2019-17066
Published: 2020-05-18
Description: In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives (HKCU) when starting an application with elevated rights.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-acquire-admin-privileges-by-hijacking-certain-user-registry-entries; https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-acquire-admin-privileges-by-hijacking-certain-user-registry-entries
CVE: CVE-2020-13094
Published: 2020-05-18
Description: Dolibarr before 11.0.4 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/157752/Dolibarr-11.0.3-Cross-Site-Scripting.html; https://github.com/Dolibarr/dolibarr/blob/11.0.4/ChangeLog; https://www.dolibarr.org/dolibarr-erp-crm-11-0-4-maintenance-release-for-branch-11-0-is-available.php
CVE: CVE-2020-13153
Published: 2020-05-18
Description: app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/2989aa05225aa9b3a592ca50cbf8350ef256909c; https://github.com/MISP/MISP/compare/v2.4.125...v2.4.126; https://github.com/MISP/MISP/commit/2989aa05225aa9b3a592ca50cbf8350ef256909c
CVE: CVE-2020-13154
Published: 2020-05-18
Description: Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/eLeN3Re/CVE-2020-13154; https://www.manageengine.com/products/service-desk/on-premises/readme.html; https://gitlab.com/eLeN3Re/CVE-2020-13154
CVE: CVE-2020-1897
Published: 2020-05-18
Description: A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.facebook.com/security/advisories/cve-2020-1897; https://www.facebook.com/security/advisories/cve-2020-1897
CVE: CVE-2020-12667
Published: 2020-05-19
Description: Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://cyber-security-group.cs.tau.ac.il/#; http://www.openwall.com/lists/oss-security/2020/05/19/2; https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/
CVE: CVE-2020-8434
Published: 2020-05-19
Description: Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://medium.com/%40mdavis332/higher-ed-erp-portal-vulnerability-auth-bypass-to-login-any-account-f1aeef438f80; https://medium.com/%40mdavis332/higher-ed-erp-portal-vulnerability-auth-bypass-to-login-any-account-f1aeef438f80
CVE: CVE-2020-12244
Published: 2020-05-19
Description: An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html; http://www.openwall.com/lists/oss-security/2020/05/19/3; https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-02.html
CVE: CVE-2020-12662
Published: 2020-05-19
Description: Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html; http://www.nxnsattack.com
CVE: CVE-2020-12663
Published: 2020-05-19
Description: Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html; http://www.openwall.com/lists/oss-security/2020/05/19/5
CVE: CVE-2020-4286
Published: 2020-05-19
Description: IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 176268.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176268; https://www.ibm.com/support/pages/node/6194751; https://exchange.xforce.ibmcloud.com/vulnerabilities/176268
CVE: CVE-2020-4298
Published: 2020-05-19
Description: IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176475.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176475; https://www.ibm.com/support/pages/node/6194775; https://exchange.xforce.ibmcloud.com/vulnerabilities/176475
CVE: CVE-2020-4411
Published: 2020-05-19
Description: The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel module that could allow an attacker to cause a denial of service condition on the affected system. To exploit this vulnerability, a local attacker could invoke a subset of ioctls on the Spectrum Scale device with non-valid arguments. This could allow the attacker to crash the kernel. IBM X-Force ID: 179986.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179986; https://www.ibm.com/support/pages/node/6209002; https://exchange.xforce.ibmcloud.com/vulnerabilities/179986
CVE: CVE-2020-4412
Published: 2020-05-19
Description: The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service security vulnerability. An attacker can force the Spectrum Scale mmfsd/mmsdrserv daemons to unexpectedly exit, impacting the functionality of the Spectrum Scale cluster and the availability of file systems managed by Spectrum Scale. IBM X-Force ID: 179987.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179987; https://www.ibm.com/support/pages/node/6209004; https://exchange.xforce.ibmcloud.com/vulnerabilities/179987
CVE: CVE-2020-6956
Published: 2020-05-19
Description: PCS DEXICON 3.4.1 allows XSS via the loginName parameter in login_action.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.kpmg.de/noindex/advisories/KPMG-2019-001.txt; https://www.kpmg.de/noindex/advisories/KPMG-2019-001.txt
CVE: CVE-2020-8616
Published: 2020-05-19
Description: A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html; http://www.nxnsattack.com
CVE: CVE-2020-8617
Published: 2020-05-19
Description: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html; http://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html
CVE: CVE-2020-11845
Published: 2020-05-19
Description: Cross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://softwaresupport.softwaregrp.com/doc/KM03640285; https://softwaresupport.softwaregrp.com/doc/KM03640285
CVE: CVE-2020-1695
Published: 2020-05-19
Description: A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1695; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJDMT443YZWCBS5NS76XZ7TL3GK7BXHL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ/
CVE: CVE-2020-8021
Published: 2020-05-19
Description: a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://bugzilla.suse.com/show_bug.cgi?id=1171649; https://lists.debian.org/debian-lts-announce/2021/02/msg00006.html; https://bugzilla.suse.com/show_bug.cgi?id=1171649