deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3119
Published: 2020-01-31
Description: Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/web2project/web2project/commit/ab5ba92a6aaf0435cd0b2132cf7f9b7b41575a28; https://github.com/web2project/web2project/commit/eead99b36f62a8222d9f3a913f1a[PII_REDACTED]ef; https://www.htbridge.com/advisory/HTB23213
CVE: CVE-2016-2033
Published: 2020-01-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was associated with multiple vulnerabilities. Notes: non
CVE: CVE-2013-3565
Published: 2020-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://git.videolan.org/gitweb.cgi/vlc.git/?p=vlc.git%3Ba=commitdiff%3Bh=bf02b8dd211d5a52aa301a9a2ff4e73ed8195881; http://lists.opensuse.org/opensuse-updates/2014-03/msg00001.html; http://www.videolan.org/developers/vlc-branch/NEWS
CVE: CVE-2014-3809
Published: 2020-01-31
Description: Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.securityfocus.com/archive/1/534124; https://www.securityfocus.com/archive/1/534124
CVE: CVE-2014-3868
Published: 2020-01-31
Description: Multiple SQL injection vulnerabilities in ZeusCart 4.x.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127196/ZeusCart-4.x-Remote-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Jun/116; http://www.securityfocus.com/bid/68182
CVE: CVE-2014-5039
Published: 2020-01-31
Description: Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://groups.google.com/a/eucalyptus.com/forum/#%21topic/security-announce/U4AbkOgpQSA; https://groups.google.com/a/eucalyptus.com/forum/#%21topic/security-announce/U4AbkOgpQSA
CVE: CVE-2014-5236
Published: 2020-01-31
Description: Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf; http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded
CVE: CVE-2014-8126
Published: 2020-01-31
Description: The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2015-0035.html; http://rhn.redhat.com/errata/RHSA-2015-0036.html; https://bugzilla.redhat.com/show_bug.cgi?id=1169800
CVE: CVE-2014-8139
Published: 2020-01-31
Description: Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.ocert.org/advisories/ocert-2014-011.html; http://www.securitytracker.com/id/1031433; https://access.redhat.com/errata/RHSA-2015:0700
CVE: CVE-2014-8140
Published: 2020-01-31
Description: Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.ocert.org/advisories/ocert-2014-011.html; http://www.securitytracker.com/id/1031433; https://access.redhat.com/errata/RHSA-2015:0700
CVE: CVE-2014-8321
Published: 2020-01-31
Description: Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://aircrack-ng.blogspot.com/2014/10/aircrack-ng-12-release-candidate-1.html; http://packetstormsecurity.com/files/128943/Aircrack-ng-1.2-Beta-3-DoS-Code-Execution.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/98458
CVE: CVE-2014-8322
Published: 2020-01-31
Description: Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://aircrack-ng.blogspot.com/2014/10/aircrack-ng-12-release-candidate-1.html; http://packetstormsecurity.com/files/128943/Aircrack-ng-1.2-Beta-3-DoS-Code-Execution.html; http://www.exploit-db.com/exploits/35018
CVE: CVE-2014-8338
Published: 2020-01-31
Description: Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/128997/Drupal-7-Videowhisper-Cross-Site-Scripting.html; https://www.securityfocus.com/archive/1/533921; https://packetstormsecurity.com/files/128997/Drupal-7-Videowhisper-Cross-Site-Scripting.html
CVE: CVE-2015-6815
Published: 2020-01-31
Description: The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-835
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html
CVE: CVE-2[PII_REDACTED]
Published: 2020-01-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-8504
Published: 2020-01-31
Description: School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/J3rryBl4nks/SchoolERPCSRF; https://github.com/J3rryBl4nks/SchoolERPCSRF
CVE: CVE-2020-8505
Published: 2020-01-31
Description: School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/J3rryBl4nks/SchoolERPCSRF; https://github.com/J3rryBl4nks/SchoolERPCSRF
CVE: CVE-2014-2025
Published: 2020-01-31
Description: Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.christian-schneider.net/advisories/CVE-2014-2025.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/99568; https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=2EBBF802B1970FE31EFC8A34108DF3F47E7A8EEC&rq_RecId=31&rq_SourceAppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_SourcePageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018&rq_SourceRecId=31
CVE: CVE-2014-8141
Published: 2020-01-31
Description: Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.ocert.org/advisories/ocert-2014-011.html; http://www.securitytracker.com/id/1031433; https://access.redhat.com/errata/RHSA-2015:0700
CVE: CVE-2020-8512
Published: 2020-02-01
Description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156103/IceWarp-WebMail-11.4.4.1-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/156103/IceWarp-WebMail-11.4.4.1-Cross-Site-Scripting.html
CVE: CVE-2020-8515
Published: 2020-02-01
Description: DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html; https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/
CVE: CVE-2020-8516
Published: 2020-02-02
Description: The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html; https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html; https://security-tracker.debian.org/tracker/CVE-2020-8516
CVE: CVE-2019-20446
Published: 2020-02-02
Description: In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00024.html; https://gitlab.gnome.org/GNOME/librsvg/issues/515; https://lists.debian.org/debian-lts-announce/2020/07/msg00016.html
CVE: CVE-2020-8514
Published: 2020-02-02
Description: An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/3YdFZCKe; https://www.maxum.com/Rumpus/Download.html; https://pastebin.com/3YdFZCKe
CVE: CVE-2020-8508
Published: 2020-02-03
Description: nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://downwithup.github.io/CVEPosts.html; https://downwithup.github.io/CVEPosts.html
CVE: CVE-2020-3925
Published: 2020-02-03
Description: A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.
CVSS Score: 8.3 (HIGH)
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910005; https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce; https://tvn.twcert.org.tw/taiwanvn/TVN-201910005
CVE: CVE-2020-3926
Published: 2020-02-03
Description: An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-552
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910006; https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce; https://tvn.twcert.org.tw/taiwanvn/TVN-201910006
CVE: CVE-2020-3927
Published: 2020-02-03
Description: An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
CVSS Score: 8.3 (HIGH)
CWE: CWE-552
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910007; https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce; https://tvn.twcert.org.tw/taiwanvn/TVN-201910007
CVE: CVE-2020-7471
Published: 2020-02-03
Description: Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2020/02/03/1; https://docs.djangoproject.com/en/3.0/releases/security/; https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136
CVE: CVE-2014-8328
Published: 2020-02-03
Description: The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/extensions/repository/view/dce; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/; https://exchange.xforce.ibmcloud.com/vulnerabilities/97673
CVE: CVE-2019-18193
Published: 2020-02-03
Description: In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4.0.125 and 5.0.013.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=52; https://www.unisys.com/offerings/security-solutions/unisys-stealth-products-and-services; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=52
CVE: CVE-2013-2621
Published: 2020-02-03
Description: Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/60290; https://exchange.xforce.ibmcloud.com/vulnerabilities/84683; https://www.isecauditors.com/advisories-2013#2013-009
CVE: CVE-2013-2622
Published: 2020-02-03
Description: Cross-site Scripting (XSS) in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selected_theme" parameter in error.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/87807; https://packetstormsecurity.com/files/123557/Uebimiau-2.7.11-Cross-Site-Scripting-Open-Redirection.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/87807
CVE: CVE-2013-2623
Published: 2020-02-03
Description: Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter in index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/60288; https://exchange.xforce.ibmcloud.com/vulnerabilities/84684; https://www.isecauditors.com/advisories-2013#2013-009
CVE: CVE-2013-2624
Published: 2020-02-03
Description: Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafted URL request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/84685; https://www.isecauditors.com/advisories-2013#2013-009; https://exchange.xforce.ibmcloud.com/vulnerabilities/84685
CVE: CVE-2013-2631
Published: 2020-02-03
Description: TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twg_browserx" and "twg_browsery" in the page image.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://packetstormsecurity.com/files/121128/TinyWebGallery-1.8.9-Path-Disclosure.html; https://www.isecauditors.com/advisories-2013#2013-012; https://packetstormsecurity.com/files/121128/TinyWebGallery-1.8.9-Path-Disclosure.html
CVE: CVE-2019-11256
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11257
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11258
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11259
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11260
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11261
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11262
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11263
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11264
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11265
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11266
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-11267
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019
CVE: CVE-2019-19119
Published: 2020-02-03
Description: An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, a non-administrative user on the local machine is able to access administrative credentials.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://blog.paessler.com; https://blog.paessler.com/prtg-release-19.4.54-includes-2-brand-new-sensors-for-disk-and-storage; https://www.paessler.com/prtg/history/preview
CVE: CVE-2020-7993
Published: 2020-02-03
Description: Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/prototypejs/prototype/blob/master/CHANGELOG; https://medium.com/%40vbharad/improper-access-control-vulnerability-in-prototype-1-6-0-1-framework-379cc3a05079; https://github.com/prototypejs/prototype/blob/master/CHANGELOG
CVE: CVE-2020-8510
Published: 2020-02-03
Description: An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as any user without a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://0xem.ma/cve/2020/01/31/CVE-2020-8510.html; https://sourceforge.net/p/phpabook/news/; https://0xem.ma/cve/2020/01/31/CVE-2020-8510.html
CVE: CVE-2019-11251
Published: 2020-02-03
Description: The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://github.com/kubernetes/kubernetes/issues/87773; https://groups.google.com/d/msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ; https://github.com/kubernetes/kubernetes/issues/87773
CVE: CVE-2020-8545
Published: 2020-02-03
Description: Global.py in AIL framework 2.8 allows path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/CIRCL/AIL-framework/commit/e808840f957c810b8e3944cba808716dc722581b; https://github.com/CIRCL/AIL-framework/commit/e808840f957c810b8e3944cba808716dc722581b
CVE: CVE-2020-8547
Published: 2020-02-03
Description: phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
CVSS Score: 9.8 (CRITICAL)
References: https://www.exploit-db.com/exploits/47989; https://www.exploit-db.com/exploits/47989
CVE: CVE-2013-2646
Published: 2020-02-03
Description: TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://www.securityfocus.com/bid/59472; https://www.securityfocus.com/bid/59472
CVE: CVE-2013-2672
Published: 2020-02-03
Description: Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/84094; http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html