deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15532
Published: 2020-08-20
Description: Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air denial of service vulnerability in Bluetooth LE in EFR32 SoCs and associated modules running Bluetooth SDK, supporting Central or Observer roles.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/darkmentorllc/jackbnimble/blob/master/host/pocs/silabs_efr32_extadv_dos.py; https://github.com/darkmentorllc/publications/tree/master/2020/TI_SILABS_BLE_RCEs; https://www.blackhat.com/us-20/briefings/schedule/#finding-new-bluetooth-low-energy-exploits-via-reverse-engineering-multiple-vendors-firmwares-19655
CVE: CVE-2020-15629
Published: 2020-08-20
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10764.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-870/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-15630
Published: 2020-08-20
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-10977.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-871/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-15634
Published: 2020-08-20
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9755.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-134
References: https://kb.netgear.com/000062126/Security-Advisory-for-Pre-Authentication-Command-Injection-on-R6700v3-PSV-2020-0189; https://www.zerodayinitiative.com/advisories/ZDI-20-935/; https://kb.netgear.com/000062126/Security-Advisory-for-Pre-Authentication-Command-Injection-on-R6700v3-PSV-2020-0189
CVE: CVE-2020-15635
Published: 2020-08-20
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the acsd service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9853.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://kb.netgear.com/000062127/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-R6700v3-PSV-2020-0202; https://www.zerodayinitiative.com/advisories/ZDI-20-936/; https://kb.netgear.com/000062127/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-R6700v3-PSV-2020-0202
CVE: CVE-2020-15636
Published: 2020-08-20
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the check_ra service. A crafted raePolicyVersion in a RAE_Policy.json file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9852.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224; https://www.zerodayinitiative.com/advisories/ZDI-20-937/; https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224
CVE: CVE-2020-15637
Published: 2020-08-20
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the SetLocalDescription method. By performing actions in JavaScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-10972.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-932/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-15638
Published: 2020-08-20
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the NodeProperties::InferReceiverMapsUnsafe method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10950.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-933/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-15861
Published: 2020-08-20
Description: Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966599; https://github.com/net-snmp/net-snmp/commit/4fd9a450444a434a993bc72f7c3486ccce41f602; https://github.com/net-snmp/net-snmp/issues/145
CVE: CVE-2020-15862
Published: 2020-08-20
Description: Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965166; https://github.com/net-snmp/net-snmp/commit/77f6c60f57dba0aaea5d8ef1dd94bcd0c8e6d205; https://salsa.debian.org/debian/net-snmp/-/commit/fad[PII_REDACTED]746daf0a751dcff19eb6aeab52e
CVE: CVE-2020-17456
Published: 2020-08-20
Description: SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/158933/Seowon-SlC-130-Router-Remote-Code-Execution.html; http://packetstormsecurity.com/files/166273/Seowon-SLR-120-Router-Remote-Code-Execution.html; https://github.com/TAPESH-TEAM/CVE-2020-17456-Seowon-SLR-120S42G-RCE-Exploit-Unauthenticated
CVE: CVE-2020-8869
Published: 2020-08-20
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9881.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-311/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8870
Published: 2020-08-20
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files from the GetTIFPalette method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9931.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-312/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-10289
Published: 2020-08-20
Description: Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-502
References: https://github.com/ros/actionlib/pull/171; https://github.com/ros/actionlib/pull/171
CVE: CVE-2020-10283
Published: 2020-08-20
Description: The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer, an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://github.com/aliasrobotics/RVD/issues/3316; https://github.com/aliasrobotics/RVD/issues/3316
CVE: CVE-2019-20150
Published: 2020-08-20
Description: In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's editor to change the expected SFTP Host IP to a malicious host, and then using the Check Connectivity option. The application then sends these saved credentials to the malicious host.
CVSS Score: 6.5 (MEDIUM)
References: https://sion-evans.com/blog/CVE-2019-20150.html; https://sion-evans.com/blog/CVE-2019-20150.html
CVE: CVE-2019-20151
Published: 2020-08-20
Description: An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and inserted via the Note field. As a result, the payload is executed by the application's administrator(s).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sion-evans.com/blog/CVE-2019-20151.html; https://sion-evans.com/blog/CVE-2019-20151.html
CVE: CVE-2019-20152
Published: 2020-08-20
Description: An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the Create New Workflow field. As a result, the payload is executed via the navigation bar throughout the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sion-evans.com/blog/CVE-2019-20152.html; https://sion-evans.com/blog/CVE-2019-20152.html
CVE: CVE-2020-14357
Published: 2020-08-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-23936
Published: 2020-08-20
Description: PHPGurukul Vehicle Parking Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/enesozeser/Vulnerabilities/blob/master/CVE-2020-23936; https://github.com/enesozeser/Vulnerabilities/blob/master/CVE-2020-23936
CVE: CVE-2020-23935
Published: 2020-08-20
Description: Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165215/Kabir-Alhasan-Student-Management-System-1.0-SQL-Injection.html; https://github.com/enesozeser/Vulnerabilities/blob/master/CVE-2020-23935; http://packetstormsecurity.com/files/165215/Kabir-Alhasan-Student-Management-System-1.0-SQL-Injection.html
CVE: CVE-2020-16279
Published: 2020-08-20
Description: The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed to the command line without sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.contextis.com/en/resources/advisories/cve-2020-16279; https://www.contextis.com/en/resources/advisories/cve-2020-16279
CVE: CVE-2020-16280
Published: 2020-08-20
Description: Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services, domain joined users, and local administrators. To exploit the vulnerability a local attacker must have access to the underlying operating system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.contextis.com/en/resources/advisories/cve-2020-16280; https://www.contextis.com/en/resources/advisories/cve-2020-16280
CVE: CVE-2020-16281
Published: 2020-08-20
Description: The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible.
CVSS Score: 7.8 (HIGH)
CWE: CWE-116
References: https://www.contextis.com/en/resources/advisories/cve-2020-16281; https://www.contextis.com/en/resources/advisories/cve-2020-16281
CVE: CVE-2020-16282
Published: 2020-08-20
Description: In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. This may allow a local attacker to break out of the restricted environment or inject malicious code into the application and fully compromise the operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.contextis.com/en/resources/advisories/cve-2020-16282; https://www.contextis.com/en/resources/advisories/cve-2020-16282
CVE: CVE-2020-4548
Published: 2020-08-20
Description: IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypass the user interface and send requests to the IBM Content Navigator server with illegal characters that could be stored in the IBM Content Navigator database. IBM X-Force ID: 183316.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183316; https://www.ibm.com/support/pages/node/6262411; https://exchange.xforce.ibmcloud.com/vulnerabilities/183316
CVE: CVE-2020-4687
Published: 2020-08-20
Description: IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186679; https://www.ibm.com/support/pages/node/6262423; https://exchange.xforce.ibmcloud.com/vulnerabilities/186679
CVE: CVE-2020-24359
Published: 2020-08-20
Description: HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020; https://github.com/hashicorp/vault-ssh-helper/releases; https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020
CVE: CVE-2020-12618
Published: 2020-08-20
Description: eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.
CVSS Score: 4.8 (MEDIUM)
References: https://www.emclient.com/release-history; https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf; https://www.emclient.com/release-history
CVE: CVE-2020-12619
Published: 2020-08-20
Description: MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.
CVSS Score: 5.9 (MEDIUM)
References: https://updates.mailmate-app.com/2.0/release_notes; https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf; https://updates.mailmate-app.com/2.0/release_notes
CVE: CVE-2020-24567
Published: 2020-08-21
Description: voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: this is only relevant if low-privileged users can write to the installation directory, which may be considered a site-specific configuration error
CVSS Score: 7.8 (HIGH)
References: https://www.cymaera.com/articles/everything.html; https://www.voidtools.com/forum/viewtopic.php?p=32509#p32509; https://www.cymaera.com/articles/everything.html
CVE: CVE-2020-24571
Published: 2020-08-21
Description: NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371; https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371
CVE: CVE-2020-24574
Published: 2020-08-21
Description: The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based "trusted client" protection mechanism.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/jtesta/gog_galaxy_client_service_poc; https://github.com/jtesta/gog_galaxy_client_service_poc/issues/1#issuecomment-926932218; https://www.gog.com/galaxy
CVE: CVE-2020-12759
Published: 2020-08-21
Description: Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/; https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/
CVE: CVE-2020-14194
Published: 2020-08-21
Description: Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-269
References: https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/; https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/
CVE: CVE-2020-14215
Published: 2020-08-21
Description: Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/; https://blog.zulip.com/2020/06/17/zulip-server-2-1-5-security-release/
CVE: CVE-2020-15070
Published: 2020-08-21
Description: Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://blog.zulip.com/2020/06/26/zulip-server-2-1-7-security-release/; https://blog.zulip.com/2020/06/26/zulip-server-2-1-7-security-release/
CVE: CVE-2020-7310
Published: 2020-08-21
Description: Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that are part of write protection rules via manipulating symbolic links to redirect a McAfee file operations to an unintended file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-269, CWE-269
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS103067; http://service.mcafee.com/FAQDocument.aspx?&id=TS103067
CVE: CVE-2020-7710
Published: 2020-08-21
Description: This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://github.com/hacksparrow/safe-eval/issues/19; https://snyk.io/vuln/SNYK-JS-SAFEEVAL-608076; https://github.com/hacksparrow/safe-eval/issues/19
CVE: CVE-2020-14518
Published: 2020-08-21
Description: Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-212-01; https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive; https://us-cert.cisa.gov/ics/advisories/icsma-20-212-01