deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7565
Published: 2020-11-19
Description: A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
CVSS Score: 7.3 (HIGH)
CWE: CWE-326
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04; https://www.se.com/ww/en/download/document/SEVD-2020-315-05/; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE: CVE-2020-7566
Published: 2020-11-19
Description: A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
CVSS Score: 7.3 (HIGH)
CWE: CWE-334
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04; https://www.se.com/ww/en/download/document/SEVD-2020-315-05/; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE: CVE-2020-7567
Published: 2020-11-19
Description: A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-311
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04; https://www.se.com/ww/en/download/document/SEVD-2020-315-05/; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE: CVE-2020-7568
Published: 2020-11-19
Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04; https://www.se.com/ww/en/download/document/SEVD-2020-315-05/; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE: CVE-2020-7569
Published: 2020-11-19
Description: A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-04/; https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE: CVE-2020-7570
Published: 2020-11-19
Description: A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-04/; https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE: CVE-2020-7571
Published: 2020-11-19
Description: A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-04/; https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE: CVE-2020-7572
Published: 2020-11-19
Description: A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-04/; https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE: CVE-2020-7573
Published: 2020-11-19
Description: A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-04/; https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE: CVE-2020-4788
Published: 2020-11-20
Description: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
CVSS Score: 4.7 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/11/20/3; http://www.openwall.com/lists/oss-security/2020/11/23/1; https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
CVE: CVE-2020-5668
Published: 2020-11-20
Description: Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/120SFCPU firmware version '22' and earlier, R08/16/32/120PCPU firmware version '25' and earlier, R08/16/32/120PSFCPU firmware version '06' and earlier, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware version '07' and earlier, RJ71GP21-SX firmware version '47' and earlier, RJ71GP21S-SX firmware version '47' and earlier, and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication, or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://jvn.jp/vu/JVNVU95980140/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdf
CVE: CVE-2020-4739
Published: 2020-11-20
Description: IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 188149.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188149; https://www.ibm.com/support/pages/node/6370023; https://exchange.xforce.ibmcloud.com/vulnerabilities/188149
CVE: CVE-2020-4937
Published: 2020-11-20
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 191814.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191814; https://www.ibm.com/support/pages/node/6370795; https://exchange.xforce.ibmcloud.com/vulnerabilities/191814
CVE: CVE-2020-13671
Published: 2020-11-20
Description: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/; https://www.drupal.org/sa-core-2020-012
CVE: CVE-2020-19667
Published: 2020-11-20
Description: Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/ImageMagick/ImageMagick/issues/1895; https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2020-19668
Published: 2020-11-20
Description: Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/saitoha/libsixel/issues/136; https://github.com/saitoha/libsixel/issues/136
CVE: CVE-2020-25839
Published: 2020-11-20
Description: NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html; https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html
CVE: CVE-2020-28877
Published: 2020-11-20
Description: Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/peanuts62/TP-Link-poc; https://exchange.xforce.ibmcloud.com/vulnerabilities/192112; https://github.com/peanuts62/TP-Link-poc
CVE: CVE-2020-7842
Published: 2020-11-20
Description: Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users. This affects D'live set-top box AP(WF2429TB) v1.1.10.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797
CVE: CVE-2020-26236
Published: 2020-11-20
Description: In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/ScratchVerifier/ScratchVerifier/commit/a603769010abf8c1bede91af46e4945314e4aa4a; https://github.com/ScratchVerifier/ScratchVerifier/security/advisories/GHSA-99cr-hvf7-85g9; https://github.com/ScratchVerifier/ScratchVerifier/commit/a603769010abf8c1bede91af46e4945314e4aa4a
CVE: CVE-2020-28974
Published: 2020-11-20
Description: A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2020/11/25/1; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.7; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c4e0dff2095c579b142d5a0693257f1c58b4804
CVE: CVE-2020-20739
Published: 2020-11-20
Description: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-909
References: https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031a; https://github.com/libvips/libvips/issues/1419; https://lists.debian.org/debian-lts-announce/2020/11/msg00049.html
CVE: CVE-2020-20740
Published: 2020-11-20
Description: PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/enferex/pdfresurrect/commit/1b422459f07353adce2878806d5247d9e91fb397; https://github.com/enferex/pdfresurrect/issues/14; https://lists.debian.org/debian-lts-announce/2020/12/msg00002.html
CVE: CVE-2020-28845
Published: 2020-11-20
Description: A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: http://the-it-wonders.blogspot.com/2020/11/netskope-csv-injection-in-admin-ui.html; http://the-it-wonders.blogspot.com/2020/11/netskope-csv-injection-in-admin-ui.html
CVE: CVE-2020-4004
Published: 2020-11-20
Description: VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi[PII_REDACTED]01-SG, 6.5 before ESXi[PII_REDACTED]01-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVSS Score: 8.2 (HIGH)
CWE: CWE-416
References: https://www.vmware.com/security/advisories/VMSA-2020-0026.html; https://www.vmware.com/security/advisories/VMSA-2020-0026.html
CVE: CVE-2020-4005
Published: 2020-11-20
Description: VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi[PII_REDACTED]01-SG, 6.5 before ESXi[PII_REDACTED]01-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004)
CVSS Score: 7.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2020-0026.html; https://www.vmware.com/security/advisories/VMSA-2020-0026.html
CVE: CVE-2020-25185
Published: 2020-11-21
Description: The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09).
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02
CVE: CVE-2020-25725
Published: 2020-11-21
Description: In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25725; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41915; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZUU5QG6SSVRTKZTR3A72LDRVZETEI63/
CVE: CVE-2020-5797
Published: 2020-11-21
Description: UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59
References: https://www.tenable.com/security/research/tra-2020-60; https://www.tenable.com/security/research/tra-2020-60
CVE: CVE-2020-25189
Published: 2020-11-21
Description: The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02
CVE: CVE-2020-14230
Published: 2020-11-21
Description: HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6, 10.0.1 FP5 and 11.0.1 are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085303; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085303
CVE: CVE-2020-14234
Published: 2020-11-21
Description: HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to crash the server. Versions previous to release 9.0.1 FP10 IF6 and release 10.0.1 are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085302; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085302
CVE: CVE-2020-14258
Published: 2020-11-21
Description: HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304
CVE: CVE-2020-28975
Published: 2020-11-21
Description: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/160281/SciKit-Learn-0.23.2-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2020/Nov/44; https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501
CVE: CVE-2020-27985
Published: 2020-11-23
Description: Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home/<user>/SecurityOnion/setup/so-setup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://github.com/Security-Onion-Solutions/securityonion/commit/b[PII_REDACTED]a2747a00ace665568ab5f51ac47b; https://github.com/Security-Onion-Solutions/securityonion/releases; https://s1gh.sh/cve-2020-27985-security-onion-local-privilege-escalation/
CVE: CVE-2020-28053
Published: 2020-11-23
Description: HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020; https://security.gentoo.org/glsa/202208-09; https://www.hashicorp.com/blog/category/consul
CVE: CVE-2020-7925
Published: 2020-11-23
Description: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-475, CWE-20
References: https://jira.mongodb.org/browse/SERVER-49142; https://jira.mongodb.org/browse/SERVER-49142
CVE: CVE-2020-7926
Published: 2020-11-23
Description: A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects MongoDB Server v4.4 versions prior to 4.4.1. Versions before 4.4 are not affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://jira.mongodb.org/browse/SERVER-50170; https://jira.mongodb.org/browse/SERVER-50170
CVE: CVE-2018-20802
Published: 2020-11-23
Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-394
References: https://jira.mongodb.org/browse/SERVER-36993; https://jira.mongodb.org/browse/SERVER-36993
CVE: CVE-2018-20804
Published: 2020-11-23
Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://jira.mongodb.org/browse/SERVER-35636; https://jira.mongodb.org/browse/SERVER-35636
CVE: CVE-2018-20805
Published: 2020-11-23
Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834, CWE-834
References: https://jira.mongodb.org/browse/SERVER-38164; https://jira.mongodb.org/browse/SERVER-38164
CVE: CVE-2019-14553
Published: 2020-11-23
Description: Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.tianocore.org/show_bug.cgi?id=960; https://bugzilla.tianocore.org/show_bug.cgi?id=960