deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-9602
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9603
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9604
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9605
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9606
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9607
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9608
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9609
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9610
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a null pointer vulnerability. Successful exploitation could lead to application denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9611
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to application denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9612
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9613
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass.
CVSS Score: 7.8 (HIGH)
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9614
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass.
CVSS Score: 7.8 (HIGH)
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9615
Published: 2020-06-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]6 and earlier, and 2[PII_REDACTED]8 and earlier have a race condition vulnerability. Successful exploitation could lead to security feature bypass.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://helpx.adobe.com/security/products/acrobat/apsb20-24.html; https://helpx.adobe.com/security/products/acrobat/apsb20-24.html
CVE: CVE-2020-9618
Published: 2020-06-25
Description: Adobe Audition versions 13.0.5 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/audition/apsb20-28.html; https://helpx.adobe.com/security/products/audition/apsb20-28.html
CVE: CVE-2020-9637
Published: 2020-06-25
Description: Adobe After Effects versions 17.1 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb20-35.html; https://helpx.adobe.com/security/products/after_effects/apsb20-35.html
CVE: CVE-2020-9638
Published: 2020-06-25
Description: Adobe After Effects versions 17.1 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb20-35.html; https://helpx.adobe.com/security/products/after_effects/apsb20-35.html
CVE: CVE-2020-9639
Published: 2020-06-25
Description: Adobe Illustrator versions 24.1.2 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-37.html; https://helpx.adobe.com/security/products/illustrator/apsb20-37.html
CVE: CVE-2020-9640
Published: 2020-06-25
Description: Adobe Illustrator versions 24.1.2 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-37.html; https://helpx.adobe.com/security/products/illustrator/apsb20-37.html
CVE: CVE-2020-9641
Published: 2020-06-25
Description: Adobe Illustrator versions 24.1.2 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb20-37.html; https://helpx.adobe.com/security/products/illustrator/apsb20-37.html
CVE: CVE-2020-9642
Published: 2020-06-25
Description: Adobe Illustrator versions 24.1.2 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://helpx.adobe.com/security/products/illustrator/apsb20-37.html; https://helpx.adobe.com/security/products/illustrator/apsb20-37.html
CVE: CVE-2020-9652
Published: 2020-06-25
Description: Adobe Premiere Pro versions 14.2 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html; https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html
CVE: CVE-2020-9653
Published: 2020-06-25
Description: Adobe Premiere Pro versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html; https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html
CVE: CVE-2020-9654
Published: 2020-06-25
Description: Adobe Premiere Pro versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html; https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html
CVE: CVE-2020-9655
Published: 2020-06-25
Description: Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html; https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html
CVE: CVE-2020-9656
Published: 2020-06-25
Description: Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html; https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html
CVE: CVE-2020-9657
Published: 2020-06-25
Description: Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html; https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html
CVE: CVE-2020-9658
Published: 2020-06-25
Description: Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/audition/apsb20-40.html; https://helpx.adobe.com/security/products/audition/apsb20-40.html
CVE: CVE-2020-9659
Published: 2020-06-25
Description: Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/audition/apsb20-40.html; https://helpx.adobe.com/security/products/audition/apsb20-40.html
CVE: CVE-2020-9660
Published: 2020-06-25
Description: Adobe After Effects versions 17.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb20-35.html; https://helpx.adobe.com/security/products/after_effects/apsb20-35.html
CVE: CVE-2020-9661
Published: 2020-06-25
Description: Adobe After Effects versions 17.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb20-35.html; https://helpx.adobe.com/security/products/after_effects/apsb20-35.html
CVE: CVE-2020-9662
Published: 2020-06-25
Description: Adobe After Effects versions 17.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb20-35.html; https://helpx.adobe.com/security/products/after_effects/apsb20-35.html
CVE: CVE-2020-15304
Published: 2020-06-26
Description: An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00048.html; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md
CVE: CVE-2020-15305
Published: 2020-06-26
Description: An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00048.html; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md
CVE: CVE-2020-15306
Published: 2020-06-26
Description: An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00048.html; https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md
CVE: CVE-2020-15308
Published: 2020-06-26
Description: Support Incident Tracker (aka SiT! or SiTracker) 3.67 p2 allows post-authentication SQL injection via the site_edit.php typeid or site parameter, the search_incidents_advanced.php search_title parameter, or the report_qbe.php criteriafield parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://code610.blogspot.com/2020/06/postauth-sqli-in-sitracker-v367-p2.html; https://code610.blogspot.com/2020/06/postauth-sqli-in-sitracker-v367-p2.html
CVE: CVE-2020-15311
Published: 2020-06-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-4080. Reason: This candidate is a duplicate of CVE-2008-4080.2. Notes: All CVE users should reference CVE-2008-4080.2 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-4650
Published: 2020-06-26
Description: IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170961.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170961; https://www.ibm.com/support/pages/node/6223922; https://exchange.xforce.ibmcloud.com/vulnerabilities/170961
CVE: CVE-2020-15016
Published: 2020-06-26
Description: NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/PreethamBomma/9c3eb4a6f5188a67c94306dd9c9f23ca; https://gist.github.com/PreethamBomma/9c3eb4a6f5188a67c94306dd9c9f23ca
CVE: CVE-2020-15017
Published: 2020-06-26
Description: NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/PreethamBomma/6ceeb4d5c754834697e42f1db8214c69; https://gist.github.com/PreethamBomma/6ceeb4d5c754834697e42f1db8214c69
CVE: CVE-2020-15348
Published: 2020-06-26
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-4223
Published: 2020-06-26
Description: IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 175121.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175121; https://www.ibm.com/support/pages/node/6238376; https://exchange.xforce.ibmcloud.com/vulnerabilities/175121
CVE: CVE-2020-4565
Published: 2020-06-26
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and server. IBM X-Force ID: 183935.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183935; https://www.ibm.com/support/pages/node/6238920; https://exchange.xforce.ibmcloud.com/vulnerabilities/183935
CVE: CVE-2020-10753
Published: 2020-06-26
Description: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-113, CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00062.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753; https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html
CVE: CVE-2020-15335
Published: 2020-06-26
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html#xmpp-no-auth-cleartext; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html#xmpp-no-auth-cleartext
CVE: CVE-2020-15336
Published: 2020-06-26
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html#xmpp-no-auth-cleartext; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html#xmpp-no-auth-cleartext
CVE: CVE-2020-10727
Published: 2020-06-26
Description: A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1827200; https://issues.redhat.com/browse/ENTMQBR-3435; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-10769
Published: 2020-06-26
Description: A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html; https://bugzilla.redhat.com/show_bug.cgi?id=1708775%3B; https://lkml.org/lkml/2019/1/21/675
CVE: CVE-2020-10624
Published: 2020-06-26
Description: ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.us-cert.gov/ics/advisories/icsa-20-175-02; https://www.us-cert.gov/ics/advisories/icsa-20-175-02
CVE: CVE-2020-10628
Published: 2020-06-26
Description: ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.us-cert.gov/ics/advisories/icsa-20-175-02; https://www.us-cert.gov/ics/advisories/icsa-20-175-02
CVE: CVE-2020-11996
Published: 2020-06-26
Description: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html; https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E
CVE: CVE-2020-13891
Published: 2020-06-26
Description: An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
CVSS Score: 7.5 (HIGH)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/