deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6142
Published: 2020-09-01
Description: A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclusion. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1082; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1082
CVE: CVE-2020-6143
Published: 2020-09-01
Description: A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-96, CWE-94
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1083; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1083
CVE: CVE-2020-6144
Published: 2020-09-01
Description: A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-96, CWE-94
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1083; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1083
CVE: CVE-2020-6151
Published: 2020-09-01
Description: A memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause a memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-704, CWE-704, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1095; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1095
CVE: CVE-2020-6152
Published: 2020-09-01
Description: A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause an out-of-bounds write. An attacker can trigger this vulnerability by providing a victim with a malicious DICOM file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-252, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1096; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1096
CVE: CVE-2020-6873
Published: 2020-09-01
Description: A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http links, the remote attackers could use this vulnerability to cause the equipment WEB/TELNET module denial of service and make the equipment be out of management. This affects: ZXR10 2800-4_ALMPUFB(LOW), all versions up to V3.00.40.
CVSS Score: 5.3 (MEDIUM)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013403; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013403
CVE: CVE-2020-6874
Published: 2020-09-01
Description: A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerability for account credential enumeration attack or brute-force attack for password guessing. This affects: ZXIPTV, ZXIPTV-WEB-PV5.09.08.04.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-327, CWE-522
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013463; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013463
CVE: CVE-2020-24955
Published: 2020-09-01
Description: SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from quarantine into the system32 folder via an NTFS directory junction, as demonstrated by a crafted ualapi.dll file that is detected as malware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://github.com/b1nary0x1; https://www.youtube.com/watch?v=jdcqbev-H5I; https://github.com/b1nary0x1
CVE: CVE-2020-8335
Published: 2020-09-01
Description: The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS versions up to r13uj47w, while the emergency-reset button is pressed which may allow for unauthorized access.
CVSS Score: 6.1 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-30042; https://support.lenovo.com/us/en/product_security/LEN-30042
CVE: CVE-2020-8341
Published: 2020-09-01
Description: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
CVSS Score: 2.4 (LOW)
References: https://support.lenovo.com/us/en/product_security/LEN-30042; https://support.lenovo.com/us/en/product_security/LEN-30042
CVE: CVE-2020-25073
Published: 2020-09-02
Description: FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, but only if the Apache mod_status module is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://salsa.debian.org/freedombox-team/freedombox/-/issues/1935; https://salsa.debian.org/freedombox-team/freedombox/-/issues/1935
CVE: CVE-2020-5622
Published: 2020-09-02
Description: Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to cause a denial of service which may result in not being able to add newly detected attack source IP addresses as blocking targets for about 10 minutes via a specially crafted request.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/en/jp/JVN42665874/index.html; https://www.shadan-kun.com/news/20200831/; https://jvn.jp/en/jp/JVN42665874/index.html
CVE: CVE-2020-24355
Published: 2020-09-02
Description: Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B; https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2; https://www.zyxel.com/support/security_advisories.shtml
CVE: CVE-2020-16602
Published: 2020-09-02
Description: Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in which a file created under "%PROGRAMDATA%\Razer Chroma\SDK\Apps" can be replaced before it is executed by the server. The attacker must have access to port 54236 for a registration step.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://packetstormsecurity.com/files/160225/Razer-Chroma-SDK-Server-3.16.02-Race-Condition.html; https://assets.razerzone.com/dev_portal/REST/html/index.html; https://www.angelystor.com/2020/09/cve-2020-16602-remote-file-execution-on.html
CVE: CVE-2020-17458
Published: 2020-09-02
Description: A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.fabbricadigitale.com/en/il-nuovo-aspetto-di-multiux/; https://www.gruppotim.it/redteam; https://www.fabbricadigitale.com/en/il-nuovo-aspetto-di-multiux/
CVE: CVE-2020-24601
Published: 2020-09-02
Description: In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2020-24601-ignite-realtime-openfire.html; https://issues.igniterealtime.org/browse/OF-1963; https://cybersecurityworks.com/zerodays/cve-2020-24601-ignite-realtime-openfire.html
CVE: CVE-2020-24602
Published: 2020-09-02
Description: Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in the Server Properties and Security Audit Viewer JSP page
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2020-24602-ignite-realtime-openfire.html; https://issues.igniterealtime.org/browse/OF-1963; https://cybersecurityworks.com/zerodays/cve-2020-24602-ignite-realtime-openfire.html
CVE: CVE-2020-24604
Published: 2020-09-02
Description: A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in server-properties.jsp and security-audit-viewer.jsp
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2020-24604-ignite-realtime-openfire.html; https://issues.igniterealtime.org/browse/OF-1963; https://cybersecurityworks.com/zerodays/cve-2020-24604-ignite-realtime-openfire.html
CVE: CVE-2020-16150
Published: 2020-09-02
Description: A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OSOFUD6UTGTDDSQRS62BPXDU52I6PUA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRPBHCQKZXHVKOP5O5EWE7P76AWGUXQJ/
CVE: CVE-2020-25078
Published: 2020-09-02
Description: An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
CVSS Score: 7.5 (HIGH)
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180; https://twitter.com/Dogonsecurity/status/[PII_REDACTED]67516161; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
CVE: CVE-2020-25079
Published: 2020-09-02
Description: An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180; https://twitter.com/Dogonsecurity/status/[PII_REDACTED]18259712; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
CVE: CVE-2020-12621
Published: 2020-09-02
Description: The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-306
References: https://play.google.com/store/apps/details?id=com.teamwire.messenger&hl=en_US; https://telekom-security.github.io/2020/08/teamwire-passcode-bypass.html; https://play.google.com/store/apps/details?id=com.teamwire.messenger&hl=en_US
CVE: CVE-2020-13802
Published: 2020-09-02
Description: Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/159027/Rebar3-3.13.2-Command-Injection.html; https://github.com/vulnbe/poc-rebar3.git; https://vuln.be/post/rebar3-command-injection/
CVE: CVE-2020-14209
Published: 2020-09-02
Description: Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/161955/Dolibarr-ERP-CRM-11.0.4-Bypass-Code-Execution.html; https://github.com/Dolibarr/dolibarr/releases/tag/11.0.5; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-012
CVE: CVE-2020-15810
Published: 2020-09-02
Description: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html; https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m
CVE: CVE-2020-15811
Published: 2020-09-02
Description: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-697
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html; https://github.com/squid-cache/squid/security/advisories/GHSA-c7p8-xqhm-49wv
CVE: CVE-2020-23830
Published: 2020-09-02
Description: A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/48783; https://www.sourcecodester.com/php/14366/stock-management-system-php.html; https://www.exploit-db.com/exploits/48783
CVE: CVE-2020-24028
Published: 2020-09-02
Description: ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. NOTE: as of 2025-10-14, the Supplier's perspective is that this "does not allow administrative privilege gain. Authorization is enforced server-side, restricting actions to the user’s own permission scope."
CVSS Score: 8.8 (HIGH)
References: https://forlogic.net; https://github.com/underprotection/CVE-2020-24028; https://qualiex.com
CVE: CVE-2020-24029
Published: 2020-09-02
Description: Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated against registered user emails and require a valid, short-lived token."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/underprotection/CVE-2020-24029; https://qualiex.com; https://github.com/underprotection/CVE-2020-24029
CVE: CVE-2020-24030
Published: 2020-09-02
Description: ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "not exploitable in the current implementation. Tokens are properly expired, invalidated, and bound to session context. Attempts to alter the token payload to extend its validity do not affect server-side validation."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-672
References: https://github.com/underprotection/CVE-2020-24030; https://qualiex.com; https://github.com/underprotection/CVE-2020-24030
CVE: CVE-2020-24553
Published: 2020-09-02
Description: Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html; http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html
CVE: CVE-2020-24654
Published: 2020-09-02
Description: In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00001.html; https://bugzilla.suse.com/show_bug.cgi?id=1175857; https://github.com/KDE/ark/commit/8bf8c5ef07b0ac5e914d752681e470dea403a5bd
CVE: CVE-2020-25025
Published: 2020-09-02
Description: The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-016; https://typo3.org/help/security-advisories
CVE: CVE-2020-25026
Published: 2020-09-02
Description: The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
CVSS Score: 4.3 (MEDIUM)
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-017; https://typo3.org/help/security-advisories
CVE: CVE-2020-15094
Published: 2020-09-02
Description: In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
CVSS Score: 8.0 (HIGH)
CWE: CWE-212
References: https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78; https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3/
CVE: CVE-2020-15167
Published: 2020-09-02
Description: In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-94, CWE-427
References: https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw; https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw
CVE: CVE-2020-4445
Published: 2020-09-02
Description: IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181122.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181122; https://www.ibm.com/support/pages/node/6325343; https://exchange.xforce.ibmcloud.com/vulnerabilities/181122
CVE: CVE-2020-4522
Published: 2020-09-02
Description: IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182397.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182397; https://www.ibm.com/support/pages/node/6325343; https://exchange.xforce.ibmcloud.com/vulnerabilities/182397
CVE: CVE-2020-4546
Published: 2020-09-02
Description: IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183314; https://www.ibm.com/support/pages/node/6325343; https://exchange.xforce.ibmcloud.com/vulnerabilities/183314
CVE: CVE-2020-4693
Published: 2020-09-02
Description: IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caused by improper validation of data prior to export. IBM X-Force ID: 186782.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186782; https://www.ibm.com/support/pages/node/6325341; https://exchange.xforce.ibmcloud.com/vulnerabilities/186782
CVE: CVE-2020-25043
Published: 2020-09-02
Description: The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system.
CVSS Score: 7.1 (HIGH)
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720