deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13796
Published: 2020-06-03
Description: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4; https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4
CVE: CVE-2020-13797
Published: 2020-06-03
Description: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4; https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4
CVE: CVE-2020-13798
Published: 2020-06-03
Description: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4; https://github.com/NavigateCMS/Navigate-CMS/commit/e690bb5d7bbe9df9052b13c403ca0ac5e58054d4
CVE: CVE-2020-5295
Published: 2020-06-03
Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-98, CWE-829
References: http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html; http://seclists.org/fulldisclosure/2020/Aug/2; https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc
CVE: CVE-2020-5296
Published: 2020-06-03
Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-73, CWE-610
References: http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html; http://seclists.org/fulldisclosure/2020/Aug/2; https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc
CVE: CVE-2020-5297
Published: 2020-06-03
Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CVSS Score: 3.4 (LOW)
CWE: CWE-73, CWE-610
References: http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html; http://seclists.org/fulldisclosure/2020/Aug/2; https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8
CVE: CVE-2020-5298
Published: 2020-06-03
Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-87, CWE-79
References: http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html; http://seclists.org/fulldisclosure/2020/Aug/2; https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c
CVE: CVE-2020-5299
Published: 2020-06-03
Description: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html; http://seclists.org/fulldisclosure/2020/Aug/2; https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a
CVE: CVE-2011-1805
Published: 2020-06-03
Description: Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: https://crbug.com/82633; https://crbug.com/82633
CVE: CVE-2011-2863
Published: 2020-06-03
Description: Insufficient policy enforcement in V8 in Google Chrome prior to 14.0.0.0 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://crbug.com/93759; https://crbug.com/93759
CVE: CVE-2020-11080
Published: 2020-06-03
Description: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVSS Score: 3.7 (LOW)
CWE: CWE-707, CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html; https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090; https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394
CVE: CVE-2020-11091
Published: 2020-06-03
Description: In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-350
References: https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60; https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73; https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60
CVE: CVE-2020-6419
Published: 2020-06-03
Description: Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html; https://crbug.com/1040325; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6453
Published: 2020-06-03
Description: Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html; https://crbug.com/1065094; https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html
CVE: CVE-2020-6493
Published: 2020-06-03
Description: Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html
CVE: CVE-2020-6494
Published: 2020-06-03
Description: Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html
CVE: CVE-2020-6495
Published: 2020-06-03
Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html
CVE: CVE-2020-6496
Published: 2020-06-03
Description: Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html
CVE: CVE-2020-6497
Published: 2020-06-03
Description: Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html; https://crbug.com/1069246; https://www.debian.org/security/2020/dsa-4714
CVE: CVE-2020-6498
Published: 2020-06-03
Description: Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html; https://crbug.com/1081081; https://www.debian.org/security/2020/dsa-4714
CVE: CVE-2020-6499
Published: 2020-06-03
Description: Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html; https://crbug.com/999001; https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
CVE: CVE-2020-6500
Published: 2020-06-03
Description: Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html; https://crbug.com/843095; https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
CVE: CVE-2020-6501
Published: 2020-06-03
Description: Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html; https://crbug.com/990581; https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
CVE: CVE-2020-6502
Published: 2020-06-03
Description: Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html; https://crbug.com/785159; https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
CVE: CVE-2020-6503
Published: 2020-06-03
Description: Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/639322; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html
CVE: CVE-2020-6504
Published: 2020-06-03
Description: Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/875503; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html
CVE: CVE-2020-11094
Published: 2020-06-04
Description: The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed. Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18; https://github.com/rainlab/debugbar-plugin/security/advisories/GHSA-c8wh-6jw4-2h79; https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18
CVE: CVE-2020-7030
Published: 2020-06-04
Description: A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-200
References: http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html; http://seclists.org/fulldisclosure/2020/Jun/12; https://downloads.avaya.com/css/P8/documents/101067493
CVE: CVE-2020-10546
Published: 2020-06-04
Description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py; https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/; https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py
CVE: CVE-2020-10547
Published: 2020-06-04
Description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/theguly/exploits/blob/master/CVE-2020-10547.py; https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/; https://github.com/theguly/exploits/blob/master/CVE-2020-10547.py
CVE: CVE-2020-10548
Published: 2020-06-04
Description: rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py; https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/; https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py
CVE: CVE-2020-10549
Published: 2020-06-04
Description: rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py; https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/; https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py
CVE: CVE-2020-13777
Published: 2020-06-04
Description: GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
CVSS Score: 7.4 (HIGH)
CWE: CWE-327
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html; https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P/
CVE: CVE-2019-16150
Published: 2020-06-04
Description: Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded key.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://fortiguard.com/psirt/FG-IR-19-194; https://fortiguard.com/psirt/FG-IR-19-194
CVE: CVE-2020-13817
Published: 2020-06-04
Description: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
CVSS Score: 7.4 (HIGH)
CWE: CWE-330, CWE-330
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html; http://support.ntp.org/bin/view/Main/NtpBug3596
CVE: CVE-2020-13818
Published: 2020-06-04
Description: In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.manageengine.com/network-monitoring/help/read-me-complete.html; https://www.zerodayinitiative.com/advisories/ZDI-20-691/; https://www.manageengine.com/network-monitoring/help/read-me-complete.html
CVE: CVE-2020-6640
Published: 2020-06-04
Description: An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-20-003; https://fortiguard.com/advisory/FG-IR-20-003
CVE: CVE-2020-9292
Published: 2020-06-04
Description: An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-428
References: https://fortiguard.com/advisory/FG-IR-20-021; https://fortiguard.com/advisory/FG-IR-20-021
CVE: CVE-2020-4183
Published: 2020-06-04
Description: IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174739.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174739; https://www.ibm.com/support/pages/node/6220126; https://exchange.xforce.ibmcloud.com/vulnerabilities/174739
CVE: CVE-2020-4191
Published: 2020-06-04
Description: IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174852.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174852; https://www.ibm.com/support/pages/node/6220130; https://exchange.xforce.ibmcloud.com/vulnerabilities/174852
CVE: CVE-2020-4193
Published: 2020-06-04
Description: IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 174857.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174857; https://www.ibm.com/support/pages/node/6220132; https://exchange.xforce.ibmcloud.com/vulnerabilities/174857