deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6258
Published: 2020-05-12
Description: SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to Missing Authorization Check.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2915429; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2915429
CVE: CVE-2020-6259
Published: 2020-05-12
Description: Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2920548; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2920548
CVE: CVE-2020-6262
Published: 2020-05-12
Description: Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/2835979; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2835979
CVE: CVE-2020-12826
Published: 2020-05-12
Description: A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1822077; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.5; https://github.com/torvalds/linux/commit/7395ea4e65c2a00d23185a3f63ad315756ba9cef
CVE: CVE-2020-11060
Published: 2020-05-12
Description: In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.
CVSS Score: 7.4 (HIGH)
CWE: CWE-74, CWE-352
References: http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html; https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c; https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f
CVE: CVE-2020-11062
Published: 2020-05-12
Description: In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf; https://github.com/glpi-project/glpi/security/advisories/GHSA-3xxh-f5p2-jg3h; https://github.com/glpi-project/glpi/commit/5e1c52c5e8a30ceb4e9572964da7ed89ddfb1aaf
CVE: CVE-2020-12772
Published: 2020-05-12
Description: An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the (NT)LM hashes of the user are sent with the HTTP request. This allows an attacker to collect these hashes, crack them, and potentially compromise the computer. (ROAR can be configured for automatic access. Also, access can occur if the user clicks.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://github.com/theart42/cves/blob/master/cve-2020-12772/CVE-2020-12772.md; https://github.com/theart42/cves/blob/master/cve-2020-12772/CVE-2020-12772.md
CVE: CVE-2020-11057
Published: 2020-05-12
Description: In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmp6-jjg8-9424; https://jira.xwiki.org/browse/XWIKI-16960; https://medium.com/%40andrew.levkin/tews-4c47cfc011d1
CVE: CVE-2020-11058
Published: 2020-05-12
Description: In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.
CVSS Score: 2.2 (LOW)
CWE: CWE-119, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/3627aaf7d289315b614a584afb388f04abfb5bbf; https://github.com/FreeRDP/FreeRDP/issues/6011; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wjg2-2f82-466g
CVE: CVE-2020-1718
Published: 2020-05-12
Description: A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718
CVE: CVE-2020-11932
Published: 2020-05-13
Description: It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
CVSS Score: 2.3 (LOW)
CWE: CWE-532, CWE-532
References: https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/; https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613; https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/
CVE: CVE-2020-3327
Published: 2020-05-13
Description: A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html; https://lists.debian.org/debian-lts-announce/2020/05/msg00018.html; https://lists.debian.org/debian-lts-announce/2020/08/msg00010.html
CVE: CVE-2020-3341
Published: 2020-05-13
Description: A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html; https://lists.debian.org/debian-lts-announce/2020/05/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BMTC7I5LGY4FCIZLHPNC4WWC6VNLFER/
CVE: CVE-2020-10654
Published: 2020-05-13
Description: Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a Remote Code Execution vector on the authenticating endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://docs.pingidentity.com/bundle/pingid/page/hmc[PII_REDACTED]90.html; https://docs.pingidentity.com/bundle/pingid/page/okt[PII_REDACTED]88.html; https://www.pingidentity.com/
CVE: CVE-2020-12697
Published: 2020-05-13
Description: The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-005; https://typo3.org/help/security-advisories
CVE: CVE-2020-12698
Published: 2020-05-13
Description: The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-005; https://typo3.org/help/security-advisories
CVE: CVE-2020-12699
Published: 2020-05-13
Description: The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-005; https://typo3.org/help/security-advisories
CVE: CVE-2020-12700
Published: 2020-05-13
Description: The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-005; https://typo3.org/help/security-advisories
CVE: CVE-2020-12742
Published: 2020-05-13
Description: The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://github.com/iubenda/iubenda-cookie-class/commit/545e0586320ae6f16204ba548cf533ef75dc2fbd; https://wordpress.org/plugins/iubenda-cookie-law-solution/#developers; https://github.com/iubenda/iubenda-cookie-class/commit/545e0586320ae6f16204ba548cf533ef75dc2fbd
CVE: CVE-2020-4312
Published: 2020-05-13
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a cached web page. IBM X-Force ID: 177089.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/177089; https://www.ibm.com/support/pages/node/6208046; https://exchange.xforce.ibmcloud.com/vulnerabilities/177089
CVE: CVE-2019-16112
Published: 2020-05-13
Description: TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?service=tyler.empire.settings.SettingManager URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.exploit-db.com/exploits/48462; https://www.exploit-db.com/exploits/48462
CVE: CVE-2020-12427
Published: 2020-05-13
Description: The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.wdc.com/downloads.aspx?g=907&lang=en; https://www.westerndigital.com/support/productsecurity/wdc-20004-wd-discovery-cross-site-request-forgery-csrf; https://support.wdc.com/downloads.aspx?g=907&lang=en
CVE: CVE-2020-12763
Published: 2020-05-13
Description: TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow in handling RTSP packets. This may result in remote code execution or denial of service. The issue is in the binary rtspd (in /sbin) when parsing a long "Authorization: Basic" RTSP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://payatu.com/blog/munawwar/trendNet-wireless-camera-buffer-overflow-vulnerability; https://payatu.com/blog/munawwar/trendNet-wireless-camera-buffer-overflow-vulnerability
CVE: CVE-2020-8020
Published: 2020-05-13
Description: A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1171439; https://lists.debian.org/debian-lts-announce/2021/02/msg00006.html; https://bugzilla.suse.com/show_bug.cgi?id=1171439
CVE: CVE-2019-15878
Published: 2020-05-13
Description: In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper checking in SCTP when an application tries to update an SCTP-AUTH shared key.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:14.sctp.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:14.sctp.asc
CVE: CVE-2019-15879
Published: 2020-05-13
Description: In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.
CVSS Score: 7.4 (HIGH)
CWE: CWE-362, CWE-772
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:15.cryptodev.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:15.cryptodev.asc
CVE: CVE-2019-15880
Published: 2020-05-13
Description: In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-119
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:16.cryptodev.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:16.cryptodev.asc
CVE: CVE-2019-9682
Published: 2020-05-13
Description: Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.
CVSS Score: 8.1 (HIGH)
CWE: CWE-276
References: https://www.dahuasecurity.com/support/cybersecurity/details/767; https://www.dahuasecurity.com/support/cybersecurity/details/767
CVE: CVE-2020-5838
Published: 2020-05-13
Description: Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by other users.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1766; https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1766
CVE: CVE-2020-7454
Published: 2020-05-13
Description: In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not properly validate packet length resulting in modules causing an out of bounds read/write condition if no checking was built into the module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:12.libalias.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.zerodayinitiative.com/advisories/ZDI-20-659/
CVE: CVE-2020-7455
Published: 2020-05-13
Description: In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, the FTP packet handler in libalias incorrectly calculates some packet length allowing disclosure of small amounts of kernel (for kernel NAT) or natd process space (for userspace natd).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:13.libalias.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.zerodayinitiative.com/advisories/ZDI-20-661/
CVE: CVE-2020-9501
Published: 2020-05-13
Description: Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in additional consumption of platform server resources. Versions with Build time before April 2020 are affected.
CVSS Score: 5.5 (MEDIUM)
References: https://www.dahuasecurity.com/support/cybersecurity/details/757; https://www.dahuasecurity.com/support/cybersecurity/details/757
CVE: CVE-2020-9502
Published: 2020-05-13
Description: Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://www.dahuasecurity.com/support/cybersecurity/details/777; https://www.dahuasecurity.com/support/cybersecurity/details/777
CVE: CVE-2019-2388
Published: 2020-05-13
Description: In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.0.11; https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.0.11
CVE: CVE-2020-5407
Published: 2020-05-13
Description: Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E; https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E; https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E
CVE: CVE-2020-12831
Published: 2020-05-13
Description: An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1830805; https://github.com/FRRouting/frr/pull/6383; https://bugzilla.redhat.com/show_bug.cgi?id=1830805
CVE: CVE-2020-12832
Published: 2020-05-13
Description: WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://ctulhu.me/2020/05/16/cve-2020-12832/; https://plugins.trac.wordpress.org/changeset/2302759; https://wordpress.org/plugins/simple-file-list/#developers
CVE: CVE-2020-11070
Published: 2020-05-13
Description: The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/TYPO3GmbH/svg_sanitizer/security/advisories/GHSA-59cf-m7v5-wh5w; https://github.com/TYPO3GmbH/svg_sanitizer/security/advisories/GHSA-59cf-m7v5-wh5w
CVE: CVE-2020-11073
Published: 2020-05-13
Description: In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0
CVSS Score: 7.9 (HIGH)
CWE: CWE-77, CWE-22
References: https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/commit/30c77db7c83eca2bc5f6134fccbdc117b49a6a05; https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/issues/122; https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/pull/123
CVE: CVE-2020-1714
Published: 2020-05-13
Description: A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714; https://github.com/keycloak/keycloak/pull/7053; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714
CVE: CVE-2020-1993
Published: 2020-05-13
Description: The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8.
CVSS Score: 3.7 (LOW)
CWE: CWE-384, CWE-384
References: https://security.paloaltonetworks.com/CVE-2020-1993; https://security.paloaltonetworks.com/CVE-2020-1993
CVE: CVE-2020-1994
Published: 2020-05-13
Description: A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-377
References: https://security.paloaltonetworks.com/CVE-2020-1994; https://security.paloaltonetworks.com/CVE-2020-1994
CVE: CVE-2020-1995
Published: 2020-05-13
Description: A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue affects: PAN-OS 9.1 versions earlier than 9.1.2.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://security.paloaltonetworks.com/CVE-2020-1995; https://security.paloaltonetworks.com/CVE-2020-1995