deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4650
Published: 2020-02-20
Description: The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://bugs.python.org/issue21766; http://openwall.com/lists/oss-security/2014/06/26/3; https://access.redhat.com/security/cve/cve-2014-4650
CVE: CVE-2015-4410
Published: 2020-02-20
Description: The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.html; http://www.openwall.com/lists/oss-security/2015/06/06/3
CVE: CVE-2015-4411
Published: 2020-02-20
Description: The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.html; http://www.openwall.com/lists/oss-security/2015/06/06/3
CVE: CVE-2019-4583
Published: 2020-02-20
Description: IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167289; https://www.ibm.com/support/pages/node/3002121; https://exchange.xforce.ibmcloud.com/vulnerabilities/167289
CVE: CVE-2019-4752
Published: 2020-02-20
Description: IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 173348.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/173348; https://www.ibm.com/support/pages/node/2948919; https://www.ibm.com/support/pages/node/2950269
CVE: CVE-2011-0699
Published: 2020-02-20
Description: Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted slot value.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-787
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]8425&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]9620&w=2; http://vulnfactory.org/vulns/
CVE: CVE-2011-4915
Published: 2020-02-20
Description: fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0499680a42141d86417a8fbaa8c8db806bea1201; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a2ef990ab5a6705a356d146dd773a3b359787497; http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-4915.html
CVE: CVE-2012-2599
Published: 2020-02-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-3835. Reason: This issue was MERGED into CVE-2012-3835 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2012-3835 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-3351
Published: 2020-02-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) logo.link, or (3) aboutlink parameter, or a nested URI scheme name for (4) javascript, (5) asfunction, or (6) vbscript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://developer.longtailvideo.com/trac/ticket/1585; http://technet.microsoft.com/security/msvr/msvr12-009; https://www.exploit-db.com/exploits/37552
CVE: CVE-2014-4019
Published: 2020-02-20
Description: ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html; http://www.exploit-db.com/exploits/33803; http://www.osvdb.org/102668
CVE: CVE-2012-5236
Published: 2020-02-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2014-3557
Published: 2020-02-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-9283
Published: 2020-02-20
Description: golang.org/x/crypto before v0.0.0[PII_REDACTED]3623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html; https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY; https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
CVE: CVE-2020-3764
Published: 2020-02-20
Description: Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-10.html; https://www.zerodayinitiative.com/advisories/ZDI-20-331/; https://www.zerodayinitiative.com/advisories/ZDI-20-332/
CVE: CVE-2020-3765
Published: 2020-02-20
Description: Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb20-09.html; https://helpx.adobe.com/security/products/after_effects/apsb20-09.html
CVE: CVE-2020-6968
Published: 2020-02-20
Description: Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.us-cert.gov/ics/advisories/icsa-20-049-01; https://www.us-cert.gov/ics/advisories/icsa-20-049-01
CVE: CVE-2020-6977
Published: 2020-02-20
Description: A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE Ultrasound Products: Vivid products - all versions; LOGIQ - all versions not including LOGIQ 100 Pro; Voluson - all versions; Versana Essential - all versions; Invenia ABUS Scan station - all versions; Venue - all versions not including Venue 40 R1-3 and Venue 50 R4-5
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-693, CWE-20
References: https://www.us-cert.gov/ics/advisories/icsma-20-049-02; https://www.us-cert.gov/ics/advisories/icsma-20-049-02
CVE: CVE-2020-9318
Published: 2020-02-20
Description: Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuring the SNMP alert settings in the UI. This is fixed in 9.2.15.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.red-gate.com/privacy-and-security/vulnerabilities/2020-02-19-sql-monitor; https://www.red-gate.com/privacy-and-security/vulnerabilities/2020-02-19-sql-monitor
CVE: CVE-2019-11189
Published: 2020-02-20
Description: Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet injection. To exploit the vulnerability, an attacker sends a gratuitous ARP reply that causes the host mobility application to remove existing access control flow denial rules in the network. The access control application does not re-install flow deny rules, so the attacker can bypass the intended access control policy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2019-16297
Published: 2020-02-20
Description: An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p4tutorial), the host event listener does not handle the following event types: HOST_MOVED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2019-16298
Published: 2020-02-20
Description: An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.virtualbng), the host event listener does not handle the following event types: HOST_MOVED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2019-16299
Published: 2020-02-20
Description: An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host event listener does not handle the following event types: HOST_ADDED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2019-16300
Published: 2020-02-20
Description: An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosproject.acl), the host event listener does not handle the following event types: HOST_REMOVED. In combination with other applications, this could lead to the absence of intended code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2019-16301
Published: 2020-02-20
Description: An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.onosproject.vtn), the host event listener does not handle the following event types: HOST_MOVED. In combination with other applications, this could lead to the absence of intended code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2019-16302
Published: 2020-02-20
Description: An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.evpnopenflow), the host event listener does not handle the following event types: HOST_MOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf; https://www.ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf
CVE: CVE-2020-8990
Published: 2020-02-20
Description: Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-384
References: https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads; https://www.westerndigital.com/support/productsecurity/wdc-19013-my-cloud-home-and-ibi-session-invalidation-vulnerability; https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads
CVE: CVE-2020-9003
Published: 2020-02-20
Description: A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/zeroday/FG-VD-20-041; https://github.com/MachoThemes/modula-lite/blob/master/changelog.txt; https://wordpress.org/plugins/modula-best-grid-gallery/
CVE: CVE-2020-9015
Published: 2020-02-20
Description: Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/158119/Arista-Restricted-Shell-Escape-Privilege-Escalation.html; https://eos.arista.com/arista-eos-is-not-vulnerable-to-cve-2020-9015/; https://securitybytes.me
CVE: CVE-2020-9320
Published: 2020-02-20
Description: Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, Antivirus for Small Business, Exchange Security (Gateway), Internet Security Suite for Windows, Prime, Free Security Suite for Windows, and Cross Platform Anti-malware SDK. NOTE: Vendor asserts that vulnerability does not exist in product
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: http://packetstormsecurity.com/files/156472/AVIRA-Generic-Malformed-Container-Bypass.html; http://seclists.org/fulldisclosure/2020/Feb/31; https://blog.zoller.lu/p/from-low-hanging-fruit-department-avira.html
CVE: CVE-2019-14688
Published: 2020-02-20
Description: Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://success.trendmicro.com/solution/1123562; https://success.trendmicro.com/solution/1123562
CVE: CVE-2019-19694
Published: 2020-02-20
Description: The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the entire product completely..
CVSS Score: 4.7 (MEDIUM)
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124056.aspx; https://esupport.trendmicro.com/support/vb/solution/ja-jp/1124058.aspx; https://jvn.jp/en/jp/JVN02921757/
CVE: CVE-2020-5242
Published: 2020-02-20
Description: openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284, CWE-863
References: https://github.com/openhab/openhab-addons/commit/4c4cb664f2e2c3866aadf117d22fb54aa8dd0031; https://github.com/openhab/openhab-addons/security/advisories/GHSA-w698-693g-23hv; https://github.com/openhab/openhab-addons/commit/4c4cb664f2e2c3866aadf117d22fb54aa8dd0031
CVE: CVE-2020-8601
Published: 2020-02-20
Description: Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located in the same directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://success.trendmicro.com/solution/000241963; https://success.trendmicro.com/solution/000241963
CVE: CVE-2020-8960
Published: 2020-02-20
Description: Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads; https://www.westerndigital.com/support/productsecurity/wdc-20003-mycloud-site-version-2-2-0-134; https://www.westerndigital.com/support/productsecurity/wdc-20003-mycloud-xss-vulnerability
CVE: CVE-2020-5243
Published: 2020-02-21
Description: uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-1333
References: https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1; https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p; https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1
CVE: CVE-2014-7914
Published: 2020-02-21
Description: btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/0360aa7c418152a3e5e335a065ac3629cbb09559; https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/0360aa7c418152a3e5e335a065ac3629cbb09559
CVE: CVE-2016-4606
Published: 2020-02-21
Description: Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858; https://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
CVE: CVE-2020-5524
Published: 2020-02-21
Description: Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv20-003.html; https://jvn.jp/en/jp/JVN49410695/index.html; https://jvn.jp/en/jp/JVN25766797/
CVE: CVE-2020-5525
Published: 2020-02-21
Description: Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv20-003.html; https://jvn.jp/en/jp/JVN49410695/index.html; https://jpn.nec.com/security-info/secinfo/nv20-003.html
CVE: CVE-2020-5533
Published: 2020-02-21
Description: Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jpn.nec.com/security-info/secinfo/nv20-003.html; https://jvn.jp/en/jp/JVN49410695/index.html; https://jpn.nec.com/security-info/secinfo/nv20-003.html
CVE: CVE-2020-5534
Published: 2020-02-21
Description: Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv20-003.html; https://jvn.jp/en/jp/JVN49410695/index.html; https://jpn.nec.com/security-info/secinfo/nv20-003.html
CVE: CVE-2019-19452
Published: 2020-02-21
Description: A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integrity processes) can exploit this to gain NT AUTHORITY\SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.coresecurity.com/advisories/viper-rgb-driver-multiple-vulnerabilities; https://www.viper.patriotmemory.com; https://www.coresecurity.com/advisories/viper-rgb-driver-multiple-vulnerabilities
CVE: CVE-2020-5324
Published: 2020-02-21
Description: Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.
CVSS Score: 7.1 (HIGH)
CWE: CWE-427, CWE-59
References: https://www.dell.com/support/article/SLN320348; https://www.dell.com/support/article/SLN320348
CVE: CVE-2020-5326
Published: 2020-02-21
Description: Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.dell.com/support/article/SLN320337; https://www.dell.com/support/article/SLN320337
CVE: CVE-2012-0063
Published: 2020-02-21
Description: Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbitrary code ith the permissions of the user running tucan.
CVSS Score: 8.1 (HIGH)
References: http://www.openwall.com/lists/oss-security/2012/01/19/5; https://access.redhat.com/security/cve/cve-2012-0063; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0063