deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-35729
Published: 2020-12-27
Description: KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html; http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html; http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html
CVE: CVE-2020-29204
Published: 2020-12-27
Description: XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xuxueli/xxl-job/issues/2083; https://github.com/xuxueli/xxl-job/issues/2083
CVE: CVE-2020-29299
Published: 2020-12-27
Description: Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtml; https://www.zyxel.com/us/en/support/security_advisories.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtml
CVE: CVE-2020-29249
Published: 2020-12-27
Description: CXUUCMS V3 allows class="layui-input" XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cbkhwx/cxuucmsv3/issues/2; https://github.com/cbkhwx/cxuucmsv3/issues/2
CVE: CVE-2020-29250
Published: 2020-12-27
Description: CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cbkhwx/cxuucmsv3/issues/3; https://github.com/cbkhwx/cxuucmsv3/issues/3
CVE: CVE-2020-29156
Published: 2020-12-27
Description: The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/Ko-kn3t/CVE-2020-29156; https://raw.githubusercontent.com/woocommerce/woocommerce/master/changelog.txt; https://github.com/Ko-kn3t/CVE-2020-29156
CVE: CVE-2020-35736
Published: 2020-12-27
Description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/liftoff/GateOne/issues/747; https://rmb122.com/2019/08/28/Ogeek-Easy-Realworld-Challenge-1-2-Writeup/; https://github.com/liftoff/GateOne/issues/747
CVE: CVE-2020-35738
Published: 2020-12-28
Description: WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://github.com/dbry/WavPack/issues/91; https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2YZLKYE66EU4XRHTABV5LB2G7ZDZ422F/
CVE: CVE-2020-28093
Published: 2020-12-28
Description: On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234.
CVSS Score: 7.2 (HIGH)
References: https://github.com/cecada/Tenda-AC6-Root-Acces/blob/main/README.md; https://github.com/cecada/Tenda-AC6-Root-Acces/blob/main/README.md
CVE: CVE-2020-28094
Published: 2020-12-28
Description: On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed test contain links to download malware named elive or CNKI E-Learning.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cecada/Tenda-AC6-Root-Acces/blob/main/README.md; https://github.com/cecada/Tenda-AC6-Root-Acces/blob/main/README.md
CVE: CVE-2020-28096
Published: 2020-12-28
Description: FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.
CVSS Score: 6.8 (MEDIUM)
References: https://github.com/cecada/Foscam-Model-X1-Root-Access; https://github.com/cecada/Foscam-Model-X1-Root-Access
CVE: CVE-2020-29193
Published: 2020-12-28
Description: Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse order).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://github.com/cecada/Panasonic-WV-S2231L/blob/main/README.md; https://security.panasonic.com/products_technology/products/wv-s2231l/; https://github.com/cecada/Panasonic-WV-S2231L/blob/main/README.md
CVE: CVE-2020-29194
Published: 2020-12-28
Description: Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative control) via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/set_factory URI.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cecada/Panasonic-WV-S2231L/blob/main/README.md; https://security.panasonic.com/products_technology/products/wv-s2231l/; https://github.com/cecada/Panasonic-WV-S2231L/blob/main/README.md
CVE: CVE-2020-26028
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://zammad.com/news/security-advisory-zaa-2020-19; https://zammad.com/news/security-advisory-zaa-2020-19
CVE: CVE-2020-26029
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://zammad.com/news/security-advisory-zaa-2020-20; https://zammad.com/news/security-advisory-zaa-2020-20
CVE: CVE-2020-26030
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An attacker can create a valid and authenticated session that can be used to perform any actions in the name of other users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://zammad.com/news/security-advisory-zaa-2020-18; https://zammad.com/news/security-advisory-zaa-2020-18
CVE: CVE-2020-26031
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have insufficient permissions).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://zammad.com/news/security-advisory-zaa-2020-16; https://zammad.com/news/security-advisory-zaa-2020-16
CVE: CVE-2020-26032
Published: 2020-12-28
Description: An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may lead to disclosure of information from intranet systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://zammad.com/news/security-advisory-zaa-2020-15; https://zammad.com/news/security-advisory-zaa-2020-15
CVE: CVE-2020-26033
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://zammad.com/news/security-advisory-zaa-2020-17; https://zammad.com/news/security-advisory-zaa-2020-17
CVE: CVE-2020-26034
Published: 2020-12-28
Description: An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as associated with a valid user.
CVSS Score: 4.3 (MEDIUM)
References: https://zammad.com/news/security-advisory-zaa-2020-14; https://zammad.com/news/security-advisory-zaa-2020-14
CVE: CVE-2020-26035
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/news/security-advisory-zaa-2020-21; https://zammad.com/news/security-advisory-zaa-2020-21
CVE: CVE-2020-29158
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/zammad/zammad/commit/cf5a5e396058d4b134dd33d0a62b11c1733c98ab; https://zammad.com/en/advisories/zaa-2020-23; https://github.com/zammad/zammad/commit/cf5a5e396058d4b134dd33d0a62b11c1733c98ab
CVE: CVE-2020-29159
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This behvaior was unintended.
CVSS Score: 4.9 (MEDIUM)
References: https://github.com/zammad/zammad/commit/f0462d4c20c2968b52b5dc6a585f26c0409b4fc4; https://zammad.com/en/advisories/zaa-2020-22; https://github.com/zammad/zammad/commit/f0462d4c20c2968b52b5dc6a585f26c0409b4fc4
CVE: CVE-2020-29160
Published: 2020-12-28
Description: An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/zammad/zammad/commit/28944de180a88698509a656f61558bf9d7f810f4; https://zammad.com/en/advisories/zaa-2020-24; https://github.com/zammad/zammad/commit/28944de180a88698509a656f61558bf9d7f810f4
CVE: CVE-2020-29242
Published: 2020-12-28
Description: dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/dhowden/tag/issues/77; https://github.com/dhowden/tag/issues/77
CVE: CVE-2020-29243
Published: 2020-12-28
Description: dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/dhowden/tag/issues/80; https://github.com/dhowden/tag/issues/80
CVE: CVE-2020-29244
Published: 2020-12-28
Description: dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/dhowden/tag/issues/79; https://github.com/dhowden/tag/issues/79
CVE: CVE-2020-29245
Published: 2020-12-28
Description: dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/dhowden/tag/issues/78; https://github.com/dhowden/tag/issues/78
CVE: CVE-2020-35627
Published: 2020-12-28
Description: Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image extension to PHP and executing PHP code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6; https://makewebbetter.com/product/giftware-woocommerce-gift-cards/; https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6
CVE: CVE-2020-26569
Published: 2020-12-28
Description: In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. This can result in traffic being discarded on the receiving VLAN. This affects versions: 4.21.12M and below releases in the 4.21.x train; 4.22.7M and below releases in the 4.22.x train; 4.23.5M and below releases in the 4.23.x train; 4.24.2F and below releases in the 4.24.x train.
CVSS Score: 5.9 (MEDIUM)
References: https://www.arista.com/en/support/advisories-notices/security-advisories/11997-security-advisory-57; https://www.arista.com/en/support/advisories-notices/security-advisories/11997-security-advisory-57
CVE: CVE-2020-15898
Published: 2020-12-28
Description: In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train.
CVSS Score: 5.3 (MEDIUM)
References: https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56; https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56
CVE: CVE-2020-24360
Published: 2020-12-28
Description: An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. The affected Arista EOS versions are: 4.24.2.4F and below releases in the 4.24.x train; 4.23.4M and below releases in the 4.23.x train; 4.22.6M and below releases in the 4.22.x train.
CVSS Score: 7.4 (HIGH)
CWE: CWE-404
References: https://www.arista.com/en/support/advisories-notices/security-advisories/11999-security-advisory-59; https://www.arista.com/en/support/advisories-notices/security-advisories/11999-security-advisory-59
CVE: CVE-2020-26289
Published: 2020-12-28
Description: date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/knowledgecode/date-and-time/commit/9e4b501eacddccc8b1f559fb414f48472ee17c2a; https://github.com/knowledgecode/date-and-time/security/advisories/GHSA-r92x-f52r-x54g; https://www.npmjs.com/package/date-and-time
CVE: CVE-2020-27837
Published: 2020-12-28
Description: A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1906812; https://bugzilla.redhat.com/show_bug.cgi?id=1906812
CVE: CVE-2020-14273
Published: 2020-12-28
Description: HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085947; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085947
CVE: CVE-2020-25507
Published: 2020-12-28
Description: An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://community.nomagic.com/finding-and-fixing-wrong-file-permission-twc-installation-t7165.html; https://docs.nomagic.com/display/TWCloud190/Installation+on+Linux+using+scripts; https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-002.md
CVE: CVE-2020-26290
Published: 2020-12-28
Description: Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-347
References: https://github.com/dexidp/dex/commit/324b1c886b[PII_REDACTED]13a3dbddebe38eecd4e8; https://github.com/dexidp/dex/releases/tag/v2.27.0; https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5
CVE: CVE-2020-35610
Published: 2020-12-28
Description: An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms.
CVSS Score: 7.5 (HIGH)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-com-finder-ignores-access-levels-on-autosuggest.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-com-finder-ignores-access-levels-on-autosuggest.html
CVE: CVE-2020-35611
Published: 2020-12-28
Description: An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-disclosure-of-secrets-in-global-configuration-page.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-disclosure-of-secrets-in-global-configuration-page.html
CVE: CVE-2020-35612
Published: 2020-12-28
Description: An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-path-traversal-in-mod-random-image.html; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-path-traversal-in-mod-random-image.html
CVE: CVE-2020-35613
Published: 2020-12-28
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-sql-injection-in-com-users-list-view.html; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-sql-injection-in-com-users-list-view.html
CVE: CVE-2020-35614
Published: 2020-12-28
Description: An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page.
CVSS Score: 5.3 (MEDIUM)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-user-enumeration-in-backend-login.html; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-user-enumeration-in-backend-login.html
CVE: CVE-2020-35615
Published: 2020-12-28
Description: An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-csrf-in-com-privacy-emailexport-feature.html; https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-csrf-in-com-privacy-emailexport-feature.html
CVE: CVE-2020-35616
Published: 2020-12-28
Description: An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://developer.joomla.org/security-centre/[PII_REDACTED]7-core-write-acl-violation-in-multiple-core-views.html; https://developer.joomla.org/security-centre/[PII_REDACTED]7-core-write-acl-violation-in-multiple-core-views.html
CVE: CVE-2020-35730
Published: 2020-12-28
Description: An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491; https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10; https://github.com/roundcube/roundcubemail/releases/tag/1.2.13
CVE: CVE-2020-35766
Published: 2020-12-28
Description: The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkeys file (related to t-testdata.h, t-setup.c, and t-cleanup.c). NOTE: this is applicable to persons who choose to engage in the "A number of self-test programs are included here for unit-testing the library" situation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://github.com/trusteddomainproject/OpenDKIM/issues/113; https://github.com/trusteddomainproject/OpenDKIM/issues/113
CVE: CVE-2020-27172
Published: 2020-12-28
Description: An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achieve arbitrary write that leads to elevation of privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://www.fortiguard.com/zeroday/FG-VD-20-120; https://www.fortiguard.com/zeroday/FG-VD-20-120
CVE: CVE-2020-13473
Published: 2020-12-28
Description: NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://cvewalkthrough.com/cve-2020-13473-nch-account-clear-text-password-storage/; https://tejaspingulkar.blogspot.com/2020/12/cve-2020-13473-nch-account-clear-text.html; https://cvewalkthrough.com/cve-2020-13473-nch-account-clear-text-password-storage/
CVE: CVE-2020-13474
Published: 2020-12-28
Description: In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425
References: https://cvewalkthrough.com/cve-2020-13474-nch-express-accounts-privilege-escalation/; https://tejaspingulkar.blogspot.com/2020/12/cve-2020-13474-nch-express-accounts.html; https://cvewalkthrough.com/cve-2020-13474-nch-express-accounts-privilege-escalation/
CVE: CVE-2020-13476
Published: 2020-12-28
Description: NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://tejaspingulkar.blogspot.com/2020/12/cve-2020-13475-nch-accounts-cross-site.html; https://tejaspingulkar.blogspot.com/2020/12/cve-2020-13475-nch-accounts-cross-site.html