deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26286
Published: 2020-12-29
Description: HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that your uploaded file storage only contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/uploadimage` endpoint on your instance using your reverse proxy. And/or restrict MIME-types and file names served from your upload file storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8; https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1; https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc
CVE: CVE-2020-26287
Published: 2020-12-29
Description: HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.md; https://github.com/hackmdio/codimd/issues/1630; https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4
CVE: CVE-2020-35769
Published: 2020-12-29
Description: miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/webmin/webmin/commit/1163f3a7f418f249af64890f4636575e687e9de7#diff-9b33fd8f5603d4f0d1428689bc36f24af4770608a22c0d92b7a8bcc522450dc6; https://vigilance.fr/vulnerability/Webmin-code-execution-via-miniserv-pl-handle-request-34220; https://github.com/webmin/webmin/commit/1163f3a7f418f249af64890f4636575e687e9de7#diff-9b33fd8f5603d4f0d1428689bc36f24af4770608a22c0d92b7a8bcc522450dc6
CVE: CVE-2020-25847
Published: 2020-12-29
Description: This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-20-20; https://www.qnap.com/en/security-advisory/qsa-20-20
CVE: CVE-2020-17533
Published: 2020-12-29
Description: Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
CVSS Score: 8.1 (HIGH)
CWE: CWE-252, CWE-252
References: http://www.openwall.com/lists/oss-security/2020/12/29/1; https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3E
CVE: CVE-2020-29475
Published: 2020-12-29
Description: nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49093; https://www.exploit-db.com/exploits/49093
CVE: CVE-2020-5801
Published: 2020-12-29
Description: An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr.dll, resulting in process termination. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.tenable.com/security/research/tra-2020-71; https://www.tenable.com/security/research/tra-2020-71
CVE: CVE-2020-5802
Published: 2020-12-29
Description: An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TCP port 4241. This will cause an unhandled exception, resulting in termination of RSLinxNG.exe. Observed in FactoryTalk 6.11. All versions of FactoryTalk Linx are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.tenable.com/security/research/tra-2020-71; https://www.tenable.com/security/research/tra-2020-71
CVE: CVE-2020-5806
Published: 2020-12-29
Description: An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are affected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://www.tenable.com/security/research/tra-2020-71; https://www.tenable.com/security/research/tra-2020-71
CVE: CVE-2020-5807
Published: 2020-12-29
Description: An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attacker can specify long fields in the log entry, which can cause an unhandled exception in wcscpy_s() if a local user opens FactoryTalk Diagnostics Viewer (FTDiagViewer.exe) to view the log entry. Observed in FactoryTalk Diagnostics 6.11. All versions of FactoryTalk Diagnostics are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.tenable.com/security/research/tra-2020-71; https://www.tenable.com/security/research/tra-2020-71
CVE: CVE-2020-28275
Published: 2020-12-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-28276
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28276; https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39
CVE: CVE-2020-28277
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/lukeed/dset/blob/50a6ead172d1466a96035eff00f8eb465ccd050a/src/index.js#L6; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28277; https://github.com/lukeed/dset/blob/50a6ead172d1466a96035eff00f8eb465ccd050a/src/index.js#L6
CVE: CVE-2020-29470
Published: 2020-12-29
Description: OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49099; https://www.exploit-db.com/exploits/49099
CVE: CVE-2020-29471
Published: 2020-12-29
Description: OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49098; https://www.exploit-db.com/exploits/49098
CVE: CVE-2020-1848
Published: 2020-12-29
Description: There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185(C00R2P1). Local attackers construct malicious application files, causing system applications to run abnormally.
CVSS Score: 5.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-02-smartphone-en
CVE: CVE-2020-28278
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/robinvdvleuten/shvl/blob/bef0a3ebade444cc6b297147ecf5242308f0892e/index.js#L10; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28278; https://github.com/robinvdvleuten/shvl/blob/bef0a3ebade444cc6b297147ecf5242308f0892e/index.js#L10
CVE: CVE-2020-28279
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/sahellebusch/flattenizer/pull/13; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28279; https://github.com/sahellebusch/flattenizer/pull/13
CVE: CVE-2020-28280
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/bigpipe/predefine/blob/238137e3d1b8288ff5d7529c3cbcdd371888c26b/index.js#L284; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28280; https://github.com/bigpipe/predefine/blob/238137e3d1b8288ff5d7529c3cbcdd371888c26b/index.js#L284
CVE: CVE-2020-28281
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/react-atomic/react-atomic-organism/blob/e5645a2f9e632ffdebc83d720498831e09754c22/packages/lib/set-object-value/src/index.js#L16; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28281; https://github.com/react-atomic/react-atomic-organism/blob/e5645a2f9e632ffdebc83d720498831e09754c22/packages/lib/set-object-value/src/index.js#L16
CVE: CVE-2020-28282
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/cowboy/node-getobject/blob/aba04a8e1d6180eb39eff09990c3a43886ba8937/lib/getobject.js#L48; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28282; https://github.com/cowboy/node-getobject/blob/aba04a8e1d6180eb39eff09990c3a43886ba8937/lib/getobject.js#L48
CVE: CVE-2020-28283
Published: 2020-12-29
Description: Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/dominictarr/libnested/blob/d028a1b0f2e5f16fc28e568f52b936ae0bca0647/index.js#L27; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28284; https://github.com/dominictarr/libnested/blob/d028a1b0f2e5f16fc28e568f52b936ae0bca0647/index.js#L27
CVE: CVE-2020-35773
Published: 2020-12-29
Description: The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://advisory.checkmarx.net/advisory/CX-2020-4292; https://developer.wordpress.org/reference/functions/wp_create_nonce/; https://developer.wordpress.org/reference/functions/wp_verify_nonce/
CVE: CVE-2020-35774
Published: 2020-12-29
Description: server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://advisory.checkmarx.net/advisory/CX-2020-4287; https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c; https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0
CVE: CVE-2020-9093
Published: 2020-12-29
Description: There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specific message properly, which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would compromise normal service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-smartphone-en
CVE: CVE-2020-9094
Published: 2020-12-29
Description: There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. A module does not deal with specific message properly. Attackers can exploit this vulnerability by sending malicious packet. This can lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-obr-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-obr-en
CVE: CVE-2020-9124
Published: 2020-12-29
Description: There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201223-01-cloudengine-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201223-01-cloudengine-en
CVE: CVE-2020-9125
Published: 2020-12-29
Description: There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2). An attacker with specific permission can exploit this vulnerability by sending crafted packet with specific parameter to the target device. Due to insufficient validation of the parameter, successful exploit can cause the device to behave abnormally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-taurus-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-taurus-en
CVE: CVE-2020-9207
Published: 2020-12-29
Description: There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not verify the input file properly. Attackers can exploit this vulnerability by crafting malicious files to bypass current verification mechanism. This can compromise normal service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-vrp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-vrp-en
CVE: CVE-2020-9208
Published: 2020-12-29
Description: There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authentication. Attackers without access to the module can exploit this vulnerability to obtain extra information, leading to information leak.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-neteco-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-01-neteco-en
CVE: CVE-2020-9223
Published: 2020-12-29
Description: There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.
CVSS Score: 7.5 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201216-03-smartphone-en
CVE: CVE-2020-35735
Published: 2020-12-29
Description: Vidyo 02-09-/D allows clickjacking via the portal/ URI.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021
References: https://blog.vidyo.com/category/product-updates/; https://github.com/italoantunes/CVE; https://blog.vidyo.com/category/product-updates/
CVE: CVE-2020-16268
Published: 2020-12-29
Description: The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM (MST) with the option to disable the installation of the Nomad module. An attacker may craft a .reg file in a specific location that will be able to write to any registry key as an elevated user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-668
References: https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645; https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE: CVE-2020-27643
Published: 2020-12-29
Description: The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories (where they would not normally have access to create or modify files) via the creation of a junction point to a system directory. This leads to partial privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645; https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE: CVE-2020-27644
Published: 2020-12-29
Description: The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges by placing a malicious cryptbase.dll file in %WINDIR%\Temp\.
CVSS Score: 8.8 (HIGH)
CWE: CWE-428
References: https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645; https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE: CVE-2020-27645
Published: 2020-12-29
Description: The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-428
References: https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645; https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE: CVE-2020-10148
Published: 2020-12-29
Description: The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://kb.cert.org/vuls/id/843464; https://www.solarwinds.com/securityadvisory; https://kb.cert.org/vuls/id/843464
CVE: CVE-2020-10207
Published: 2020-12-29
Description: Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows remote attackers to retrieve and modify the device settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#87fe; https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#87fe
CVE: CVE-2020-10210
Published: 2020-12-29
Description: Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B, an attacker may remotely log in through SSH.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#1ab7; https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#1ab7
CVE: CVE-2020-10206
Published: 2020-12-30
Description: Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows local attackers to view and interact with the video output of the device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-798
References: https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#dda4; https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#dda4
CVE: CVE-2020-10208
Published: 2020-12-30
Description: Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74, CWE-78
References: https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3; https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#9cf3
CVE: CVE-2020-10209
Published: 2020-12-30
Description: Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows man-in-the-middle attackers to execute arbitrary commands with root level privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#4dbc; https://andre-oudhof.medium.com/pwning-my-isps-stbs-c5e78544274d#4dbc
CVE: CVE-2020-35777
Published: 2020-12-30
Description: NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000062634/Security-Advisory-for-Command-Injection-Vulnerability-on-DGN2200v1-PSV-2020-0411; https://kb.netgear.com/000062634/Security-Advisory-for-Command-Injection-Vulnerability-on-DGN2200v1-PSV-2020-0411