deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15367
Published: 2020-07-07
Description: Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/inflixim4be/CVE-2020-15367; https://www.venki.com.br/; https://github.com/inflixim4be/CVE-2020-15367
CVE: CVE-2020-15392
Published: 2020-07-07
Description: A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/inflixim4be/CVE-2020-15392; https://www.venki.com.br/; https://github.com/inflixim4be/CVE-2020-15392
CVE: CVE-2020-15509
Published: 2020-07-07
Description: Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://github.com/NordicSemiconductor/Android-BLE-Library/commits/master; https://github.com/NordicSemiconductor/Android-DFU-Library/commits/release; https://secretdiary.ninja/index.php/2020/07/03/norec-attack-stripping-ble-encryption-from-nordicsemis-android-library-cve-2020-15509/
CVE: CVE-2020-15513
Published: 2020-07-07
Description: The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-010; https://typo3.org/help/security-advisories
CVE: CVE-2020-15514
Published: 2020-07-07
Description: The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-012; https://typo3.org/help/security-advisories
CVE: CVE-2020-15516
Published: 2020-07-07
Description: The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-013; https://typo3.org/help/security-advisories
CVE: CVE-2020-15517
Published: 2020-07-07
Description: The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-009; https://typo3.org/help/security-advisories
CVE: CVE-2020-15525
Published: 2020-07-07
Description: GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/; https://about.gitlab.com/releases/categories/releases/; https://gitlab.com/gitlab-org/gitlab/-/issues/225259
CVE: CVE-2020-15573
Published: 2020-07-07
Description: SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15574
Published: 2020-07-07
Description: SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.
CVSS Score: 7.5 (HIGH)
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15575
Published: 2020-07-07
Description: SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15576
Published: 2020-07-07
Description: SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
CVSS Score: 7.5 (HIGH)
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15577
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID is SVE-2020-16830 (July 2020).
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15578
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-2020-17270 (July 2020).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15579
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via the KNOX API. The Samsung ID is SVE-2020-17318 (July 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15580
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) by enrolling a new lock password. The Samsung ID is SVE-2020-17328 (July 2020).
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15581
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual addresses via vectors involving shared memory. The Samsung ID is SVE-2020-17605 (July 2020).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15582
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software. The Bluetooth Low Energy (BLE) component has a buffer overflow with a resultant deadlock or crash. The Samsung ID is SVE-2020-16870 (July 2020).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15583
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. StickerProvider allows directory traversal for access to system files. The Samsung ID is SVE-2020-17665 (July 2020).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-15584
Published: 2020-07-07
Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can trigger an out-of-bounds access and device reset via a 4K wallpaper image because ImageProcessHelper mishandles boundary checks. The Samsung ID is SVE-2020-18056 (July 2020).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-4323
Published: 2020-07-07
Description: "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080572; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080572&sys_kb_id=3668a078dbb9101855f38d6d13961955; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080572
CVE: CVE-2019-4324
Published: 2020-07-07
Description: "HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sys_id=cd5030b4dbbd101855f38d6d13961958; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080574; https://support.hcltechsw.com/csm?id=kb_article&sys_id=cd5030b4dbbd101855f38d6d13961958
CVE: CVE-2020-15036
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19; https://www.nedi.ch/download/; https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19
CVE: CVE-2020-15037
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st[] parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19; https://www.nedi.ch/download/; https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19
CVE: CVE-2019-19935
Published: 2020-07-07
Description: Froala Editor before 3.2.3 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158300/Froala-WYSIWYG-HTML-Editor-3.1.1-Cross-Site-Scripting.html; https://blog.compass-security.com/2020/07/yet-another-froala-0-day-xss/; https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2020-004_DOM_XSS_in_Froala_WYSIWYG_HTML_Editor.txt
CVE: CVE-2020-11882
Published: 2020-07-07
Description: The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly validated. This can be abused by an attacker to redirect a user to any page and deliver any content to the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/158302/Android-o2-Business-1.2.0-Open-Redirect.html; https://rcesecurity.com/; http://packetstormsecurity.com/files/158302/Android-o2-Business-1.2.0-Open-Redirect.html
CVE: CVE-2020-15028
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.php xo parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15029
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15030
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Routes.php rtr parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15031
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15032
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Incidents.php id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15033
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the snmpget.php ip parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15034
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3; https://www.nedi.ch/download/; https://gist.github.com/p4nk4jv/68ae8b773dbea6d8769295ba96d9f1e3
CVE: CVE-2020-15035
Published: 2020-07-07
Description: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.php hde parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19; https://www.nedi.ch/download/; https://gist.github.com/sudoninja-noob/c1722c118abc7a562a9a0de726266a19
CVE: CVE-2020-15515
Published: 2020-07-07
Description: The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
CVSS Score: 8.8 (HIGH)
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-011; https://typo3.org/help/security-advisories
CVE: CVE-2020-15350
Published: 2020-07-07
Description: RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the required buffer capacity and validate against the provided buffer size. The base64_estimate_decode_size() function calculates the expected decoded size with an arithmetic round-off error and does not take into account possible padding bytes. Due to this underestimation, it may be possible to craft base64 input that causes a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-131
References: https://drive.google.com/file/d/1jMCAi8uawV1-an5uCghIxT2TEdxCE1Lk/view?usp=sharing; https://github.com/RIOT-OS/RIOT/pull/14400; https://drive.google.com/file/d/1jMCAi8uawV1-an5uCghIxT2TEdxCE1Lk/view?usp=sharing
CVE: CVE-2019-20896
Published: 2020-07-07
Description: WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://sourceforge.net/p/webchess/bugs/81/; https://sourceforge.net/p/webchess/bugs/81/
CVE: CVE-2020-15095
Published: 2020-07-07
Description: Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html
CVE: CVE-2020-12736
Published: 2020-07-07
Description: Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://code42.com/r/support/CVE-2020-12736; https://support.code42.com/Release_Notes; https://code42.com/r/support/CVE-2020-12736
CVE: CVE-2020-12821
Published: 2020-07-07
Description: Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVSS Score: 9.8 (CRITICAL)
References: https://bitcoin.stackexchange.com/questions/61151/eclipse-attack-vs-sybil-attack; https://gateway.ipfs.io/ipfs/QmPWuNBs8h6a8KamRvGqhTq5UDYJRQsEEy37zDKjujQQQm/Gossipsub%20Evaluation%20Report.pdf; https://github.com/ipfs/blog/pull/450
CVE: CVE-2020-15008
Published: 2020-07-07
Description: A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://slagle.tech/2020/07/06/cve-2020-15008/; https://slagle.tech/2020/07/06/cve-2020-15008/
CVE: CVE-2020-8519
Published: 2020-07-07
Description: SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2020/07/09/1; http://www.vapidlabs.com/advisory.php?v=213; https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/
CVE: CVE-2020-8520
Published: 2020-07-07
Description: SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2020/07/09/1; http://www.vapidlabs.com/advisory.php?v=213; https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/
CVE: CVE-2020-8521
Published: 2020-07-07
Description: SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2020/07/09/1; http://www.vapidlabs.com/advisory.php?v=213; https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/
CVE: CVE-2020-15599
Published: 2020-07-07
Description: Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/48626; https://www.exploit-db.com/exploits/48626
CVE: CVE-2020-8916
Published: 2020-07-07
Description: A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to restrict access in your debug environments.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/openthread/wpantund/pull/468/commits/0e5d1601febb869f583e944785e5685c6c747be7; https://github.com/openthread/wpantund/pull/468/commits/0e5d1601febb869f583e944785e5685c6c747be7
CVE: CVE-2020-15600
Published: 2020-07-07
Description: An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/158455/CMSUno-1.6-Cross-Site-Request-Forgery.html; https://github.com/boiteasite/cmsuno/issues/15; http://packetstormsecurity.com/files/158455/CMSUno-1.6-Cross-Site-Request-Forgery.html
CVE: CVE-2020-3931
Published: 2020-07-08
Description: Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.acronis.com/en-us/blog/posts/backdoor-wide-open-critical-vulnerabilities-uncovered-geovision; https://www.twcert.org.tw/tw/cp-132-3754-b77d0-1.html; https://www.acronis.com/en-us/blog/posts/backdoor-wide-open-critical-vulnerabilities-uncovered-geovision
CVE: CVE-2020-11849
Published: 2020-07-08
Description: Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prior to 4.7.3 and 4.8.1 hot fix 1. The vulnerability could allow information exposure that can result in an elevation of privilege or an unauthorized access.
CVSS Score: 9.8 (CRITICAL)
References: https://www.netiq.com/documentation/identity-manager-47/releasenotes_idm4741_apps/data/releasenotes_idm4741_apps.html; https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4811_apps/data/releasenotes_idm4811_apps.html; https://www.netiq.com/documentation/identity-manager-47/releasenotes_idm4741_apps/data/releasenotes_idm4741_apps.html
CVE: CVE-2020-3973
Published: 2020-07-08
Description: The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.vmware.com/security/advisories/VMSA-2020-0016.html; https://www.vmware.com/security/advisories/VMSA-2020-0016.html