deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26916
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.50, and WNR2020 before 1.1.0.62.
CVSS Score: 5.4 (MEDIUM)
References: https://kb.netgear.com/000062337/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2019-0012; https://kb.netgear.com/000062337/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2019-0012
CVE: CVE-2020-26917
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000062336/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extender-and-Routers-PSV-2018-0242; https://kb.netgear.com/000062336/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extender-and-Routers-PSV-2018-0242
CVE: CVE-2020-26918
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R6700v3 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000062335/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-Routers-PSV-2018-0243; https://kb.netgear.com/000062335/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-Routers-PSV-2018-0243
CVE: CVE-2020-26919
Published: 2020-10-09
Description: NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
CVSS Score: 9.8 (CRITICAL)
References: https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377; https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-26919
CVE: CVE-2020-26920
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.3.110, SRR60 before 2.5.3.110, and SRS60 before 2.5.3.110.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000062333/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0327; https://kb.netgear.com/000062333/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0327
CVE: CVE-2020-26921
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by authentication bypass. This affects GS110EMX before 1.0.1.7, GS810EMX before 1.7.1.3, XS512EM before 1.0.1.3, and XS724EM before 1.0.1.3.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287
References: https://kb.netgear.com/000062332/Security-Advisory-for-Authentication-Bypass-on-Some-Smart-Managed-Plus-Switches-PSV-2020-0305; https://kb.netgear.com/000062332/Security-Advisory-for-Authentication-Bypass-on-Some-Smart-Managed-Plus-Switches-PSV-2020-0305
CVE: CVE-2020-26922
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000062330/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Wireless-Controllers-PSV-2020-0139; https://kb.netgear.com/000062330/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Wireless-Controllers-PSV-2020-0139
CVE: CVE-2020-26923
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by stored XSS. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180; https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180
CVE: CVE-2020-26924
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC720 before 3.9.1.13 and WAC730 before 3.9.1.13.
CVSS Score: 3.1 (LOW)
References: https://kb.netgear.com/000062328/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Wireless-Access-Points-PSV-2020-0141; https://kb.netgear.com/000062328/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Wireless-Access-Points-PSV-2020-0141
CVE: CVE-2020-26925
Published: 2020-10-09
Description: NETGEAR GS808E devices before 1.7.1.0 are affected by denial of service.
CVSS Score: 3.2 (LOW)
References: https://kb.netgear.com/000062327/Security-Advisory-for-Denial-of-Service-on-GS808E-PSV-2019-0200; https://kb.netgear.com/000062327/Security-Advisory-for-Denial-of-Service-on-GS808E-PSV-2019-0200
CVE: CVE-2020-26926
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062326/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0028; https://kb.netgear.com/000062326/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0028
CVE: CVE-2020-26927
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before 1.0.0.42, R6050 before 1.0.1.26, JR6150 before 1.0.1.26, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.66, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, AC2100 before 1.2.0.62, AC2400 before 1.2.0.62, AC2600 before 1.2.0.62, R7450 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS Score: 9.4 (CRITICAL)
References: https://kb.netgear.com/000062325/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2019-0109; https://kb.netgear.com/000062325/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2019-0109
CVE: CVE-2020-26928
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062324/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0027; https://kb.netgear.com/000062324/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0027
CVE: CVE-2020-26929
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.100 and R6230 before 1.1.0.100.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000062323/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2019-0011; https://kb.netgear.com/000062323/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2019-0011
CVE: CVE-2020-26930
Published: 2020-10-09
Description: NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings.
CVSS Score: 3.3 (LOW)
CWE: CWE-1188
References: https://kb.netgear.com/000062322/Security-Advisory-for-Security-Misconfiguration-on-EX7700-PSV-2020-0109; https://kb.netgear.com/000062322/Security-Advisory-for-Security-Misconfiguration-on-EX7700-PSV-2020-0109
CVE: CVE-2020-26931
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24.
CVSS Score: 5.9 (MEDIUM)
References: https://kb.netgear.com/000062321/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Wireless-Controllers-PSV-2020-0268; https://kb.netgear.com/000062321/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Wireless-Controllers-PSV-2020-0268
CVE: CVE-2020-13955
Published: 2020-10-09
Description: HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://lists.apache.org/thread.html/r0b0fbe[PII_REDACTED]951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3E; https://lists.apache.org/thread.html/r0b0fbe[PII_REDACTED]951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3E
CVE: CVE-2020-9105
Published: 2020-10-09
Description: Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an insufficient input validation vulnerability. Due to the input validation logic is incorrect, an attacker can exploit this vulnerability to access and modify the memory of the device by doing a series of operations. Successful exploit may cause the service abnormal.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200923-01-outofbound-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200923-01-outofbound-en
CVE: CVE-2020-26932
Published: 2020-10-10
Description: debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://bugs.debian.org/971904; https://salsa.debian.org/sympa-team/sympa/-/merge_requests/1; https://www.debian.org/security/2020/dsa-4818
CVE: CVE-2020-26934
Published: 2020-10-10
Description: phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html
CVE: CVE-2020-26935
Published: 2020-10-10
Description: An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html; https://advisory.checkmarx.net/advisory/CX-2020-4281
CVE: CVE-2020-26945
Published: 2020-10-10
Description: MyBatis before 3.5.6 mishandles deserialization of object streams.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/mybatis/mybatis-3/compare/mybatis-3.5.5...mybatis-3.5.6; https://github.com/mybatis/mybatis-3/pull/2079; https://github.com/mybatis/mybatis-3/compare/mybatis-3.5.5...mybatis-3.5.6
CVE: CVE-2020-26947
Published: 2020-10-10
Description: monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users to gain privileges via a Trojan horse library in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/monero-project/monero-gui/commit/6ed536982953d870010d8fa065dccbffeb6cae50; https://github.com/monero-project/monero-gui/issues/3142#issuecomment-705940446; https://github.com/monero-project/monero-gui/commit/6ed536982953d870010d8fa065dccbffeb6cae50
CVE: CVE-2020-26948
Published: 2020-10-10
Description: Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/btnz-k/emby_ssrf; https://github.com/btnz-k/emby_ssrf/blob/master/emby_scan.rb; https://github.com/btnz-k/emby_ssrf
CVE: CVE-2020-14184
Published: 2020-10-12
Description: Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-71652; https://jira.atlassian.com/browse/JRASERVER-71652
CVE: CVE-2020-5133
Published: 2020-10-12
Description: A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due to buffer overflow, which leads to a firewall crash. This vulnerability affected SonicOS Gen 6 version 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0008; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0008
CVE: CVE-2020-5134
Published: 2020-10-12
Description: A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash. This vulnerability affected SonicOS Gen 6 version 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0009; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0009
CVE: CVE-2020-5135
Published: 2020-10-12
Description: A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0010; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0010; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5135
CVE: CVE-2020-5136
Published: 2020-10-12
Description: A buffer overflow vulnerability in SonicOS allows an authenticated attacker to cause Denial of Service (DoS) in the SSL-VPN and virtual assist portal, which leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0011; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0011
CVE: CVE-2020-5137
Published: 2020-10-12
Description: A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0012
CVE: CVE-2020-5138
Published: 2020-10-12
Description: A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to SonicOS crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0013; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0013
CVE: CVE-2020-5139
Published: 2020-10-12
Description: A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of Invalid pointer and leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-763, CWE-763
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0014; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0014
CVE: CVE-2020-5140
Published: 2020-10-12
Description: A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP request that leads to memory addresses leak. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0015; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0015
CVE: CVE-2020-5141
Published: 2020-10-12
Description: A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-799, CWE-307
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0016; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0016
CVE: CVE-2020-5142
Published: 2020-10-12
Description: A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in the firewall SSLVPN portal. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0017; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0017
CVE: CVE-2020-5143
Published: 2020-10-12
Description: SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0018; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0018
CVE: CVE-2020-4660
Published: 2020-10-12
Description: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186140.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186140; https://www.ibm.com/support/pages/node/6346619; https://exchange.xforce.ibmcloud.com/vulnerabilities/186140
CVE: CVE-2020-4661
Published: 2020-10-12
Description: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186142.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186142; https://www.ibm.com/support/pages/node/6346619; https://exchange.xforce.ibmcloud.com/vulnerabilities/186142
CVE: CVE-2020-4699
Published: 2020-10-12
Description: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186947.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186947; https://www.ibm.com/support/pages/node/6346619; https://exchange.xforce.ibmcloud.com/vulnerabilities/186947
CVE: CVE-2020-4772
Published: 2020-10-12
Description: An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 189150.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189150; https://www.ibm.com/support/pages/node/6344069; https://exchange.xforce.ibmcloud.com/vulnerabilities/189150
CVE: CVE-2020-4773
Published: 2020-10-12
Description: A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no impact to remainder of web application. IBM X-Force ID: 189151.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189151; https://www.ibm.com/support/pages/node/6344097; https://exchange.xforce.ibmcloud.com/vulnerabilities/189151
CVE: CVE-2020-4774
Published: 2020-10-12
Description: An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information such as XML document structure and content. IBM X-Force ID: 189152.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-91
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189152; https://www.ibm.com/support/pages/node/6346595; https://exchange.xforce.ibmcloud.com/vulnerabilities/189152
CVE: CVE-2020-4775
Published: 2020-10-12
Description: A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IBM X-Force ID: 189153.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189153; https://www.ibm.com/support/pages/node/6346571; https://exchange.xforce.ibmcloud.com/vulnerabilities/189153