deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-20719
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D8500 before 1.0.3.43, R6250 before 1.0.4.34, R6400 before 1.0.1.44, R6400v2 before 1.0.2.62, R7000P before 1.4.1.30, R7100LG before 1.0.0.48, R7300DST before 1.0.0.68, R7900 before 1.0.3.8, R7900P before 1.4.1.30, R8000 before 1.0.4.28, R8000P before 1.4.1.30, R8300 before 1.0.2.128, and R8500 before 1.0.2.128.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://kb.netgear.com/000061209/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2018-0194; https://kb.netgear.com/000061209/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-and-Gateways-PSV-2018-0194
CVE: CVE-2019-20720
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D7800 before 1.0.1.47, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN2000RPTv3 before 1.0.1.32, WN3000RPv3 before 1.0.2.70, and WN3100RPv2 before 1.0.0.66.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000061208/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2018-0174; https://kb.netgear.com/000061208/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2018-0174
CVE: CVE-2019-20721
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.47, EX2700 before 1.0.1.48, EX6100v2 before 1.0.1.76, EX6150v2 before 1.0.1.76, EX6200v2 before 1.0.1.72, EX6400 before 1.0.2.136, EX7300 before 1.0.2.136, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN2000RPTv3 before 1.0.1.32, WN3000RPv2 before 1.0.0.68, WN3000RPv3 before 1.0.2.70, WN3100RPv2 before 1.0.0.66, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.66, XR450 before 2.3.2.32, and XR500 before 2.3.2.32.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000061207/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-Extenders-PSV-2018-0159; https://kb.netgear.com/000061207/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-Extenders-PSV-2018-0159
CVE: CVE-2019-20722
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44, DM200 before 1.0.0.58, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, RBS40 before 2.3.0.28, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000061206/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0148; https://kb.netgear.com/000061206/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0148
CVE: CVE-2019-20723
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0.0.63, DM200 before 1.0.0.58, EX2700 before 1.0.1.48, EX6100v2 before 1.0.1.76, EX6150v2 before 1.0.1.76, EX6200v2 before 1.0.1.72, EX6400 before 1.0.2.136, EX7300 before 1.0.2.136, EX8000 before 1.0.1.180, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WN2000RPTv3 before 1.0.1.32, WN3000RPv2 before 1.0.0.68, WN3000RPv3 before 1.0.2.70, WN3100RPv2 before 1.0.0.60, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000061205/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2018-0146; https://kb.netgear.com/000061205/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2018-0146
CVE: CVE-2019-20724
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0.0.63, D7800 before 1.0.1.44, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, RBS40 before 2.3.0.28, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000061204/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0144; https://kb.netgear.com/000061204/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0144
CVE: CVE-2019-20725
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0.0.63, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000061203/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2018-0143; https://kb.netgear.com/000061203/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2018-0143
CVE: CVE-2019-20726
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0.0.63, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000061202/Security-Advisory-for-Post-Authentication-Command-on-Some-Routers-and-Gateways-PSV-2018-0141; https://kb.netgear.com/000061202/Security-Advisory-for-Post-Authentication-Command-on-Some-Routers-and-Gateways-PSV-2018-0141
CVE: CVE-2019-20727
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before 1.0.0.63, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000061201/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2018-0139; https://kb.netgear.com/000061201/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2018-0139
CVE: CVE-2020-10707
Published: 2020-04-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-11612. Reason: This candidate is a reservation duplicate of CVE-2020-11612. Notes: All CVE users should reference CVE-2020-11612 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-11007
Published: 2020-04-16
Description: In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e[PII_REDACTED]787ad2a; https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-w8rc-pgxq-x2cj; https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e[PII_REDACTED]787ad2a
CVE: CVE-2020-11811
Published: 2020-04-16
Description: In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://fatihhcelik.blogspot.com/2020/01/qdpm-web-based-project-management.html; https://fatihhcelik.blogspot.com/2020/01/qdpm-web-based-project-management.html
CVE: CVE-2020-11812
Published: 2020-04-16
Description: Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-filters0value.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-filters1value.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-filters0value.html
CVE: CVE-2020-11813
Published: 2020-04-16
Description: In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-stored-xss.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-stored-xss.html
CVE: CVE-2020-11814
Published: 2020-04-16
Description: A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://fatihhcelik.blogspot.com/2020/01/qdpm-web-based-project-management_11.html; https://fatihhcelik.blogspot.com/2020/01/qdpm-web-based-project-management_11.html
CVE: CVE-2020-11815
Published: 2020-04-16
Description: In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs without the Maintenance Mode setting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-rce.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-rce.html
CVE: CVE-2020-11816
Published: 2020-04-16
Description: Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-reportsid-post.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-reportsid-post.html
CVE: CVE-2020-11818
Published: 2020-04-16
Description: In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-csrf-bypass-privilege.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-csrf-bypass-privilege.html
CVE: CVE-2020-11819
Published: 2020-04-16
Description: In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-rce-via.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-rce-via.html
CVE: CVE-2020-11820
Published: 2020-04-16
Description: Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-entitiesid.html; https://fatihhcelik.blogspot.com/2020/01/rukovoditel-sql-injection-entitiesid.html
CVE: CVE-2020-11823
Published: 2020-04-16
Description: In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2020/04/dolibarr-stored-xss.html; https://fatihhcelik.blogspot.com/2020/04/dolibarr-stored-xss.html
CVE: CVE-2020-11825
Published: 2020-04-16
Description: In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://fatihhcelik.blogspot.com/2020/04/dolibarr-csrf.html; https://fatihhcelik.blogspot.com/2020/04/dolibarr-csrf.html
CVE: CVE-2020-11826
Published: 2020-04-16
Description: Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a database without encryption and an attacker can read the password-protected notes without having the password. Notes are stored in the ZENTITY table in the memono.sqlite database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://fatihhcelik.blogspot.com/2020/02/memono-insecure-data-storage-ios.html; https://fatihhcelik.blogspot.com/2020/02/memono-insecure-data-storage-ios.html
CVE: CVE-2020-1964
Published: 2020-04-16
Description: It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/r16dd39f4180e4443ef4ca774a3a5a3d7ac69f91812c183ed2a99e959%40%3Cdev.heron.apache.org%3E; https://lists.apache.org/thread.html/rd43ae18588fd7bdb375be63bc95a651aab319ced6306759e1237ce67%40%3Cdev.ignite.apache.org%3E; https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94%40%3Cdev.ignite.apache.org%3E
CVE: CVE-2020-2177
Published: 2020-04-16
Description: Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2020/04/16/4; https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1556; http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE: CVE-2020-2178
Published: 2020-04-16
Description: Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/04/16/4; https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1753; http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE: CVE-2020-2179
Published: 2020-04-16
Description: Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2020/04/16/4; https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1825; http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE: CVE-2020-2180
Published: 2020-04-16
Description: Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2020/04/16/4; https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1736; http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE: CVE-2020-7110
Published: 2020-04-16
Description: ClearPass is vulnerable to Stored Cross Site Scripting by allowing a malicious administrator, or a compromised administrator account, to save malicious scripts within ClearPass that could be executed resulting in a privilege escalation attack. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt
CVE: CVE-2020-7111
Published: 2020-04-16
Description: A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt
CVE: CVE-2020-7113
Published: 2020-04-16
Description: A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher.
CVSS Score: 4.9 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt
CVE: CVE-2020-7114
Published: 2020-04-16
Description: A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in ClearPass by crafting HTTP packets. As a result of this attack, a possible complete cluster compromise might occur. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt
CVE: CVE-2020-7224
Published: 2020-04-16
Description: The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the parameters could allow unauthorized third-party libraries to load.
CVSS Score: 9.8 (CRITICAL)
References: https://docs.aviatrix.com/#security-bulletin; https://docs.aviatrix.com/HowTos/security_bulletin_article.html; https://docs.aviatrix.com/HowTos/security_bulletin_article.html#article-avxsb-00001
CVE: CVE-2020-7483
Published: 2020-04-16
Description: **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vulnerability was discovered in and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. The 'password' feature is an additional optional check performed by TS1131 that it is connected to a specific controller. This data is sent as clear text and is visible on the network. This feature is not present in TriStation 1131 versions v4.9.1 and v4.10.1 through current. Therefore, the vulnerability is not present in these versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01; https://www.se.com/ww/en/download/document/SESB-2020-105-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
CVE: CVE-2020-7484
Published: 2020-04-16
Description: **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability with the former 'password' feature could allow a denial of service attack if the user is not following documented guidelines pertaining to dedicated TriStation connection and key-switch protection. This vulnerability was discovered and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. This feature is not present in version v4.9.1 and v4.10.1 through current. Therefore, the vulnerability is not present in these versions.
CVSS Score: 7.5 (HIGH)
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01; https://www.se.com/ww/en/download/document/SESB-2020-105-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
CVE: CVE-2020-7485
Published: 2020-04-16
Description: **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy support account in the TriStation software version v4.9.0 and earlier could cause improper access to the TriStation host machine. This was addressed in TriStation version v4.9.1 and v4.10.1 released on May 30, 2013.1
CVSS Score: 9.8 (CRITICAL)
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01; https://www.se.com/ww/en/download/document/SESB-2020-105-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
CVE: CVE-2020-7486
Published: 2020-04-16
Description: **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. This vulnerability was discovered and remediated in version v10.5.x on August 13, 2009. TCMs from v10.5.x and on will no longer exhibit this behavior.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01; https://www.se.com/ww/en/download/document/SESB-2020-105-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
CVE: CVE-2019-20728
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6400 before 1.0.0.74, D7000v2 before 1.0.0.74, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.102, DGND2200Bv4 before 1.0.0.102, DM200 before 1.0.0.52, JNDR3000 before 1.0.0.22, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, RBW30 before 2.1.2.6, R6250 before 1.0.4.26, R6300v2 before 1.0.4.24, R6400 before 1.0.1.36, R6400v2 before 1.0.2.52, R6700 before 1.0.1.44, R6900 before 1.0.1.44, R7000 before 1.0.9.26, R6900P before 1.3.0.20, R7000P before 1.3.0.20, R7100LG before 1.0.0.40, R7300DST before 1.0.0.62, R7500v2 before 1.0.3.26, R7800 before 1.0.2.44, R7900 before 1.0.2.10, R8000 before 1.0.4.12, R7900P before 1.3.0.10, R8000P before 1.3.0.10, R8300 before 1.0.2.116, R8500 before 1.0.2.116, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR3400v3 before 1.0.1.18, WNDR3700v4 before 1.0.2.96, WNDR4300v1 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, WNR2000v5 before 1.0.0.64, and WNR3500Lv2 before 1.2.0.48.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://kb.netgear.com/000061199/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2017-315; https://kb.netgear.com/000061199/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2017-315