deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4358
Published: 2020-05-27
Description: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178762.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178762; https://www.ibm.com/support/pages/node/6214481; https://exchange.xforce.ibmcloud.com/vulnerabilities/178762
CVE: CVE-2020-4378
Published: 2020-05-27
Description: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST command. IBM X-Force ID: 179157.
CVSS Score: 4.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179157; https://www.ibm.com/support/pages/node/6214484; https://exchange.xforce.ibmcloud.com/vulnerabilities/179157
CVE: CVE-2020-4379
Published: 2020-05-27
Description: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179158.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179158; https://www.ibm.com/support/pages/node/6214483; https://exchange.xforce.ibmcloud.com/vulnerabilities/179158
CVE: CVE-2020-13253
Published: 2020-05-27
Description: sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2020/05/27/2; https://bugzilla.redhat.com/show_bug.cgi?id=1838546; https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html
CVE: CVE-2020-13630
Published: 2020-05-27
Description: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2020/Dec/32; http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-13631
Published: 2020-05-27
Description: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Dec/32; http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-13632
Published: 2020-05-27
Description: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.chromium.org/p/chromium/issues/detail?id=1080459; https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
CVE: CVE-2020-10945
Published: 2020-05-27
Description: Centreon before 19.10.7 exposes Session IDs in server responses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://sysdream.com/news/lab/2020-05-13-cve-2020-10945-centreon-session-id-exposure; https://sysdream.com/news/lab/2020-05-13-cve-2020-10945-centreon-session-id-exposure
CVE: CVE-2020-10946
Published: 2020-05-27
Description: Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/; https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
CVE: CVE-2020-13627
Published: 2020-05-27
Description: Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/; https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
CVE: CVE-2020-13628
Published: 2020-05-27
Description: Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/; https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
CVE: CVE-2020-13633
Published: 2020-05-27
Description: Fork before 5.8.3 allows XSS via navigation_title or title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/forkcms/forkcms/pull/3093; https://github.com/forkcms/forkcms/pull/3093
CVE: CVE-2020-6774
Published: 2020-05-27
Description: Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and access the underlying operating system.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-284, CWE-668
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-363824-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-363824-BT.html
CVE: CVE-2020-10936
Published: 2020-05-27
Description: Sympa before 6.2.56 allows privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/sympa-community/sympa/releases; https://lists.debian.org/debian-lts-announce/2020/10/msg00012.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3J4NZLGAF4ZYK52XEBQDTBNHLGBEPXXN/
CVE: CVE-2020-11059
Published: 2020-05-27
Description: In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-200, CWE-200
References: https://github.com/ipfs/aegir/security/advisories/GHSA-qfcv-5whw-7pcw; https://github.com/ipfs/aegir/security/advisories/GHSA-qfcv-5whw-7pcw
CVE: CVE-2020-11075
Published: 2020-05-27
Description: In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-114
References: https://github.com/anchore/anchore-engine/commit/e41786901f097fd32104447a[PII_REDACTED]5d37db; https://github.com/anchore/anchore-engine/issues/430; https://github.com/anchore/anchore-engine/pull/431
CVE: CVE-2020-8603
Published: 2020-05-27
Description: A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/000253095; https://www.zerodayinitiative.com/advisories/ZDI-20-675/; https://success.trendmicro.com/solution/000253095
CVE: CVE-2020-8604
Published: 2020-05-27
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html; http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html; https://success.trendmicro.com/solution/000253095
CVE: CVE-2020-8605
Published: 2020-05-27
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html; http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html; https://success.trendmicro.com/solution/000253095
CVE: CVE-2020-8606
Published: 2020-05-27
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html; http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html; https://success.trendmicro.com/solution/000253095
CVE: CVE-2020-13641
Published: 2020-05-28
Description: An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/real-time-find-and-replace/#developers; https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-patched-in-real-time-find-and-replace-plugin/; https://wordpress.org/plugins/real-time-find-and-replace/#developers
CVE: CVE-2020-13642
Published: 2020-05-28
Description: An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/siteorigin-panels/#developers; https://www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/; https://wordpress.org/plugins/siteorigin-panels/#developers
CVE: CVE-2020-13643
Published: 2020-05-28
Description: An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/siteorigin-panels/#developers; https://www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/; https://wordpress.org/plugins/siteorigin-panels/#developers
CVE: CVE-2020-13644
Published: 2020-05-28
Description: An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/accordions/#developers; https://www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/; https://wordpress.org/plugins/accordions/#developers
CVE: CVE-2020-13645
Published: 2020-05-28
Description: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://gitlab.gnome.org/GNOME/balsa/-/issues/34; https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O/
CVE: CVE-2020-11949
Published: 2020-05-28
Description: testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.
CVSS Score: 6.5 (MEDIUM)
References: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf; http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf
CVE: CVE-2020-11950
Published: 2020-05-28
Description: VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf; http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2020-001-v1.pdf
CVE: CVE-2019-20807
Published: 2020-05-28
Description: In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html; http://seclists.org/fulldisclosure/2020/Jul/24; https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
CVE: CVE-2020-13361
Published: 2020-05-28
Description: In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
CVSS Score: 3.9 (LOW)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html; http://www.openwall.com/lists/oss-security/2020/05/28/1; https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
CVE: CVE-2020-7812
Published: 2020-05-28
Description: Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-494, CWE-494
References: http://www.kaoni.com/; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428; http://www.kaoni.com/
CVE: CVE-2020-13362
Published: 2020-05-28
Description: In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
CVSS Score: 3.2 (LOW)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html; http://www.openwall.com/lists/oss-security/2020/05/28/2; https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
CVE: CVE-2020-13649
Published: 2020-05-28
Description: parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-617, CWE-754
References: https://github.com/jerryscript-project/jerryscript/commit/69f8e78c2f8d562bd6d8002b5488f1662ac30d24; https://github.com/jerryscript-project/jerryscript/issues/3786; https://github.com/jerryscript-project/jerryscript/issues/3788
CVE: CVE-2020-4231
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation. IBM X-Force ID: 175335.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175335; https://www.ibm.com/support/pages/node/6207905; https://exchange.xforce.ibmcloud.com/vulnerabilities/175335
CVE: CVE-2020-4232
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system. IBM X-Force ID: 175336.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175336; https://www.ibm.com/support/pages/node/6207906; https://exchange.xforce.ibmcloud.com/vulnerabilities/175336
CVE: CVE-2020-4233
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 175360.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175360; https://www.ibm.com/support/pages/node/6207912; https://exchange.xforce.ibmcloud.com/vulnerabilities/175360
CVE: CVE-2020-4244
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force ID: 175422.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175422; https://www.ibm.com/support/pages/node/6207907; https://exchange.xforce.ibmcloud.com/vulnerabilities/175422
CVE: CVE-2020-4245
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 175423.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175423; https://www.ibm.com/support/pages/node/6207908; https://exchange.xforce.ibmcloud.com/vulnerabilities/175423
CVE: CVE-2020-4246
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 175481.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175481; https://www.ibm.com/support/pages/node/6207902; https://exchange.xforce.ibmcloud.com/vulnerabilities/175481
CVE: CVE-2020-4249
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect authorization. IBM X-Force ID: 175485.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175485; https://www.ibm.com/support/pages/node/6207911; https://exchange.xforce.ibmcloud.com/vulnerabilities/175485
CVE: CVE-2020-4419
Published: 2020-05-28
Description: IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180071.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180071; https://www.ibm.com/support/pages/node/6217403; https://exchange.xforce.ibmcloud.com/vulnerabilities/180071
CVE: CVE-2020-4248
Published: 2020-05-28
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175484; https://www.ibm.com/support/pages/node/6207913; https://exchange.xforce.ibmcloud.com/vulnerabilities/175484
CVE: CVE-2020-8329
Published: 2020-05-28
Description: A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted.
CVSS Score: 5.3 (MEDIUM)
References: https://iknow.lenovo.com.cn/detail/dc_188830.html; https://iknow.lenovo.com.cn/detail/dc_188830.html
CVE: CVE-2020-8330
Published: 2020-05-28
Description: A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, preventing subsequent print jobs until the printer is rebooted.
CVSS Score: 5.3 (MEDIUM)
References: https://iknow.lenovo.com.cn/detail/dc_188830.html; https://iknow.lenovo.com.cn/detail/dc_188830.html
CVE: CVE-2020-11079
Published: 2020-05-28
Description: node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-94, CWE-77
References: https://github.com/skoranga/node-dns-sync/commit/cb10a5ac7913eacc031ade7d91596277f31645dc; https://github.com/skoranga/node-dns-sync/security/advisories/GHSA-wh69-wc6q-7888; https://github.com/skoranga/node-dns-sync/commit/cb10a5ac7913eacc031ade7d91596277f31645dc