deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11048
Published: 2020-05-07
Description: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.
CVSS Score: 2.2 (LOW)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/9301bfe730c[PII_REDACTED]8b74353daa99f5a969b; https://github.com/FreeRDP/FreeRDP/issues/6007; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hv8w-f2hx-5gcv
CVE: CVE-2020-11049
Published: 2020-05-07
Description: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/c367f65d42e0d2e1ca[PII_REDACTED]80aa9c2eacd0; https://github.com/FreeRDP/FreeRDP/issues/6008; https://github.com/FreeRDP/FreeRDP/pull/6019
CVE: CVE-2020-12116
Published: 2020-05-07
Description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.manageengine.com/network-monitoring/help/read-me-complete.html; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125125; https://www.manageengine.com/network-monitoring/help/read-me-complete.html
CVE: CVE-2020-12703
Published: 2020-05-07
Description: UliCMS before 2020.2 has XSS during PackageController uninstall.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://en.ulicms.de/aktuelles.html?single=xss-security-issue-in-packagecontroller-fixed; https://en.ulicms.de/aktuelles.html?single=xss-security-issue-in-packagecontroller-fixed
CVE: CVE-2020-12704
Published: 2020-05-07
Description: UliCMS before 2020.2 has PageController stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://en.ulicms.de/aktuelles.html?single=stored-xss-security-flaw-in-pagecontroller-fixed; https://en.ulicms.de/aktuelles.html?single=stored-xss-security-flaw-in-pagecontroller-fixed
CVE: CVE-2020-12705
Published: 2020-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lepton-cms.org/posts/important-security-update-141.php; https://lepton-cms.org/posts/important-security-update-141.php
CVE: CVE-2020-12706
Published: 2020-05-07
Description: Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/php-fusion/PHP-Fusion/commit/67273e546642d39451858a[PII_REDACTED]7c9abd5f; https://github.com/php-fusion/PHP-Fusion/issues/2306; https://www.exploit-db.com/exploits/48404
CVE: CVE-2020-12707
Published: 2020-05-07
Description: An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/lepton-cms/LEPTON/-/commit/52215f708395a329c9e17ea33bfc6762d4efccbb; https://gitlab.com/lepton-cms/LEPTON/-/commit/52215f708395a329c9e17ea33bfc6762d4efccbb
CVE: CVE-2020-12708
Published: 2020-05-07
Description: Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/php-fusion/PHP-Fusion/issues/2310; https://github.com/php-fusion/PHP-Fusion/issues/2310
CVE: CVE-2020-4427
Published: 2020-05-07
Description: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180532; https://www.ibm.com/support/pages/node/6206875; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2020-4428
Published: 2020-05-07
Description: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180533; https://www.ibm.com/support/pages/node/6206875; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2020-4429
Published: 2020-05-07
Description: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180534; https://www.ibm.com/support/pages/node/6206875; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2020-4430
Published: 2020-05-07
Description: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180535; https://www.ibm.com/support/pages/node/6206875; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2020-10176
Published: 2020-05-07
Description: ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devices allow Eval Injection of commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://firedome.io/blog/firedome-discloses-0-day-vulnerabilities-in-yale-ip-cameras/; https://lp.firedome.io/hubfs/Yale%20WIPC-301W%20RCE%20Vulnerability%20Report%205-6.pdf; https://firedome.io/blog/firedome-discloses-0-day-vulnerabilities-in-yale-ip-cameras/
CVE: CVE-2020-10794
Published: 2020-05-07
Description: Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined with CVE-2020-10795 for remote root access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/; https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE: CVE-2020-10795
Published: 2020-05-07
Description: Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/; https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE: CVE-2020-11050
Published: 2020-05-07
Description: In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-297, CWE-295
References: https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339; https://github.com/TooTallNate/Java-WebSocket/security/advisories/GHSA-gw55-jm4h-x339
CVE: CVE-2020-11052
Published: 2020-05-07
Description: In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0.
CVSS Score: 8.3 (HIGH)
CWE: CWE-307, CWE-307
References: https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7; https://github.com/Sorcery/sorcery/issues/231; https://github.com/Sorcery/sorcery/pull/235
CVE: CVE-2020-11053
Published: 2020-05-07
Description: In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. However, by crafting a redirect URL with HTML encoded whitespace characters the validation could be bypassed and allow a redirect to any URL provided. This has been patched in 5.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601, CWE-601
References: https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg; https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg
CVE: CVE-2020-11054
Published: 2020-05-07
Description: In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.
CVSS Score: 3.5 (LOW)
CWE: CWE-684
References: https://bugs.kde.org/show_bug.cgi?id=420902; https://github.com/qutebrowser/qutebrowser/commit/021ab572a319ca3db5907a33a59774f502b3b975; https://github.com/qutebrowser/qutebrowser/commit/19f01bb42d02da539446a52a25bb0c1232b86327
CVE: CVE-2020-11055
Published: 2020-05-07
Description: In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://jvn.jp/en/jp/JVN41035278/index.html; https://bookstackapp.com/blog/beta-release-v0-29-2/; https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2
CVE: CVE-2020-11056
Published: 2020-05-07
Description: In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.
CVSS Score: 7.4 (HIGH)
CWE: CWE-94, CWE-74
References: https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical; https://github.com/barrelstrength/craft-sprout-forms/security/advisories/GHSA-px8v-hxxx-2rgh; https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical
CVE: CVE-2020-9474
Published: 2020-05-07
Description: The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/; https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE: CVE-2020-9475
Published: 2020-05-07
Description: The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/; https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems/
CVE: CVE-2014-1423
Published: 2020-05-07
Description: signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/644; http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/645; https://bugs.launchpad.net/ubuntu/+source/signon/+bug/1392380
CVE: CVE-2015-7946
Published: 2020-05-07
Description: Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
CVSS Score: 7.3 (HIGH)
CWE: CWE-200, CWE-200
References: https://launchpad.net/bugs/1525981; https://launchpad.net/bugs/1525981
CVE: CVE-2020-10916
Published: 2020-05-07
Description: This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P1[20191213-rel60361] Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the first-time setup process. The issue results from the lack of proper validation on first-time setup requests. An attacker can leverage this vulnerability to reset the password for the Admin account and execute code in the context of the device. Was ZDI-CAN-10003.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.zerodayinitiative.com/advisories/ZDI-20-553/; https://www.zerodayinitiative.com/advisories/ZDI-20-553/
CVE: CVE-2020-12718
Published: 2020-05-08
Description: In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/php-fusion/PHP-Fusion/issues/2309; https://github.com/php-fusion/PHP-Fusion/issues/2309
CVE: CVE-2020-12719
Published: 2020-05-08
Description: XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665
CVE: CVE-2020-12720
Published: 2020-05-08
Description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-306
References: http://packetstormsecurity.com/files/157716/vBulletin-5.6.1-SQL-Injection.html; http://packetstormsecurity.com/files/157904/vBulletin-5.6.1-SQL-Injection.html; https://attackerkb.com/topics/RSDAFLik92/cve-2020-12720-vbulletin-incorrect-access-control
CVE: CVE-2012-0952
Published: 2020-05-08
Description: A heap buffer overflow was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards, which may allow an attacker to overflow 49 bytes. This issue was fixed in version 295.53.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers/+bug/979373; https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers/+bug/979373
CVE: CVE-2012-0953
Published: 2020-05-08
Description: A race condition was discovered in the Linux drivers for Nvidia graphics which allowed an attacker to exfiltrate kernel memory to userspace. This issue was fixed in version 295.53.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers/+bug/979373; https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers/+bug/979373
CVE: CVE-2020-12735
Published: 2020-05-08
Description: reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331
References: https://github.com/domainmod/domainmod/issues/122; https://github.com/domainmod/domainmod/issues/122
CVE: CVE-2020-10638
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-593/; https://www.zerodayinitiative.com/advisories/ZDI-20-599/
CVE: CVE-2020-12002
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-590/; https://www.zerodayinitiative.com/advisories/ZDI-20-591/
CVE: CVE-2020-12006
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-589/; https://www.zerodayinitiative.com/advisories/ZDI-20-595/
CVE: CVE-2020-12010
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files outside the application’s control.
CVSS Score: 7.1 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.us-cert.gov/ics/advisories/icsa-20-128-01
CVE: CVE-2020-12014
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-613/; https://www.us-cert.gov/ics/advisories/icsa-20-128-01
CVE: CVE-2020-12018
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-628/; https://www.us-cert.gov/ics/advisories/icsa-20-128-01
CVE: CVE-2020-12022
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-129
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-598/; https://www.us-cert.gov/ics/advisories/icsa-20-128-01
CVE: CVE-2020-12026
Published: 2020-05-08
Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-20-128-01; https://www.zerodayinitiative.com/advisories/ZDI-20-626/; https://www.us-cert.gov/ics/advisories/icsa-20-128-01
CVE: CVE-2020-7264
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10316; https://kc.mcafee.com/corporate/index?page=content&id=SB10316
CVE: CVE-2020-7265
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10316; https://kc.mcafee.com/corporate/index?page=content&id=SB10316
CVE: CVE-2020-7266
Published: 2020-05-08
Description: Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-274, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10316; https://kc.mcafee.com/corporate/index?page=content&id=SB10316