deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13435
Published: 2020-05-24
Description: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2020/Dec/32; http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-13438
Published: 2020-05-24
Description: ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/rockcarry/ffjpeg/issues/23; https://github.com/rockcarry/ffjpeg/issues/23
CVE: CVE-2020-13439
Published: 2020-05-24
Description: ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/rockcarry/ffjpeg/issues/24; https://github.com/rockcarry/ffjpeg/issues/24
CVE: CVE-2020-13440
Published: 2020-05-24
Description: ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/rockcarry/ffjpeg/issues/22; https://github.com/rockcarry/ffjpeg/issues/22
CVE: CVE-2020-5537
Published: 2020-05-25
Description: Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN59552136/index.html; https://jvn.jp/en/jp/JVN59552136/index.html; https://kb.cybozu.support/article/36329/
CVE: CVE-2020-13442
Published: 2020-05-25
Description: A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/kbgsft/vuln-dext5upload/wiki/File-Upload-to-RCE-in-DEXT5Upload-2.7.1402870-by-xcuter; https://github.com/kbgsft/vuln-dext5upload/wiki/File-Upload-to-RCE-in-DEXT5Upload-2.7.1402870-by-xcuter
CVE: CVE-2020-13458
Published: 2020-05-25
Description: An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/verbb/image-resizer/blob/craft-3/CHANGELOG.md; https://github.com/verbb/image-resizer/blob/craft-3/CHANGELOG.md
CVE: CVE-2020-13459
Published: 2020-05-25
Description: An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/verbb/image-resizer/blob/craft-3/CHANGELOG.md; https://github.com/verbb/image-resizer/blob/craft-3/CHANGELOG.md
CVE: CVE-2020-13482
Published: 2020-05-25
Description: EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/igrigorik/em-http-request/issues/339; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKYP5TR5NTVVDX5R4HCNNH2OQR7M4X3J/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z32PUJA6RGBZ3TKSOTGUXZ45662S3MVF/
CVE: CVE-2020-13485
Published: 2020-05-25
Description: The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-697
References: https://github.com/verbb/knock-knock/blob/craft-3/CHANGELOG.md; https://limpidsecurity.pl/security-advisories/1/knock-knock-plugin-for-craft-cms/; https://github.com/verbb/knock-knock/blob/craft-3/CHANGELOG.md
CVE: CVE-2020-13486
Published: 2020-05-25
Description: The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/verbb/knock-knock/blob/craft-3/CHANGELOG.md; https://github.com/verbb/knock-knock/blob/craft-3/CHANGELOG.md
CVE: CVE-2020-3811
Published: 2020-05-26
Description: qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-863
References: https://bugs.debian.org/961060; https://lists.debian.org/debian-lts-announce/2020/06/msg00002.html; https://usn.ubuntu.com/4556-1/
CVE: CVE-2020-3812
Published: 2020-05-26
Description: qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://bugs.debian.org/961060; https://lists.debian.org/debian-lts-announce/2020/06/msg00002.html; https://usn.ubuntu.com/4556-1/
CVE: CVE-2020-13487
Published: 2020-05-26
Description: The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://bbpress.org/; https://codex.bbpress.org/releases/; https://wordpress.org/plugins/bbpress/#developers
CVE: CVE-2020-10751
Published: 2020-05-26
Description: A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-349, CWE-345
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html; http://www.openwall.com/lists/oss-security/2020/05/27/3
CVE: CVE-2020-10719
Published: 2020-05-26
Description: A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10719; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10719
CVE: CVE-2020-11970
Published: 2020-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-8168
Published: 2020-05-26
Description: We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8%2C; https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83%2C; https://www.ui.com/download/airmax-m
CVE: CVE-2020-8170
Published: 2020-05-26
Description: We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.ui.com/releases/Security-advisory-bulletin-010-010/36a8448a-7dbf-4d30-bb54-398c44591dd4; https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83; https://www.ui.com/download/airmax-m
CVE: CVE-2020-8171
Published: 2020-05-26
Description: We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://community.ui.com/releases/Security-advisory-bulletin-011-011/d0d411a5-6dcb-4988-9709-d57f50957261; https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83; https://www.ui.com/download/airmax-m
CVE: CVE-2020-12393
Published: 2020-05-26
Description: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1615471; https://www.mozilla.org/security/advisories/mfsa2020-16/; https://www.mozilla.org/security/advisories/mfsa2020-17/
CVE: CVE-2020-12394
Published: 2020-05-26
Description: A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. This vulnerability affects Firefox < 76.
CVSS Score: 3.3 (LOW)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1628288; https://security.gentoo.org/glsa/202005-04; https://www.mozilla.org/security/advisories/mfsa2020-16/
CVE: CVE-2020-12395
Published: 2020-05-26
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%2C1624098%2C1625749%2C1626382%2C1628076%2C1631508; https://security.gentoo.org/glsa/202005-03; https://security.gentoo.org/glsa/202005-04
CVE: CVE-2020-12396
Published: 2020-05-26
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 76.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488%2C1622291%2C1627644; https://security.gentoo.org/glsa/202005-04; https://www.mozilla.org/security/advisories/mfsa2020-16/
CVE: CVE-2020-12387
Published: 2020-05-26
Description: A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1545345; https://security.gentoo.org/glsa/202005-03; https://security.gentoo.org/glsa/202005-04
CVE: CVE-2020-12388
Published: 2020-05-26
Description: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1618911; https://www.mozilla.org/security/advisories/mfsa2020-16/
CVE: CVE-2020-12389
Published: 2020-05-26
Description: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1554110; https://www.mozilla.org/security/advisories/mfsa2020-16/; https://www.mozilla.org/security/advisories/mfsa2020-17/
CVE: CVE-2020-12390
Published: 2020-05-26
Description: Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1141959; https://www.mozilla.org/security/advisories/mfsa2020-16/; https://bugzilla.mozilla.org/show_bug.cgi?id=1141959
CVE: CVE-2020-12391
Published: 2020-05-26
Description: Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox < 76.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1457100; https://www.mozilla.org/security/advisories/mfsa2020-16/; https://bugzilla.mozilla.org/show_bug.cgi?id=1457100
CVE: CVE-2020-12392
Published: 2020-05-26
Description: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1614468; https://security.gentoo.org/glsa/202005-03; https://security.gentoo.org/glsa/202005-04
CVE: CVE-2020-6830
Published: 2020-05-26
Description: For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1632387; https://www.mozilla.org/security/advisories/mfsa2020-15/; https://bugzilla.mozilla.org/show_bug.cgi?id=1632387
CVE: CVE-2020-6831
Published: 2020-05-26
Description: A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00000.html; http://packetstormsecurity.com/files/158480/usrsctp-Stack-Buffer-Overflow.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1632241
CVE: CVE-2020-9046
Published: 2020-05-26
Description: A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-269
References: https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.us-cert.gov/ics/advisories/ICSA-20-147-02; https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE: CVE-2020-13614
Published: 2020-05-26
Description: An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00010.html; https://github.com/axel-download-accelerator/axel/issues/262
CVE: CVE-2020-13615
Published: 2020-05-26
Description: lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/qorelanguage/qore/compare/release-0.9.4.1...release-0.9.4.2; https://github.com/qorelanguage/qore/issues/3808; https://github.com/qorelanguage/qore/compare/release-0.9.4.1...release-0.9.4.2
CVE: CVE-2020-13616
Published: 2020-05-26
Description: The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/pichi-router/pichi/commit/[PII_REDACTED]bc324f26658d2b041bfe6ea022c573; https://github.com/pichi-router/pichi/releases/tag/1.3.0; https://github.com/pichi-router/pichi/commit/[PII_REDACTED]bc324f26658d2b041bfe6ea022c573
CVE: CVE-2020-13622
Published: 2020-05-27
Description: JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/3787; https://github.com/jerryscript-project/jerryscript/pull/3797; https://github.com/jerryscript-project/jerryscript/issues/3787
CVE: CVE-2020-13623
Published: 2020-05-27
Description: JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/jerryscript-project/jerryscript/issues/3785; https://github.com/jerryscript-project/jerryscript/issues/3785
CVE: CVE-2020-10737
Published: 2020-05-27
Description: A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10737; https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac?branch; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10737
CVE: CVE-2019-20806
Published: 2020-05-27
Description: An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2e7682ebfc750177a4944eeb56e97a3f05734528
CVE: CVE-2020-13386
Published: 2020-05-27
Description: In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installation folder. Additionally, when the product is installed, two scheduled tasks are created on the machine, SDMsgUpdate (Local) and SDMsgUpdate (TE). The scheduled tasks run in the context of the user who installed the product. Both scheduled tasks attempt to run the same binary, C:\SmartDraw 2020\Messages\SDNotify.exe. The folder Messages doesn't exist by default and (by extension) neither does SDNotify.exe. Due to the weak folder permissions, these can be created by any user. A malicious actor can therefore create a malicious SDNotify.exe binary, and have it automatically run, whenever the user who installed the product logs on to the machine. The malicious SDNotify.exe could, for example, create a new local administrator account on the machine.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://improsec.com/tech-blog/how-not-do-handle-responsible-disclosure-smartdraw-2020; https://improsec.com/tech-blog/how-not-do-handle-responsible-disclosure-smartdraw-2020
CVE: CVE-2020-4226
Published: 2020-05-27
Description: IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175207; https://www.ibm.com/support/pages/node/6216813; https://exchange.xforce.ibmcloud.com/vulnerabilities/175207
CVE: CVE-2020-4348
Published: 2020-05-27
Description: IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178414; https://www.ibm.com/support/pages/node/6213739; https://exchange.xforce.ibmcloud.com/vulnerabilities/178414
CVE: CVE-2020-4349
Published: 2020-05-27
Description: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178423.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178423; https://www.ibm.com/support/pages/node/6214482; https://exchange.xforce.ibmcloud.com/vulnerabilities/178423
CVE: CVE-2020-4350
Published: 2020-05-27
Description: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178424.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178424; https://www.ibm.com/support/pages/node/6214480; https://exchange.xforce.ibmcloud.com/vulnerabilities/178424
CVE: CVE-2020-4357
Published: 2020-05-27
Description: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178761; https://www.ibm.com/support/pages/node/6214478; https://exchange.xforce.ibmcloud.com/vulnerabilities/178761