deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10784
Published: 2020-02-04
Description: phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit a malicious page with a CSRF exploit and execute arbitrary system commands on the server.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://snyk.io/vuln/SNYK-PHP-PHPPGADMINPHPPGADMIN-543885; https://snyk.io/vuln/SNYK-PHP-PHPPGADMINPHPPGADMIN-543885
CVE: CVE-2015-3611
Published: 2020-02-04
Description: A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/74444; http://www.securitytracker.com/id/1032188; https://fortiguard.com/psirt/FG-IR-15-011
CVE: CVE-2015-3612
Published: 2020-02-04
Description: A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/74444; http://www.securitytracker.com/id/1032188; https://fortiguard.com/psirt/FG-IR-15-011
CVE: CVE-2015-3613
Published: 2020-02-04
Description: A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.securityfocus.com/bid/74444; http://www.securitytracker.com/id/1032188; https://fortiguard.com/psirt/FG-IR-15-011
CVE: CVE-2019-15610
Published: 2020-02-04
Description: Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://hackerone.com/reports/673724; https://nextcloud.com/security/advisory/?id=NC-SA-2019-013; https://hackerone.com/reports/673724
CVE: CVE-2019-15611
Published: 2020-02-04
Description: Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-657
References: https://hackerone.com/reports/672623; https://nextcloud.com/security/advisory/?id=NC-SA-2019-017; https://hackerone.com/reports/672623
CVE: CVE-2019-15612
Published: 2020-02-04
Description: A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://hackerone.com/reports/486693; https://nextcloud.com/security/advisory/?id=NC-SA-2020-001; https://hackerone.com/reports/486693
CVE: CVE-2019-15613
Published: 2020-02-04
Description: A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-345
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html; https://hackerone.com/reports/697959
CVE: CVE-2019-15614
Published: 2020-02-04
Description: Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/575562; https://nextcloud.com/security/advisory/?id=NC-SA-2020-003; https://hackerone.com/reports/575562
CVE: CVE-2019-15615
Published: 2020-02-04
Description: A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284, CWE-287
References: https://hackerone.com/reports/747726; https://nextcloud.com/security/advisory/?id=NC-SA-2020-004; https://hackerone.com/reports/747726
CVE: CVE-2019-15616
Published: 2020-02-04
Description: Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-93, CWE-74
References: https://hackerone.com/reports/592864; https://nextcloud.com/security/advisory/?id=NC-SA-2020-005; https://hackerone.com/reports/592864
CVE: CVE-2019-15617
Published: 2020-02-04
Description: A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://hackerone.com/reports/722748; https://nextcloud.com/security/advisory/?id=NC-SA-2020-006; https://hackerone.com/reports/722748
CVE: CVE-2019-15618
Published: 2020-02-04
Description: Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/515484; https://nextcloud.com/security/advisory/?id=NC-SA-2020-007; https://hackerone.com/reports/515484
CVE: CVE-2019-15619
Published: 2020-02-04
Description: Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/662204; https://nextcloud.com/security/advisory/?id=NC-SA-2020-008; https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
CVE: CVE-2019-15620
Published: 2020-02-04
Description: Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.
CVSS Score: 2.7 (LOW)
CWE: CWE-287
References: https://hackerone.com/reports/662218; https://nextcloud.com/security/advisory/?id=NC-SA-2020-011; https://hackerone.com/reports/662218
CVE: CVE-2019-15621
Published: 2020-02-04
Description: Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html; https://hackerone.com/reports/619484
CVE: CVE-2019-15622
Published: 2020-02-04
Description: Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
CVSS Score: 2.4 (LOW)
CWE: CWE-89, CWE-89
References: https://hackerone.com/reports/518669; https://nextcloud.com/security/advisory/?id=NC-SA-2019-011; https://hackerone.com/reports/518669
CVE: CVE-2019-15623
Published: 2020-02-04
Description: Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html; https://hackerone.com/reports/508490
CVE: CVE-2019-15624
Published: 2020-02-04
Description: Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html; https://hackerone.com/reports/508493
CVE: CVE-2020-6058
Published: 2020-02-04
Description: An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trigger an out-of-bounds memory read, which can result in the disclosure of sensitive information and denial of service. To trigger this vulnerability, an attacker needs to send a specially crafted packet to the vulnerable server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-0975; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0975
CVE: CVE-2020-6059
Published: 2020-02-04
Description: An exploitable out of bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trigger an out of bounds memory read which can result in sensitive information disclosure and Denial Of Service. In order to trigger this vulnerability, an attacker needs to send a specially crafted packet to the vulnerable server.
CVSS Score: 8.2 (HIGH)
CWE: CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0976; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-0976; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0976
CVE: CVE-2020-6060
Published: 2020-02-04
Description: A stack buffer overflow vulnerability exists in the way MiniSNMPD version 1.4 handles multiple connections. A specially timed sequence of SNMP connections can trigger a stack overflow, resulting in a denial of service. To trigger this vulnerability, an attacker needs to simply initiate multiple connections to the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0977; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-0977; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0977
CVE: CVE-2020-8115
Published: 2020-02-04
Description: A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/775693; https://www.revive-adserver.com/security/revive-sa-2020-001/; https://hackerone.com/reports/775693
CVE: CVE-2020-8116
Published: 2020-02-04
Description: Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
CVSS Score: 7.3 (HIGH)
CWE: CWE-471, CWE-1321
References: https://github.com/advisories/GHSA-ff7x-qrg7-qggm; https://github.com/sindresorhus/dot-prop/issues/63; https://github.com/sindresorhus/dot-prop/tree/v4
CVE: CVE-2020-8117
Published: 2020-02-04
Description: Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280, CWE-281
References: https://hackerone.com/reports/439828; https://nextcloud.com/security/advisory/?id=NC-SA-2020-013; https://hackerone.com/reports/439828
CVE: CVE-2020-8118
Published: 2020-02-04
Description: An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html; https://hackerone.com/reports/427835
CVE: CVE-2020-8119
Published: 2020-02-04
Description: Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html; https://hackerone.com/reports/719426
CVE: CVE-2020-8120
Published: 2020-02-04
Description: A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/605915; https://nextcloud.com/security/advisory/?id=NC-SA-2019-004; https://hackerone.com/reports/605915
CVE: CVE-2020-8121
Published: 2020-02-04
Description: A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-668
References: https://hackerone.com/reports/452854; https://nextcloud.com/security/advisory/?id=NC-SA-2019-003; https://hackerone.com/reports/452854
CVE: CVE-2020-8122
Published: 2020-02-04
Description: A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-20
References: https://hackerone.com/reports/447494; https://nextcloud.com/security/advisory/?id=NC-SA-2019-002; https://hackerone.com/reports/447494
CVE: CVE-2020-8123
Published: 2020-02-04
Description: A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://hackerone.com/reports/768574; https://hackerone.com/reports/768574
CVE: CVE-2020-8124
Published: 2020-02-04
Description: Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://hackerone.com/reports/496293; https://hackerone.com/reports/496293
CVE: CVE-2020-8125
Published: 2020-02-04
Description: Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://hackerone.com/reports/778414; https://hackerone.com/reports/778414
CVE: CVE-2020-8449
Published: 2020-02-04
Description: An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html; http://www.squid-cache.org/Advisories/SQUID-2020_1.txt
CVE: CVE-2020-8450
Published: 2020-02-04
Description: An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.
CVSS Score: 7.3 (HIGH)
CWE: CWE-131, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html; http://www.squid-cache.org/Advisories/SQUID-2020_1.txt
CVE: CVE-2020-8517
Published: 2020-02-04
Description: An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
CVE: CVE-2020-8615
Published: 2020-02-04
Description: A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html; https://wpvulndb.com/vulnerabilities/10058; https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
CVE: CVE-2015-2802
Published: 2020-02-04
Description: An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive information. This is the TLS vulnerability known as the RC4 cipher Bar Mitzvah vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0289&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7220&w=2; http://www.securityfocus.com/bid/75258
CVE: CVE-2019-10786
Published: 2020-02-04
Description: network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-NETWORKMANAGER-544035; https://snyk.io/vuln/SNYK-JS-NETWORKMANAGER-544035
CVE: CVE-2019-10787
Published: 2020-02-04
Description: im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Turistforeningen/node-im-resize/commit/de624dacf6a50e39fe3472af1414d44937ce1f03; https://snyk.io/vuln/SNYK-JS-IMRESIZE-544183; https://github.com/Turistforeningen/node-im-resize/commit/de624dacf6a50e39fe3472af1414d44937ce1f03
CVE: CVE-2019-10788
Published: 2020-02-04
Description: im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Turistforeningen/node-im-metadata/commit/ea15dddbe0f65694bfde36b78dd488e90f246639; https://snyk.io/vuln/SNYK-JS-IMMETADATA-544184; https://github.com/Turistforeningen/node-im-metadata/commit/ea15dddbe0f65694bfde36b78dd488e90f246639
CVE: CVE-2019-12528
Published: 2020-02-04
Description: An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
CVE: CVE-2020-5208
Published: 2020-02-05
Description: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.
CVSS Score: 7.7 (HIGH)
CWE: CWE-120, CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00031.html; https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac65e8b341f2; https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp
CVE: CVE-2020-5237
Published: 2020-02-05
Description: Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/1up-lab/OneupUploaderBundle/commit/a6011449b716f163fe1ae323053077e59212350c; https://github.com/1up-lab/OneupUploaderBundle/security/advisories/GHSA-x8wj-6m73-gfqp; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-003.txt
CVE: CVE-2020-8631
Published: 2020-02-05
Description: cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-330
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html; https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795; https://github.com/canonical/cloud-init/pull/204
CVE: CVE-2020-8632
Published: 2020-02-05
Description: In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-521
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html; https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795; https://github.com/canonical/cloud-init/pull/189
CVE: CVE-2020-7216
Published: 2020-02-05
Description: An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00005.html; https://bugzilla.suse.com/show_bug.cgi?id=1160905; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00005.html
CVE: CVE-2020-7979
Published: 2020-02-05
Description: GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-8114
Published: 2020-02-05
Description: GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/releases/categories/releases/; https://gitlab.com/gitlab-org/gitlab/issues/37468
CVE: CVE-2013-0507
Published: 2020-02-05
Description: IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: http://www.securityfocus.com/bid/59815; http://www.securityfocus.com/bid/59815
CVE: CVE-2019-16203
Published: 2020-02-05
Description: Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line option when configuring the ESRS client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-906; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/