deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15113
Published: 2020-08-05
Description: In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/; https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92
CVE: CVE-2020-16254
Published: 2020-08-05
Description: The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://github.com/ankane/chartkick; https://github.com/ankane/chartkick/issues/546; https://github.com/ankane/chartkick
CVE: CVE-2020-13404
Published: 2020-08-05
Description: The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3.0.5 for Magento allows command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/quadra-informatique/Atos-Magento/releases; https://sysdream.com/news/lab/; https://sysdream.com/news/lab/2020-06-09-cve-2020-13404-remote-system-command-injection-in-atos-magento-module/
CVE: CVE-2020-15127
Published: 2020-08-05
Description: In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flipping the readiness endpoint to false, which removes Envoy from the routing pool. When running Envoy (For example on the host network, pod spec hostNetwork=true), the shutdown manager's endpoint is accessible to anyone on the network that can reach the Kubernetes node that's running Envoy. There is no authentication in place that prevents a rogue actor on the network from shutting down Envoy via the shutdown manager endpoint. Successful exploitation of this issue will lead to bad actors shutting down all instances of Envoy, essentially killing the entire ingress data plane. This is fixed in version 1.7.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://github.com/projectcontour/contour/releases/tag/v1.7.0; https://github.com/projectcontour/contour/security/advisories/GHSA-mjp8-x484-pm3r; https://github.com/projectcontour/contour/releases/tag/v1.7.0
CVE: CVE-2020-15132
Published: 2020-08-05
Description: In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist. This enables attackers to retrieve valid usernames. Also, the response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful. This information should not be exposed, as it can be used to gather email addresses. This problem was fixed in versions 1.6.35, 2.0.10 and 2.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/sulu/sulu/security/advisories/GHSA-wfm4-pq59-wg6r; https://github.com/sulu/sulu/security/advisories/GHSA-wfm4-pq59-wg6r
CVE: CVE-2020-7298
Published: 2020-08-05
Description: Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.
CVSS Score: 7.5 (HIGH)
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062
CVE: CVE-2020-17366
Published: 2020-08-05
Description: An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate Revocation List files from the RPKI relying party's view.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/NLnetLabs/routinator/issues/319; https://github.com/NLnetLabs/routinator/releases/tag/v0.8.0; https://github.com/NLnetLabs/routinator/issues/319
CVE: CVE-2020-9036
Published: 2020-08-05
Description: Jeedom through 4.0.38 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sysdream.com/news/lab/2020-08-05-cve-2020-9036-jeedom-xss-leading-to-remote-code-execution/; https://sysdream.com/news/lab/2020-08-05-cve-2020-9036-jeedom-xss-leading-to-remote-code-execution/
CVE: CVE-2020-7352
Published: 2020-08-06
Description: The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264, CWE-798
References: https://github.com/rapid7/metasploit-framework/pull/13444; https://www.positronsecurity.com/blog/2020-04-28-gog-galaxy-client-local-privilege-escalation/; https://github.com/rapid7/metasploit-framework/pull/13444
CVE: CVE-2020-7356
Published: 2020-08-06
Description: CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/rapid7/metasploit-framework/pull/13607; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php; https://github.com/rapid7/metasploit-framework/pull/13607
CVE: CVE-2020-7357
Published: 2020-08-06
Description: Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182925; https://github.com/rapid7/metasploit-framework/pull/13607; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php
CVE: CVE-2020-7361
Published: 2020-08-06
Description: The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/rapid7/metasploit-framework/pull/13828; https://github.com/rapid7/metasploit-framework/pull/13828
CVE: CVE-2020-13364
Published: 2020-08-06
Description: A backdoor in certain Zyxel products allows remote TELNET access via a CGI script. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V5.11(AASZ.0)C0; NAS542 V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, and V5.21(ABAG.3)C0; NSA325 v2_V4.81(AALS.0)C0 and V4.81(AAAJ.1)C0; NSA310 4.22(AFK.0)C0 and 4.22(AFK.1)C0; NAS326 V5.21(AAZF.8)C0, V5.11(AAZF.4)C0, V5.11(AAZF.2)C0, and V5.11(AAZF.3)C0; NSA310S V4.75(AALH.2)C0; NSA320S V4.75(AANV.2)C0 and V4.75(AANV.1)C0; NSA221 V4.41(AFM.1)C0; and NAS540 V5.21(AATB.5)C0 and V5.21(AATB.3)C0.
CVSS Score: 8.8 (HIGH)
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml; https://www.zyxel.com/us/en/support/security_advisories.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml
CVE: CVE-2020-13365
Published: 2020-08-06
Description: Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session as root. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V5.11(AASZ.0)C0; NAS542 V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, and V5.21(ABAG.3)C0; NSA325 v2_V4.81(AALS.0)C0 and V4.81(AAAJ.1)C0; NSA310 4.22(AFK.0)C0 and 4.22(AFK.1)C0; NAS326 V5.21(AAZF.8)C0, V5.11(AAZF.4)C0, V5.11(AAZF.2)C0, and V5.11(AAZF.3)C0; NSA310S V4.75(AALH.2)C0; NSA320S V4.75(AANV.2)C0 and V4.75(AANV.1)C0; NSA221 V4.41(AFM.1)C0; and NAS540 V5.21(AATB.5)C0 and V5.21(AATB.3)C0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml; https://www.zyxel.com/us/en/support/security_advisories.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-NAS-remote-access-vulnerability.shtml
CVE: CVE-2020-7459
Published: 2020-08-06
Description: In FreeBSD 12.1-STABLE before r362166, 12.1-RELEASE before p8, 11.4-STABLE before r362167, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, missing length validation code common to mulitple USB network drivers allows a malicious USB device to write beyond the end of an allocated network packet buffer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:21.usb_net.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:21.usb_net.asc
CVE: CVE-2020-7460
Published: 2020-08-06
Description: In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:23.sendmsg.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.zerodayinitiative.com/advisories/ZDI-20-949/
CVE: CVE-2020-7817
Published: 2020-08-06
Description: MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-494, CWE-494
References: http://www.activesoft.co.kr/demo.html; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35549; http://www.activesoft.co.kr/demo.html
CVE: CVE-2020-16845
Published: 2020-08-06
Description: Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html
CVE: CVE-2020-12441
Published: 2020-08-06
Description: Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1; https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite/; https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1
CVE: CVE-2020-13793
Published: 2020-08-06
Description: Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1; https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite/; https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1
CVE: CVE-2020-16207
Published: 2020-08-06
Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02; https://www.zerodayinitiative.com/advisories/ZDI-20-950/; https://www.zerodayinitiative.com/advisories/ZDI-20-951/
CVE: CVE-2020-16211
Published: 2020-08-06
Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project files, which may allow an attacker to read information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02; https://www.zerodayinitiative.com/advisories/ZDI-20-957/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02
CVE: CVE-2020-16213
Published: 2020-08-06
Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02; https://www.zerodayinitiative.com/advisories/ZDI-20-956/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02
CVE: CVE-2020-16215
Published: 2020-08-06
Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a stack-based buffer overflow, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-20
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02; https://www.zerodayinitiative.com/advisories/ZDI-20-953/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02
CVE: CVE-2020-16217
Published: 2020-08-06
Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution, disclosure/modification of information, or cause the application to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02; https://www.zerodayinitiative.com/advisories/ZDI-20-952/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02
CVE: CVE-2020-16229
Published: 2020-08-06
Description: Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02; https://www.zerodayinitiative.com/advisories/ZDI-20-954/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02
CVE: CVE-2020-15115
Published: 2020-08-06
Description: etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-521, CWE-521
References: https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/; https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh
CVE: CVE-2020-11937
Published: 2020-08-06
Description: In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://github.com/sungjungk/whoopsie_killer; https://launchpad.net/bugs/1881982; https://usn.ubuntu.com/4450-1
CVE: CVE-2020-15114
Published: 2020-08-06
Description: In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
CVSS Score: 7.7 (HIGH)
CWE: CWE-400, CWE-772
References: https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/; https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224
CVE: CVE-2020-15136
Published: 2020-08-06
Description: In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md; https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
CVE: CVE-2020-15701
Published: 2020-08-06
Description: An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://launchpad.net/bugs/1877023; https://usn.ubuntu.com/4449-1; https://usn.ubuntu.com/4449-1/
CVE: CVE-2020-15702
Published: 2020-08-06
Description: TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://usn.ubuntu.com/4449-1; https://usn.ubuntu.com/4449-1/; https://usn.ubuntu.com/4449-2/
CVE: CVE-2020-16219
Published: 2020-08-07
Description: Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04; https://www.zerodayinitiative.com/advisories/ZDI-20-961/; https://www.zerodayinitiative.com/advisories/ZDI-20-963/
CVE: CVE-2020-16221
Published: 2020-08-07
Description: Delta Electronics TPEditor Versions 1.97 and prior. A stack-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04; https://www.zerodayinitiative.com/advisories/ZDI-20-962/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04
CVE: CVE-2020-16223
Published: 2020-08-07
Description: Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04; https://www.zerodayinitiative.com/advisories/ZDI-20-966/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04
CVE: CVE-2020-16225
Published: 2020-08-07
Description: Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-123, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04; https://www.zerodayinitiative.com/advisories/ZDI-20-964/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04
CVE: CVE-2020-16227
Published: 2020-08-07
Description: Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated when the data is entered by a user. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04; https://www.zerodayinitiative.com/advisories/ZDI-20-965/; https://us-cert.cisa.gov/ics/advisories/icsa-20-219-04