deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7453
Published: 2020-04-29
Description: In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE-p7, a missing null termination check in the jail_set configuration option "osrelease" may return more bytes with a subsequent jail_get system call allowing a malicious jail superuser with permission to create nested jails to read kernel memory.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-754
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:08.jail.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:08.jail.asc
CVE: CVE-2020-8472
Published: 2020-04-29
Description: Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8473
Published: 2020-04-29
Description: Insufficient folder permissions used by system functions in ABB System 800xA Base (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploit the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732, CWE-732
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-12443
Published: 2020-04-29
Description: BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/bigbluebutton/bigbluebutton/pull/9259/commits/b21ca8355a57286a1e6df96984b3a4c57679a463; https://github.com/mclab-hbrs/BBB-POC; https://github.com/bigbluebutton/bigbluebutton/pull/9259/commits/b21ca8355a57286a1e6df96984b3a4c57679a463
CVE: CVE-2020-8471
Published: 2020-04-29
Description: For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, weak file permissions allow an authenticated attacker to block the license handling, escalate his/her privileges and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-275, CWE-276
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch; https://www.us-cert.gov/ics/advisories/icsa-20-154-04
CVE: CVE-2020-8475
Published: 2020-04-29
Description: For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8476
Published: 2020-04-29
Description: For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to alter licenses assigned to the system nodes by sending specially crafted messages to the CLS web service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8478
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl (all published versions) enables an attacker authenticated on the local system to inject data, affecting the online view of runtime data shown in Control Builder.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264, CWE-74
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8479
Published: 2020-04-29
Description: For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5. an XML External Entity Injection vulnerability exists that allows an attacker to read or call arbitrary files from the license server and/or from the network and also block the license handling.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-91, CWE-91
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8481
Published: 2020-04-29
Description: For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-922
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8484
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8485
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8486
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker authenticated on the local system to inject data, affect node redundancy handling.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8487
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker authenticated on the local system to inject data, affect node redundancy handling.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8488
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-8489
Published: 2020-04-29
Description: Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management history services unavailable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19100
Published: 2020-04-29
Description: A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/; https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/
CVE: CVE-2019-19101
Published: 2020-04-29
Description: A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.5SP, < 4.6.4 and < 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-295
References: https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/; https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/
CVE: CVE-2019-19102
Published: 2020-04-29
Description: A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/; https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/
CVE: CVE-2020-12447
Published: 2020-04-29
Description: A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0[PII_REDACTED]-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.spookysec.net/onkyo-lfi/; https://blog.spookysec.net/onkyo-lfi/
CVE: CVE-2020-3955
Published: 2020-04-29
Description: ESXi 6.5 without patch ESXi[PII_REDACTED]04-SG and ESXi 6.7 without patch ESXi[PII_REDACTED]03-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2020-0008.html; https://www.vmware.com/security/advisories/VMSA-2020-0008.html
CVE: CVE-2019-20792
Published: 2020-04-29
Description: OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-415
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208; https://github.com/OpenSC/OpenSC/commit/c246f6f69a749d4f68626b40795a4f69168008f4; https://github.com/OpenSC/OpenSC/compare/0.19.0...0.20.0
CVE: CVE-2019-16652
Published: 2020-04-29
Description: The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
References: https://www2.deloitte.com/it/it/pages/risk/articles/security-advisory-article---deloitte-italy---risk.html; https://www2.deloitte.com/it/it/pages/risk/articles/security-advisory-article---deloitte-italy---risk.html
CVE: CVE-2019-7634
Published: 2020-04-29
Description: SUAP V2 allows XSS during the update of user information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40crhenr/cve-2019-7634-my-first-cve-61db875dc94a; https://medium.com/%40crhenr/cve-2019-7634-my-first-cve-61db875dc94a
CVE: CVE-2020-11884
Published: 2020-04-29
Description: In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=215d1f3928713d6eaec67244bcda72105b898000; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f777e19d171670ab558a6d5e6b1ac7f9b6c574f; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TZBP2HINNAX7HKHCOUMIFVQPV6GWMCZ/
CVE: CVE-2020-12246
Published: 2020-04-29
Description: Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://medium.com/%40Pavel.Step/security-analysis-of-the-smart-box-router-932f86dc8a9e; https://yadi.sk/i/YdfXr-ofAN2ZWA; https://yadi.sk/i/iIUCJVaGEuSaAw
CVE: CVE-2017-18853
Published: 2020-04-29
Description: Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2200v4 1.0.0.82 and earlier, R6300v2 1.0.4.06 and earlier, R6400 1.0.1.20 and earlier, R6400v2 1.0.2.18 and earlier, R6700 1.0.1.22 and earlier, R6900 1.0.1.20 and earlier, R7000 1.0.7.10 and earlier, R7000P 1.0.0.58 and earlier, R7100LG 1.0.0.28 and earlier, R7300DST 1.0.0.52 and earlier, R7900 1.0.1.12 and earlier, R8000 1.0.3.46 and earlier, R8300 1.0.2.86 and earlier, R8500 1.0.2.86 and earlier, WNDR3400v3 1.0.1.8 and earlier, and WNDR4500v2 1.0.0.62 and earlier.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://kb.netgear.com/000045848/Security-Advisory-for-Password-Recovery-and-File-Access-on-Some-Routers-and-Modem-Routers-PSV-2017-0677; https://kb.netgear.com/000045848/Security-Advisory-for-Password-Recovery-and-File-Access-on-Some-Routers-and-Modem-Routers-PSV-2017-0677
CVE: CVE-2017-18854
Published: 2020-04-29
Description: NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74
References: https://kb.netgear.com/000044333/Security-Advisory-for-Operating-System-Command-Injection-on-ReadyNAS-OS-6-Storage-Systems-PSV-2017-2002; https://kb.netgear.com/000044333/Security-Advisory-for-Operating-System-Command-Injection-on-ReadyNAS-OS-6-Storage-Systems-PSV-2017-2002
CVE: CVE-2017-18855
Published: 2020-04-29
Description: NETGEAR WNR854T devices before 1.5.2 are affected by command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://kb.netgear.com/000038833/Security-Advisory-for-Unauthenticated-Command-Execution-on-WNR854T-PSV-2017-2317; https://kb.netgear.com/000038833/Security-Advisory-for-Unauthenticated-Command-Execution-on-WNR854T-PSV-2017-2317
CVE: CVE-2017-18856
Published: 2020-04-29
Description: NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74
References: https://kb.netgear.com/000044333/Security-Advisory-for-Operating-System-Command-Injection-on-ReadyNAS-OS-6-Storage-Systems-PSV-2017-2002; https://kb.netgear.com/000044333/Security-Advisory-for-Operating-System-Command-Injection-on-ReadyNAS-OS-6-Storage-Systems-PSV-2017-2002
CVE: CVE-2017-18860
Published: 2020-04-29
Description: Certain NETGEAR devices are affected by debugging command execution. This affects FS752TP 5.4.2.19 and earlier, GS108Tv2 5.4.2.29 and earlier, GS110TP 5.4.2.29 and earlier, GS418TPP 6.6.2.6 and earlier, GS510TLP 6.6.2.6 and earlier, GS510TP 5.04.2.27 and earlier, GS510TPP 6.6.2.6 and earlier, GS716Tv2 5.4.2.27 and earlier, GS716Tv3 6.3.1.16 and earlier, GS724Tv3 5.4.2.27 and earlier, GS724Tv4 6.3.1.16 and earlier, GS728TPSB 5.3.0.29 and earlier, GS728TSB 5.3.0.29 and earlier, GS728TXS 6.1.0.35 and earlier, GS748Tv4 5.4.2.27 and earlier, GS748Tv5 6.3.1.16 and earlier, GS752TPSB 5.3.0.29 and earlier, GS752TSB 5.3.0.29 and earlier, GS752TXS 6.1.0.35 and earlier, M4200 12.0.2.10 and earlier, M4300 12.0.2.10 and earlier, M5300 11.0.0.28 and earlier, M6100 11.0.0.28 and earlier, M7100 11.0.0.28 and earlier, S3300 6.6.1.4 and earlier, XS708T 6.6.0.11 and earlier, XS712T 6.1.0.34 and earlier, and XS716T 6.6.0.11 and earlier.
CVSS Score: 7.7 (HIGH)
CWE: CWE-74
References: https://kb.netgear.com/000038519/Security-Advisory-for-Authentication-Bypass-and-Remote-Command-Execution-on-Some-Smart-and-Managed-Switches-PSV-2017-0857; https://kb.netgear.com/000038519/Security-Advisory-for-Authentication-Bypass-and-Remote-Command-Execution-on-Some-Smart-and-Managed-Switches-PSV-2017-0857
CVE: CVE-2018-21232
Published: 2020-04-29
Description: re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://www.openwall.com/lists/oss-security/2020/05/14/4; https://github.com/skvadrik/re2c/issues/219; https://www.openwall.com/lists/oss-security/2020/04/27/2
CVE: CVE-2019-16653
Published: 2020-04-29
Description: An application plugin in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to gain admin privileges.
CVSS Score: 8.8 (HIGH)
References: https://www2.deloitte.com/it/it/pages/risk/articles/security-advisory-article---deloitte-italy---risk.html; https://www2.deloitte.com/it/it/pages/risk/articles/security-advisory-article---deloitte-italy---risk.html
CVE: CVE-2019-20781
Published: 2020-04-29
Description: An issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/