deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14878
Published: 2020-03-19
Description: In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. Accessing _x will trigger a null pointer dereference bug in case of a memory allocation failure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/; https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
CVE: CVE-2019-16010
Published: 2020-03-19
Description: A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-xss
CVE: CVE-2019-16012
Published: 2020-03-19
Description: A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77, CWE-89
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-cypher-inject; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-cypher-inject
CVE: CVE-2020-1705
Published: 2020-03-19
Description: A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/template-service-broker-operator. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1705; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1705
CVE: CVE-2020-3264
Published: 2020-03-19
Description: A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-wwq2-pxrj-v62r; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwanbo-QKcABnS2; https://github.com/orangecertcc/security-research/security/advisories/GHSA-wwq2-pxrj-v62r
CVE: CVE-2020-3265
Published: 2020-03-19
Description: A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwpresc-ySJGvE9; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwpresc-ySJGvE9
CVE: CVE-2020-3266
Published: 2020-03-19
Description: A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwclici-cvrQpH9v; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwclici-cvrQpH9v
CVE: CVE-2019-11361
Published: 2020-03-19
Description: Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.manageengine.com/remote-desktop-management/knowledge-base/elevation-of-privilege.html; https://www.manageengine.com/remote-desktop-management/knowledge-base/elevation-of-privilege.html
CVE: CVE-2019-16382
Published: 2020-03-19
Description: An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid XML file can then be created, after which the folder is renamed back to its original value. Also, CVE-2018-15591 exploitation can consequently be achieved by using PowerGrid with the /SEE parameter to execute the arbitrary command specified in the XML file.
CVSS Score: 9.8 (CRITICAL)
References: https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Workspace-Control-September-2019; https://twitter.com/jmoosdijk; https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Workspace-Control-September-2019
CVE: CVE-2020-5262
Published: 2020-03-19
Description: In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.
CVSS Score: 7.7 (HIGH)
CWE: CWE-532, CWE-922
References: https://github.com/easybuilders/easybuild-framework/pull/3248; https://github.com/easybuilders/easybuild-framework/pull/3249; https://github.com/easybuilders/easybuild-framework/security/advisories/GHSA-2wx6-wc87-rmjm
CVE: CVE-2019-12125
Published: 2020-03-19
Description: In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-27; https://jira.onap.org/browse/OJSI-27
CVE: CVE-2019-12126
Published: 2020-03-19
Description: In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-27; https://jira.onap.org/browse/OJSI-27
CVE: CVE-2019-12127
Published: 2020-03-19
Description: In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-27; https://jira.onap.org/browse/OJSI-27
CVE: CVE-2019-15653
Published: 2020-03-19
Description: Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-327, CWE-522
References: https://www.comba-telecom.com/en/news; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164; https://www.comba-telecom.com/en/news
CVE: CVE-2019-15654
Published: 2020-03-19
Description: Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login information is stored in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.comba-telecom.com/en/news; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164; https://www.comba-telecom.com/en/news
CVE: CVE-2019-15655
Published: 2020-03-19
Description: D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-522
References: https://www.dlink.com/en/security-bulletin; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-15656
Published: 2020-03-19
Description: D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server because of username_v and password_v variables.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://www.dlink.com/en/security-bulletin; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26165; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-16061
Published: 2020-03-19
Description: A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing any low privileged user with access to the system to read sensitive data (e.g., .htpasswd) and create/modify/delete content (e.g., under /var/www/html/docs) within the operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16062
Published: 2020-03-19
Description: NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for an attacker to expose unencrypted sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16064
Published: 2020-03-19
Description: NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory contents on the server, create directories and upload files in permissible locations, and modify filenames and delete files that are accessible by the user running the web server instance.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16065
Published: 2020-03-19
Description: A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user. This affects the search_pattern value of the manage_hosts_short.cgi script.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16066
Published: 2020-03-19
Description: An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. This allows an attacker to upload malicious files and perform arbitrary code execution on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16067
Published: 2020-03-19
Description: NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication traffic in transit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-522
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16070
Published: 2020-03-19
Description: A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16337
Published: 2020-03-19
Description: The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://help.hancom.com/update_en_multilang/details/HOfficeNEO_update.htm; https://starlabs.sg/advisories/; http://help.hancom.com/update_en_multilang/details/HOfficeNEO_update.htm
CVE: CVE-2019-16338
Published: 2020-03-19
Description: The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://help.hancom.com/update_en_multilang/details/HOfficeNEO_update.htm; https://starlabs.sg/advisories/; http://help.hancom.com/update_en_multilang/details/HOfficeNEO_update.htm
CVE: CVE-2019-16375
Published: 2020-03-19
Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent composes an answer to the original article.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2019-20513
Published: 2020-03-19
Description: Open edX Ironwood.1 allows support/certificates?user= reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-014-reflected-cross-site-scripting-in-openedx/; https://www.netsparker.com/web-applications-advisories/ns-19-014-reflected-cross-site-scripting-in-openedx/
CVE: CVE-2019-20514
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20515
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20516
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20517
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20518
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20519
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20520
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20521
Published: 2020-03-19
Description: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/; https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext/
CVE: CVE-2019-20525
Published: 2020-03-19
Description: Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire/; https://www.netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire/
CVE: CVE-2019-20526
Published: 2020-03-19
Description: Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire/; https://www.netsparker.com/web-applications-advisories/ns-19-015-reflected-cross-site-scripting-in-openfire/
CVE: CVE-2020-5267
Published: 2020-03-19
Description: In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html; http://www.openwall.com/lists/oss-security/2020/03/19/1; https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a
CVE: CVE-2019-15124
Published: 2020-03-19
Description: In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phabricator.wikimedia.org/T230576; https://phabricator.wikimedia.org/T230576
CVE: CVE-2019-15539
Published: 2020-03-19
Description: The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mantisbt/mantisbt/commit/bd094dede74ff6e313e286e949e2387233a96eea; https://mantisbt.org/bugs/view.php?id=26078; https://github.com/mantisbt/mantisbt/commit/bd094dede74ff6e313e286e949e2387233a96eea
CVE: CVE-2020-10667
Published: 2020-03-19
Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name). NOTE: this is fixed in the latest version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/24; https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/
CVE: CVE-2020-10668
Published: 2020-03-19
Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/24; https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/
CVE: CVE-2020-10670
Published: 2020-03-19
Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html; https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/; http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
CVE: CVE-2020-10671
Published: 2020-03-19
Description: The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html; https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/; http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html