deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5571
Published: 2020-04-23
Description: SHARP AQUOS series (AQUOS SH-M02 build number 01.00.05 and earlier, AQUOS SH-RM02 build number 01.00.04 and earlier, AQUOS mini SH-M03 build number 01.00.04 and earlier, AQUOS Keitai SH-N01 build number 01.00.01 and earlier, AQUOS L2 (UQ mobile/J:COM) build number 01.00.05 and earlier, AQUOS sense lite SH-M05 build number 03.00.04 and earlier, AQUOS sense (UQ mobile) build number 03.00.03 and earlier, AQUOS compact SH-M06 build number 02.00.02 and earlier, AQUOS sense plus SH-M07 build number 02.00.02 and earlier, AQUOS sense2 SH-M08 build number 02.00.05 and earlier, and AQUOS sense2 (UQ mobile) build number 02.00.06 and earlier) allow an attacker to obtain the sensitive information of the device via malicious applications installed on the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://jvn.jp/en/jp/JVN93064451/index.html; https://k-tai.sharp.co.jp/support/info/info036.html; https://jvn.jp/en/jp/JVN93064451/index.html
CVE: CVE-2019-4668
Published: 2020-04-23
Description: IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171250; https://www.ibm.com/support/pages/node/6195699; https://exchange.xforce.ibmcloud.com/vulnerabilities/171250
CVE: CVE-2019-4735
Published: 2020-04-23
Description: IBM MaaS360 3.96.62 for iOS could allow an attacker with physical access to the device to obtain sensitive information from the agent outside of the container. IBM X-Force ID: 172705.
CVSS Score: 4.6 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172705; https://www.ibm.com/support/pages/node/6151767; https://exchange.xforce.ibmcloud.com/vulnerabilities/172705
CVE: CVE-2019-8359
Published: 2020-04-23
Description: An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. An out of bounds write is present in the data section during 6LoWPAN fragment re-assembly in the face of forged fragment offsets in os/net/ipv6/sicslowpan.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/contiki-ng/contiki-ng/pull/972; https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.4; https://www.usenix.org/system/files/sec20summer_clements_prepub.pdf
CVE: CVE-2019-9183
Published: 2020-04-23
Description: An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory, crashing the application. An attacker can cause a denial-of-service via a crafted 6LoWPAN frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191, CWE-787
References: https://github.com/contiki-ng/contiki-ng/pull/972; https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.4; https://www.usenix.org/system/files/sec20summer_clements_prepub.pdf
CVE: CVE-2020-11806
Published: 2020-04-23
Description: In MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process does not validate the validity of the certificate presented by the server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://help.mailstore.com/security/MAILSTORE-SA-2020-01.txt; https://help.mailstore.com/security/MAILSTORE-SA-2020-01.txt
CVE: CVE-2020-11939
Published: 2020-04-23
Description: In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://github.com/ntop/nDPI/commit/7ce478a58b4dd29a8d1e6f4e9df2f778613d9202; https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi; https://github.com/ntop/nDPI/commit/7ce478a58b4dd29a8d1e6f4e9df2f778613d9202
CVE: CVE-2020-11940
Published: 2020-04-23
Description: In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ntop/nDPI/commit/3bbb0cd3296023f6f922c71d21a1c374d2b0a435; https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi; https://github.com/ntop/nDPI/commit/3bbb0cd3296023f6f922c71d21a1c374d2b0a435
CVE: CVE-2020-11945
Published: 2020-04-23
Description: An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html; http://master.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch; http://www.openwall.com/lists/oss-security/2020/04/23/2
CVE: CVE-2020-12054
Published: 2020-04-23
Description: The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://wpvulndb.com/vulnerabilities/10184; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-1760
Published: 2020-04-23
Description: A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760; https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE: CVE-2020-4202
Published: 2020-04-23
Description: IBM UrbanCode Deploy (UCD) 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End (DFE). IBM X-Force ID: 174955.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174955; https://www.ibm.com/support/pages/node/6195701; https://exchange.xforce.ibmcloud.com/vulnerabilities/174955
CVE: CVE-2020-4311
Published: 2020-04-23
Description: IBM Tivoli Monitoring 6.3.0 could allow a local attacker to execute arbitrary code on the system. By placing a specially crafted file, an attacker could exploit this vulnerability to load other DLL files located in the same directory and execute arbitrary code on the system. IBM X-Force ID: 177083.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/177083; https://www.ibm.com/support/pages/node/6198358; https://exchange.xforce.ibmcloud.com/vulnerabilities/177083
CVE: CVE-2020-4353
Published: 2020-04-23
Description: IBM MaaS360 6.82 could allow a user with pysical access to the device to crash the application which may enable the user to access restricted applications and device settings. IBM X-Force ID: 178505.
CVSS Score: 4.6 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178505; https://www.ibm.com/support/pages/node/6151773; https://exchange.xforce.ibmcloud.com/vulnerabilities/178505
CVE: CVE-2020-4415
Published: 2020-04-23
Description: IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker to execute arbitrary code on the system with the privileges of an administrator or user associated with the Spectrum Protect server or cause the Spectrum Protect server to crash. IBM X-Force ID: 179990.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179990; https://www.ibm.com/support/pages/node/6195706; https://exchange.xforce.ibmcloud.com/vulnerabilities/179990
CVE: CVE-2020-7643
Published: 2020-04-23
Description: paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31; https://snyk.io/vuln/SNYK-JS-PAYPALADAPTIVE-565089; https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31
CVE: CVE-2017-18740
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.61, D6000 before 1.0.0.61, D6100 before 1.0.0.55, D7800 before 1.0.1.28, R6100 before 1.0.1.16, R7500 before 1.0.0.112, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, R9000 before 1.0.2.40, WNDR3700v4 before 1.0.2.88, WNDR4300 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.
CVSS Score: 6.3 (MEDIUM)
References: https://kb.netgear.com/000051515/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2017-0615; https://kb.netgear.com/000051515/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2017-0615
CVE: CVE-2017-18741
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6250 before 1.0.4.8, R6300v2 before 1.0.4.8, R6700 before 1.0.1.20, R7000 before 1.0.7.10, R7000P before 1.0.0.58, R6900P before 1.0.0.58, R7100LG before 1.0.0.32, R7900 before 1.0.1.14, R8000 before 1.0.3.22, and R8500 before 1.0.2.94.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.netgear.com/000051514/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2017-0335; https://kb.netgear.com/000051514/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2017-0335
CVE: CVE-2017-18742
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by CSRF. This affects JR6150 before 1.0.1.10, R6050 before 1.0.1.10, R6250 before 1.0.4.12, R6300v2 before 1.0.4.8, R6700 before 1.0.1.16, R6900 before 1.0.1.16, R7300DST before 1.0.0.54, R7900 before 1.0.1.12, R8000 before 1.0.3.32, and R8500 before 1.0.2.74.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000051513/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-0331; https://kb.netgear.com/000051513/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-0331
CVE: CVE-2017-18743
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.20, R6700 before 1.0.1.20, R6900 before 1.0.1.20, R7000 before 1.0.7.10, R7100LG before V1.0.0.32, R7300DST before 1.0.0.52, R7900 before 1.0.1.16, R8000 before 1.0.3.36, R8300 before 1.0.2.94, R8500 before 1.0.2.94, WNDR3400v3 before 1.0.1.12, and WNR3500Lv2 before 1.2.0.40.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://kb.netgear.com/000051512/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0330; https://kb.netgear.com/000051512/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0330
CVE: CVE-2017-18744
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects R6250 before 1.0.4.12, R6300v2 before 1.0.4.12, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7900 before 1.0.1.12, R8000 before 1.0.3.24, and R8500 before 1.0.2.74.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000051511/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2017-0324; https://kb.netgear.com/000051511/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2017-0324
CVE: CVE-2017-18745
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by stored XSS. This affects R6400 before 1.0.1.14, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7100LG before 1.0.0.32, R7300DST before 1.0.0.56, R7900 before 1.0.1.12, R8000 before 1.0.3.24, and R8500 before 1.0.2.74.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000051510/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2017-0323; https://kb.netgear.com/000051510/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2017-0323
CVE: CVE-2017-18746
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6130 before 1.0.0.16, EX6400 before 1.0.1.60, EX7000 before 1.0.0.50, EX7300 before 1.0.1.60, and WN2500RPv2 before 1.0.1.46.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.netgear.com/000051508/Security-Advisory-for-Security-Misconfiguration-on-Some-Extenders-PSV-2016-0253; https://kb.netgear.com/000051508/Security-Advisory-for-Security-Misconfiguration-on-Some-Extenders-PSV-2016-0253
CVE: CVE-2017-18747
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6130 before 1.0.0.16, EX6400 before 1.0.1.60, EX7000 before 1.0.0.50, EX7300 before 1.0.1.60, and WN2500RPv2 before 1.0.1.46.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://kb.netgear.com/000051507/Security-Advisory-for-Security-Misconfiguration-on-Some-Extenders-PSV-2016-0115; https://kb.netgear.com/000051507/Security-Advisory-for-Security-Misconfiguration-on-Some-Extenders-PSV-2016-0115
CVE: CVE-2017-18748
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects EX6200v2 before 1.0.1.44, R6100 before 1.0.1.12, R7500 before 1.0.0.108, R7500v2 before 1.0.3.10, R7800 before 1.0.2.28, R9000 before 1.0.2.30, WNDR4300v2 before 1.0.0.48, and WNDR4500v3 before 1.0.0.48.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000051506/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Extenders-PSV-2016-0104; https://kb.netgear.com/000051506/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Extenders-PSV-2016-0104
CVE: CVE-2017-18749
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by CSRF. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.44, R6050 before 1.0.1.10, R6100 before 1.0.1.16, R6220 before 1.1.0.50, R7500 before 1.0.0.112, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, R9000 before 1.0.2.40, WNDR3700v4 before 1.0.2.88, WNDR3700v5 before 1.1.0.48, WNDR4300 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.44, WNR2000v5 before 1.0.0.58, WNR2020 before 1.1.0.44, and WNR2050 before 1.1.0.44.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000051505/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2016-0101; https://kb.netgear.com/000051505/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2016-0101
CVE: CVE-2017-18750
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051504/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2133; https://kb.netgear.com/000051504/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2133
CVE: CVE-2017-18751
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D7800 before 1.0.1.28, R6100 before 1.0.1.16, R7500 before 1.0.0.112, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.88, WNDR4300 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, and WNDR4500v3 before 1.0.0.48.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051503/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2517; https://kb.netgear.com/000051503/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2517
CVE: CVE-2017-18732
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, PLW1000v2 before 1.0.0.14, and PLW1010v2 before 1.0.0.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://kb.netgear.com/000051523/Security-Advisory-for-Authentication-Bypass-on-R6300v2-PLW1000v2-and-PLW1010v2-PSV-2016-0069; https://kb.netgear.com/000051523/Security-Advisory-for-Authentication-Bypass-on-R6300v2-PLW1000v2-and-PLW1010v2-PSV-2016-0069
CVE: CVE-2017-18733
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.28, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.8, R6400 before 1.0.1.22, R6400v2 before 1.0.2.32, R7100LG before 1.0.0.32, R7300DST before 1.0.0.52, R8300 before 1.0.2.94, and R8500 before 1.0.2.100.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://kb.netgear.com/000051522/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-Gateways-PSV-2016-0061; https://kb.netgear.com/000051522/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-Gateways-PSV-2016-0061
CVE: CVE-2017-18734
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.44, PR2000 before 1.0.0.18, R6050 before 1.0.1.10, R6220 before 1.1.0.50, R6700v2 before 1.2.0.4, R6800 before 1.2.0.4, R6900v2 before 1.2.0.4, WNDR3700v5 before 1.1.0.48, WNR1000v4 before 1.1.0.44, WNR2020 before 1.1.0.44, and WNR2050 before 1.1.0.44.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://kb.netgear.com/000051521/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2154; https://kb.netgear.com/000051521/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2154
CVE: CVE-2017-18735
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JR6150 before 1.0.1.10, PR2000 before 1.0.0.18, R6050 before 1.0.1.10, R6700v2 before 1.2.0.4, R6800 before 1.2.0.4, and R6900v2 before 1.2.0.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://kb.netgear.com/000051520/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2143; https://kb.netgear.com/000051520/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2143
CVE: CVE-2017-18736
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JR6150 before 1.0.1.10, R6050 before 1.0.1.10, R6220 before 1.1.0.50, R6700v2 before 1.2.0.4, R6800 before 1.2.0.4, R6900v2 before 1.2.0.4, and WNDR3700v5 before 1.1.0.48.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://kb.netgear.com/000051519/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2017-2142; https://kb.netgear.com/000051519/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2017-2142
CVE: CVE-2017-18737
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.44, PR2000 before 1.0.0.18, R6050 before 1.0.1.10, R6220 before 1.1.0.50, R6700v2 before 1.2.0.4, R6800 before 1.2.0.4, R6900v2 before 1.2.0.4, WNDR3700v5 before 1.1.0.48, WNR1000v4 before 1.1.0.44, WNR2020 before 1.1.0.44, and WNR2050 before 1.1.0.44.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://kb.netgear.com/000051518/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2140; https://kb.netgear.com/000051518/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2140
CVE: CVE-2017-18738
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects EX6150v2 before 1.0.1.54, R6400 before 1.0.1.24, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.10, R7000P before 1.2.0.22, R6900P before 1.2.0.22, R7100LG before 1.0.0.32, R7300DST before 1.0.0.54, R7900 before 1.0.1.18, R8000 before 1.0.3.48, R8300 before 1.0.2.106, R8500 before 1.0.2.106, R6100 before 1.0.1.16, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051517/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Extenders-PSV-2017-0706; https://kb.netgear.com/000051517/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Extenders-PSV-2017-0706
CVE: CVE-2017-18739
Published: 2020-04-23
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects R6220 before V1.1.0.50, R7800 before V1.0.2.36, WNDR3400v3 before 1.0.1.14, and WNDR3700v5 before V1.1.0.48.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000051516/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2017-0670; https://kb.netgear.com/000051516/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2017-0670
CVE: CVE-2020-12105
Published: 2020-04-23
Description: OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html; https://gitlab.com/openconnect/openconnect/-/merge_requests/96; https://security.gentoo.org/glsa/202006-15
CVE: CVE-2020-12112
Published: 2020-04-23
Description: BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cwe.mitre.org/data/definitions/23.html; https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.4...v2.2.5; https://github.com/tchenu/CVE-2020-12112
CVE: CVE-2020-12113
Published: 2020-04-23
Description: BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigbluebutton/bigbluebutton/pull/9017; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.2.4; https://www.sakshamanand.com/cve-2020-12113/